News Media & Section 7: 5 Legitimate Uses That Don't Require Consent Under DPDPA

Applies to	News organizations, photo media houses, and journalistic enterprises in India
Primary law	DPDPA 2023 · Section 7
Penalty ceiling	up to ₹150 crore
Enforcement status	Data Protection Board accepting complaints — 2026-08
Source	DPDPAReady Compliance Team

Understanding DPDPA Section 7: The Closed List for News Media

News organizations and photojournalists in India often assume they can publish personal data in the “public interest” without consent. This is incorrect. The Digital Personal Data Protection Act, 2023 does not recognize “public interest” as a blanket exemption. Instead, Section 7 establishes a closed, exhaustive list of situations where processing is allowed without consent.

Verbatim Section 7 states:

“Personal data may be processed without the consent of the individual in the following cases: (a) voluntarily provided personal data; (b) by the State or any agency or instrumentality of the State for State functions; (c) to comply with any law, court order, or directions issued by any statutory authority; (d) in a medical emergency; (e) for employment purposes; and (f) in the context of a merger, amalgamation, or acquisition.”

For news media, the operative grounds are: (a) voluntarily provided data (when a source or eyewitness deliberately gives you their information for a story), (c) compliance with law (when a court order directs publication), and (e) employment purposes (newsroom staff records). Critically, none of these is “public interest.” If your story doesn’t fit one of the six listed grounds, you must obtain consent or face penalties up to ₹150 crore.

How News Organizations Apply Section 7: 6 Implementation Steps

Step 1: Document Voluntary Disclosure at Point of Collection

Section 7(a) — voluntarily provided personal data — is your primary defense for source interviews and eyewitness accounts. But voluntariness must be demonstrable, not assumed.

How to implement:

• For recorded interviews: keep the full audio/video with timestamp and identifier (source name, date, location).
• For written submissions: retain the email, message, or signed statement showing the individual provided data with knowledge it would be used for publication.
• For on-site photography: document the context — was it a public event? Did attendees know media was present? Archive geotags and timestamps.
• For studio/posed shots: obtain a signed model release or verbal consent recording before publication.

Example: A whistleblower emails you a story tip with their name and role. That email is proof of voluntary disclosure under Section 7(a). A photo taken in a crowded street of a person’s face (without prior knowledge they’d appear in your publication) is NOT voluntarily provided — that requires consent or a Section 7(c) court order.

Step 2: Distinguish Section 7(c) (Court Orders) from Routine Legal Coverage

Section 7(c) allows publication when a court order or statutory authority directive requires it. This is often misapplied.

How to implement:

• Before publishing an accused’s name or photo in a crime story, ask: Did a court release this? Or did police provide it as part of a formal public record?
• If the court publishes bail documents or a judgment naming the accused, you have Section 7(c) grounds.
• If police merely tell you an arrest happened, that is NOT Section 7(c) — you need the arrested person’s consent or their voluntary disclosure to media.
• Maintain a register linking each story to the specific court order or statutory direction.

Example: A court judgment convicts person X and directs publication of their name and photo as a warning to others. Section 7(c) applies. A police arrest announcement without court direction? You need consent.

Step 3: Identify Employee Data vs. Published Story Data (Section 7(e))

Section 7(e) allows processing employee personal data for employment purposes without consent. This is straightforward but easily overextended.

How to implement:

• Segregate newsroom staff records (salary, address, ID proof) from published story content.
• Employee data can be used for HR, payroll, and statutory compliance only.
• Do NOT add employee contact details to marketing lists or promotional campaigns without separate consent.
• Do NOT use a photographer’s personal data (home address, phone) for non-employment purposes.

Step 4: Avoid the “Public Interest” Trap

The most common violation among Indian news organizations is claiming Section 7 exemption based on “public interest.” Public interest is not a Section 7 ground. Full stop.

How to implement:

• Establish a pre-publication checklist: “Is this story based on (a) voluntary disclosure, (c) a court order, (e) employee data, or (b) state function?” If none apply, get consent.
• Train editorial teams that “newsworthy” and “important to society” do not translate to Section 7 grounds.
• If you’re publishing a sensitive story (corruption, abuse, scandal) and cannot point to one of the six grounds, obtain consent or anonymize identifying details.

Step 5: Document the Basis for Every High-Risk Story

For stories involving personal data — especially crime, litigation, health, or finance — create a basis record before publication.

How to implement:

• For each story with personal data, write: “This article relies on Section 7(__) because: [reason]. Evidence: [proof — court order, interview recording, email, etc.]”
• Examples:
  • Arrest story: “Section 7(c) — per court remand order, case number XYZ, dated [date].”
  • Interview with survivor: “Section 7(a) — recorded phone interview, 45 min, consent to publish obtained verbally, transcript archived.”
  • Employee quoted internally: “Section 7(e) — employee performing their job duties as reporter.”
• Keep this record for at least 6 months per regulatory best practice.

Step 6: Audit and Remediate Older Stories

DPDPA is now in effect. If you published stories in the past year relying on “public interest,” you may be exposed to enforcement action.

How to implement:

• Audit 50–100 of your highest-traffic stories from the last 18 months.
• For each story with personal data, identify the Section 7 basis or lack thereof.
• For stories with no valid basis: consider whether you can obtain retroactive consent, anonymize, or delete.
• Document the audit and corrective steps; regulators are more lenient with organizations that self-report and remediate.

Why News Organizations Fail Section 7 Compliance

Failure #1: Assuming “newsworthy = consent-free.” News organizations often argue that because a story is in the public interest, they can publish without Section 7 grounds. Section 7 doesn’t care about public interest — it cares about whether your processing fits one of six enumerated categories.

Failure #2: Conflating police disclosure with court orders. If police release an accused’s name, that is NOT Section 7(c) unless a court has directed it. Many organizations assume police authority = legal authorization; it does not.

Failure #3: Not documenting voluntary disclosure. A source tells you their story on the phone. That’s voluntary disclosure — but only if you can prove it (recording, email, witness). A vague recollection is not proof.

Failure #4: Publishing employee data beyond employment scope. A journalist’s home phone appears in the publication because they were part of a team story. Section 7(e) doesn’t cover this — it only covers employment-necessary data.

Failure #5: Misinterpreting Section 7(b) — State functions. Only government agencies performing official duties can claim 7(b). News organizations cannot.

Actionable Compliance Checklist

• Retain interview recordings, emails, or consent forms documenting voluntary disclosure for every source story.
• Create a registry of court orders and statutory directives authorizing publication.
• Implement a pre-publication checklist: “Which Section 7 ground does this story rely on? Do I have proof?”
• Segregate employee personal data (HR, payroll) from published story systems.
• Remove or anonymize personal data in older stories lacking a valid Section 7 basis.
• Train editorial staff on the difference between Section 7 grounds and public interest.
• Archive basis records (court order, interview proof, etc.) for each high-risk story for at least 6 months.
• Conduct a quarterly audit of 20–30 recent stories; verify Section 7 basis for each.

Frequently Asked Questions

Q1: If I publish someone’s photo from a public event (concert, protest, rally), do I need consent? A: It depends on whether they knew media would be present and consented to publication. If attendees were told “this is a public event; media may photograph and publish,” Section 7(a) applies — they voluntarily appeared. If you photograph someone walking on the street without their knowledge, consent is required unless a court order exists. The mere fact it was “public” does not activate Section 7.

Q2: A person was arrested and charged with a crime. Can I publish their name and photo without consent? A: Only if one of the following is true: (a) The arrested person gave you their name and photo voluntarily (Section 7(a)) — e.g., they called you, or they appeared in court; (b) A court issued a public judgment or bail order naming them (Section 7(c)); or (c) A statutory authority (like election commission) officially released their identity. If none of these apply, you need consent. Arrest reports alone do not authorize publication.

Q3: Our newsroom has a freelance photographer. Can we use their photo portfolio without paying them or getting consent? A: No. If the photographer owns the photo, you need their consent to publish (unless you have a work-for-hire agreement or a court order). Section 7 does not exempt you from obtaining consent from the data subject or image creator. The photographer’s prior consent to one use (e.g., portfolio display) does not carry over to news publication.

Q4: Can we interview an employee at their workplace and publish their comments about company policy without consent? A: If the employee is performing their job duties (e.g., a PR officer commenting on company policy), Section 7(e) allows you to publish their name and role. If the employee is speaking in a personal capacity about internal gossip or criticism, you need their consent — their employment doesn’t create a blanket license to publish their personal statements.

Q5: DPDPA took effect this year. If we published stories last year without consent, can we be fined? A: Yes. DPDPA applies retroactively to violations that occurred after its notification date. If you published without Section 7 grounds and without consent, regulators can impose penalties up to ₹150 crore. Conduct an audit, remediate high-risk stories (obtain consent, anonymize, or delete), and document your corrective steps. Organizations that self-report and fix violations face less severe enforcement.