DPDP Act Challenged in the Supreme Court: Privacy, Press Freedom and the Right to Information
The Digital News Publishers Association (DNPA), which represents 21 news organisations, has challenged the Digital Personal Data Protection (DPDP) Act, 2023 and the DPDP Rules, 2025 in the Supreme Court.
The Supreme Court issued notice to the Centre on 27 October 2026 and listed the case for hearing on 17 November 2026. It did not pass any interim order stopping the law. The government has indicated it is open to changing the rules, or even the Act, to address press-freedom concerns.
The petition challenges Sections 7, 17(2), 18, 19, 27, 29, 36, 37 and 44(3) of the Act and Rules 16, 17 and 23 of the Rules. Its main point: the law has no specific exemption for journalism, so the consent, notice and erasure duties could hamper investigative reporting.
Section 44(3) amends Section 8(1)(j) of the Right to Information (RTI) Act, 2005. Critics say it removes the "larger public interest" test for releasing personal information. The government (Ministry of Electronics and IT, in an August 2025 release) says the change balances privacy with the right to information.
Other concerns: Section 36 (the Centre can call for information from data holders), Section 37 (the Centre can order blocking of information), and the independence of the Data Protection Board of India, whose members are picked by a committee of senior officials and government-nominated experts.
Digital Personal Data Protection (DPDP) Act, 2023
The Digital Personal Data Protection Act, 2023 is India's first full law to protect people's personal data in digital form. It tells companies and government bodies how they may collect and use your data, and gives you rights over it. The person whose data it is, is called the Data Principal. The body that decides why and how the data is used, such as a bank or an app, is called the Data Fiduciary. A Data Protection Board of India handles complaints and penalties.
The news publishers say the Act treats a reporter investigating a public official the same way as a company using customer data for profit. Without a journalism exemption, they argue, the duty to seek consent and the right to demand erasure could be used to stop or remove public-interest stories.
Right to Information Act, 2005
The Right to Information (RTI) Act, 2005 gives every citizen of India the right to ask for information from a public authority, such as a ministry, a government office or a public sector company. The authority must reply within a fixed time. The law aims to make government transparent and accountable, so that citizens can see how decisions are taken and public money is spent.
Section 44(3) is one of the main targets of the petition. Critics fear that records on public servants' assets, recruitment or official dealings could now be refused as "personal information", weakening RTI as a tool against corruption. The government's view is that privacy must also be protected and that Section 8(2) still allows release in the public interest.
Freedom of Speech and Expression: Article 19(1)(a)
Article 19(1)(a) of the Constitution gives every citizen of India the right to freedom of speech and expression. The Constitution does not mention "freedom of the press" separately, but the Supreme Court has held that press freedom is part of Article 19(1)(a). This right is not absolute. Article 19(2) lets the State put reasonable restrictions on it, on a fixed list of grounds.
The publishers argue that the DPDP framework, by not exempting journalism, creates a "chilling effect" on Article 19(1)(a). Others argue that courts can balance the two rights case by case, as they did in R. Rajagopal, without a separate exemption. The Supreme Court will now have to decide where this balance lies.
- Petitioner: Digital News Publishers Association (21 news organisations)
- Supreme Court notice: 27 October 2026; next hearing: 17 November 2026
- Provisions challenged: Sections 7, 17(2), 18, 19, 27, 29, 36, 37, 44(3) of the DPDP Act; Rules 16, 17, 23 of the DPDP Rules
- DPDP Act passed: August 2023; DPDP Rules notified: 14 November 2025; 6,915 inputs received during consultation
- Maximum penalty: ₹250 crore (security safeguards failure); ₹200 crore (breach notification, children's data)
- Children: below 18 years, verifiable parental consent needed
- Section 44(3) DPDP Act amends Section 8(1)(j) of the RTI Act, 2005
- Privacy as a fundamental right: K.S. Puttaswamy case, 2017 (Article 21)
- Press freedom: part of Article 19(1)(a); restrictions only on the eight grounds in Article 19(2)