The Supreme Court has sought the Centre’s response to a challenge against India’s data protection law over press freedom.
The Supreme Court on October 27 issued notice on a petition filed by the Digital News Publishers Association (DNPA), challenging several provisions of the Digital Personal Data Protection (DPDP) Act, 2023, and the DPDP Rules, 2025. The association argues that the legislation, particularly its absence of a specific exemption for journalism, could restrict news reporting, investigative work and the protection of confidential sources.
The petition has been filed under Article 32 of the Constitution and seeks to declare Sections 7, 17(2), 18, 19, 27, 29, 36, 37 and 44(3) of the DPDP Act unconstitutional. It also challenges Rules 16, 17 and 23 of the DPDP Rules, 2025.
FCRF’s Chief AI Officer Certification Returns on November 14 to Prepare Future AI Leaders
Why Are News Publishers Challenging the DPDP Act?
The DNPA represents the digital divisions of 21 major news organisations, including The Indian Express, The Hindu, India Today, Times Group, Zee, NDTV and Network18. Independent investigative journalist Yukta Mudgal is also a petitioner. The central concern is that the DPDP Act does not expressly exempt journalistic activities from requirements relating to notice, prior consent and erasure of personal data.
According to the petitioners, these obligations are incompatible with ordinary newsroom operations, particularly investigations involving corruption, misconduct in public office and other matters of public interest. They argue that requiring journalists to obtain consent from individuals whose conduct they are investigating could obstruct reporting before information reaches the public.
Senior advocate Madhavi Divan, appearing for the petitioners, warned that the requirements could fundamentally alter news gathering. She argued that journalism cannot depend on obtaining permission from the people being investigated.
The petition also highlights that earlier legislative proposals contained specific exemptions for journalism. The Personal Data Protection Bill, 2018, provided an exemption under Section 47, while the 2019 and 2021 proposals also included provisions for journalistic activities. However, the draft Digital Personal Data Protection Bill, 2022, did not retain a specific journalistic exemption and instead contemplated exemptions notified by the Central Government.
The petitioners further question Section 17(2), arguing that certain activities, including research, archiving and statistical processing, receive exemptions while journalism does not.
What Happened During the Supreme Court Hearing?
A bench comprising Chief Justice of India Surya Kant, Justice Joymalya Bagchi and Justice V Mohana heard submissions concerning the legislation’s possible implications for press freedom.
Divan argued that the absence of safeguards could make routine news reporting difficult, particularly when journalists handle personal information about individuals who may not consent to its publication. She also raised concerns about television journalism and time-sensitive reporting, where obtaining prior permission could make the reporting process impractical.
Chief Justice Surya Kant observed that a balance must be maintained between citizens’ rights and the rights of the media. The bench also suggested that the petitioners could assist the government by recommending safeguards against misuse.
The association informed the court that it had already submitted a detailed representation to the Ministries of Information and Broadcasting and Electronics and Information Technology on August 10, 2026. A subsequent meeting between DNPA representatives and ministry officials took place on August 25.
The Supreme Court issued notice on both the petition and the application seeking an interim stay on the challenged provisions. The matter is returnable on November 17, when it will be considered alongside other pending challenges.
How Could the Law Affect Sources and Public Information?
The petition raises concerns about Section 36 of the DPDP Act, read with Rule 23 and the Seventh Schedule of the DPDP Rules. According to the petitioners, these provisions give the Central Government broad powers to seek information from data fiduciaries and intermediaries without adequate safeguards relating to judicial oversight, necessity, proportionality or notification of affected individuals.
They argue that such powers could potentially identify confidential journalistic sources, discouraging whistleblowers from sharing information about matters of public importance.
The association has also challenged Section 37(1), which empowers the Central Government to restrict public access to information in specified circumstances. The petitioners contend that this power is excessively broad and could affect the dissemination of news.
Another significant challenge concerns Section 44(3) of the DPDP Act, which substitutes clause (j) of Section 8(1) of the Right to Information Act, 2005. The association argues that the amendment creates a broad restriction on the disclosure of personal information, without adequately distinguishing between private matters and information connected with public activity or larger public interest.
Under the earlier provision, disclosure could be refused where personal information had no relationship to public activity or interest, subject to the statutory framework and applicable exceptions. The petitioners maintain that the earlier provision better balanced privacy with the public’s right to know. They have also referred to the Supreme Court’s electoral bonds judgment in support of their arguments concerning access to information.
What Other Constitutional Concerns Have Been Raised?
The petition also questions the constitution and powers of the Data Protection Board of India under Sections 18, 19 and 27 of the DPDP Act. According to the petitioners, the Board exercises adjudicatory functions involving personal data breaches, statutory obligations and penalties, despite its chairperson and members being selected by the executive. They argue that the absence of a mandatory judicial member raises constitutional concerns about institutional safeguards.
The association also contends that the law treats journalists differently from the State, which receives exemptions for certain processing activities undertaken in connection with criminal law enforcement.
The Supreme Court has not ruled on the constitutional validity of the challenged provisions. Its decision to issue notice begins judicial consideration of the publishers’ objections and gives the Centre an opportunity to respond.
The420 Insight
The proceedings raise a significant question about how India’s data protection framework should balance individual privacy with investigative journalism, source confidentiality and public access to information. The Supreme Court’s examination will address concerns about whether safeguards intended to protect personal data could also restrict legitimate reporting in the public interest.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
