The Supreme Court on Tuesday issued notice to the Union government on a petition by the Digital News Publishers Association (DNPA) challenging provisions of the Digital Personal Data Protection (DPDP) Act, 2023, and the DPDP Rules, 2025, on the grounds that they could undermine press freedom, restrict investigative journalism and expose confidential sources.
A bench comprising Chief Justice of India Surya Kant and Justices Joymalya Bagchi and V Mohana issued notice on the petition and an accompanying application seeking a stay of the challenged provisions. The matter is returnable on November 17.
The petition has been filed under Article 32 of the Constitution by the DNPA, which represents the digital arms of 21 major news organisations, including The Indian Express, The Hindu, India Today, the Times Group, Zee, NDTV and Network18. Independent investigative journalist Yukta Mudgal, who is based in New Delhi, is also a petitioner.
The petitioners have sought a declaration that Sections 7, 17(2), 18, 19, 27, 29, 36, 37 and 44(3) of the DPDP Act are unconstitutional. They have also challenged Rules 16, 17 and 23 of the DPDP Rules, 2025.
Senior advocate Madhavi Divan, appearing for the petitioners, told the bench that the legislation could fundamentally alter the way newsrooms operate by imposing data protection obligations incompatible with routine journalistic work.
‘It will close down the newsroom’, DNPA tells Supreme Court
Divan described the petition as the first comprehensive challenge to the legislation by traditional media organisations, arguing that its provisions could make reporting dependent on the consent of the individuals being investigated.
“This is the first comprehensive petition by ‘legacy media’. We are the traditional, conventional legacy media. This will change the whole concept of news,” she submitted.
Questioning the requirement of consent, she argued that journalists could be prevented from publishing news if they had to seek permission from the people they were reporting on.
“News has to be new. It will close down the newsroom. What’s the point if I have to ask for permission and consent?” she told the bench.
Divan also argued that the legislation could introduce a system of pre-publication censorship by requiring journalists to obtain consent before reporting on individuals. She maintained that the press was already subject to regulation and should remain accountable for wrongdoing, but that reporting could not be frozen before publication.
The Chief Justice observed that the petitioners, as domain experts, were well placed to suggest safeguards to the government and the court to prevent misuse of personal data.
“You are the domain experts. You are the best person to suggest the Union and us how you will ensure there’s no misuse,” the CJI told the petitioners.
Divan responded that the DNPA had submitted a representation to the Centre after filing the petition. According to the petition, the association sent a detailed representation to the Ministries of Information and Broadcasting and Electronics and Information Technology on August 10, 2026, outlining its concerns over the implementation of the Act and Rules. A meeting between DNPA representatives and ministry officials followed on August 25.
The CJI stressed that a balance had to be maintained between citizens’ rights and the interests of the media.
Divan said the legislation was not originally intended to regulate journalism, pointing to earlier versions of the proposed data protection framework that contained specific exemptions for journalistic activities. She also informed the bench that other petitions challenging the amendment to the Right to Information (RTI) Act were pending before the Supreme Court, but the DNPA’s petition was the first comprehensive challenge focused on the legislation’s impact on journalism.
The bench issued notice on both the petition and the application for interim relief, fixing November 17 for the next hearing.
No specific exemption for journalistic activities
A central argument in the petition is that the DPDP Act does not expressly exempt journalistic activities from its data protection requirements.
The petitioners contend that publishers, editors, reporters and correspondents could be required to comply with rules on notice, prior consent and erasure of personal data, potentially making routine reporting and investigative journalism difficult.
Investigations into corruption, misconduct by public officials and other matters of public interest frequently involve collecting and publishing personal information without the subject’s knowledge or consent. According to the petitioners, requiring journalists to obtain permission from the very individuals whose conduct they are investigating could frustrate such reporting.
They have also raised concerns that individuals could withdraw consent or seek the erasure of personal information, potentially forcing publishers to remove or substantially redact factual reports.
The petition traces the evolution of India’s data protection legislation to argue that the omission of a specific journalistic exemption was not inevitable.
The Personal Data Protection Bill, 2018, provided an exemption for journalistic purposes under Section 47. Similar exemptions were included in the Personal Data Protection Bill, 2019, and the subsequent Data Protection Bill, 2021.
However, the draft Digital Personal Data Protection Bill, 2022, did not retain a specific exemption for journalism and instead contemplated exemptions to be notified by the Central Government.
The petitioners argue that the enacted legislation consequently leaves journalists and news publishers vulnerable to restrictions that could undermine their constitutional right to freedom of speech and expression.
They have also questioned Section 17(2), arguing that it creates an arbitrary distinction by granting exemptions to certain activities, including research, archiving and statistical processing, without providing comparable protection for journalism undertaken in the public interest.
The petition further argues that the State enjoys exemptions for certain data processing activities connected with the enforcement of criminal laws, while the press has not been granted a corresponding exemption for legitimate reporting.
The publishers maintain that the law fails to distinguish adequately between commercial processing of personal data and the collection and publication of information for public-interest journalism.
Government powers and the risk to confidential sources
The petitioners have challenged Section 36 of the DPDP Act, read with Rule 23 and the Seventh Schedule of the DPDP Rules, which they say grant the Central Government broad powers to demand information from data fiduciaries and intermediaries.
They contend that the provisions lack adequate safeguards, including judicial oversight, requirements of necessity and proportionality, and a mechanism requiring notice to affected individuals.
According to the petition, these powers could enable authorities to identify or target confidential journalistic sources, discouraging whistleblowers from sharing information about corruption, corporate wrongdoing and misconduct in public office.
The petitioners argue that source confidentiality is essential to investigative journalism because individuals with knowledge of wrongdoing may be unwilling to come forward if their identities can be exposed through government demands for information.
They have also challenged Section 37(1), which empowers the Central Government to restrict public access to information in specified circumstances.
The petitioners contend that the provision grants excessively broad powers to block access to information in the interests of the general public and could be used to restrict the dissemination of news.
They argue that the absence of sufficiently clear limits and independent oversight could undermine press freedom and public access to information.
Challenge to the Data Protection Board’s independence
The petition also questions the constitution and powers of the Data Protection Board of India under Sections 18, 19 and 27 of the DPDP Act.
The Board has statutory responsibilities that include inquiring into personal data breaches and violations of obligations under the legislation, exercising adjudicatory powers and imposing penalties.
The petitioners argue that the Chairperson and members are selected by the executive, while the law does not require a judicial member to be part of the Board.
They contend that an executive-appointed body exercising adjudicatory powers that may affect fundamental rights requires adequate institutional safeguards to ensure independence and impartiality.
The petitioners have argued that the Board’s structure raises constitutional concerns because of the potential consequences of its decisions for publishers and other entities handling personal data.
Their challenge forms part of a broader dispute over whether the institutional arrangements established under the DPDP Act provide sufficient independence and accountability when adjudicating matters involving constitutional rights.
Amendment to the RTI Act raises separate concerns
Another major part of the challenge concerns Section 44(3) of the DPDP Act, which amends Section 8(1)(j) of the Right to Information Act, 2005.
The petitioners contend that the amendment creates a broad restriction on the disclosure of personal information without adequately accounting for whether the information concerns public activity, relates to a public official acting in an official capacity or warrants disclosure in the larger public interest.
Under the earlier provision, personal information could be withheld where it had no relationship to public activity or interest, subject to the statutory framework and applicable exceptions. The petitioners argue that this framework allowed a balance to be maintained between an individual's right to privacy and the public's right to know.
They contend that the amended provision removes an important public-interest safeguard and could make it more difficult to obtain information concerning public officials, corruption and matters of public accountability.
The petitioners have referred to the Supreme Court’s ruling in Association for Democratic Reforms v Union of India, the electoral bonds case, in support of their argument that the fundamental right to know cannot be subordinated entirely to privacy concerns.
In February, the Supreme Court referred petitions challenging the DPDP Act’s amendment to the RTI Act to a three-judge bench. The DNPA’s latest challenge adds a specific focus on the implications of the data protection framework for news publishers and investigative reporting.
Other petitions challenging provisions of the DPDP Act and Rules have also raised concerns about the right to information, freedom of speech and expression, government access to personal data and the independence of the Data Protection Board.
Key provisions due to take effect in 2027
The DNPA’s challenge comes ahead of the scheduled implementation of major provisions of the DPDP framework in May 2027. The association argues that the absence of an explicit exemption for journalism could have far-reaching consequences once the relevant obligations take effect.
The legal dispute centres on how the country can protect individuals’ digital personal data while preserving the ability of journalists to investigate matters of public importance, publish information and protect confidential sources.
The petitioners are seeking the invalidation of the specified provisions of the Act and Rules, along with interim relief staying their operation pending the final adjudication of the challenge.
The Supreme Court has not yet ruled on the merits of the DNPA’s claims. Its notice to the Union government seeks a response to the constitutional challenge, with the matter scheduled to be taken up again on November 17.
The petition has been filed through ADP Law Offices and advocate Anuj Tiwari.