Digital News Publishers Association (DNPA), representing 21 prominent news organizations, has filed suit with the Supreme Court challenging provisions of India's Digital Personal Data Protection Act, 2023, and the DPDP Rules, 2025. As a result of the current data protection framework, journalists could be restricted in their activities, investigative reporting may become complex, and public access to information may be limited.
Upon receiving notices from the Union Ministry of Law and Justice and Ministry of Electronics and Information Technology (MeitY) on October 27, 2026, the Supreme Court requested the Centre's response to the challenge. This case emphasizes the conflict between preserving the right to maintain an individual's digital privacy and preserving the right to investigate and report issues of public interest for the press.
Indian Parliament passed the DPDP Act in August 2023, the first comprehensive law specifically designed to protect digital personal data. It establishes rules for organizations and other entities that collect and process personal information. Under the Act, these entities are considered Data Fiduciaries and are required to obtain the consent of individuals before processing personal data, except for certain permissible purposes listed below Section 7.
A significant financial penalty is also introduced in the legislation, with data protection violations resulting in fines as high as Rs 250 crore. On November 13, 2025, MeitY notified the DPDP Rules for setting up the operational framework, with phased implementation over a period of 18 months. However, news publishers contend that the legislation does not specifically exempt journalistic activities from its provisions.
A clear provision for news reporting is not provided by Section 7, which identifies legitimate purposes for processing personal information, nor by Section 17, which lists exemptions from the Act. According to the DNPA, this omission may pose significant challenges for reporters investigating individuals, institutions, or organizations.
While investigating issues involving public accountability, journalists often obtain personal information from public records, interviews, documents, and other sources. A lack of a journalistic exemption may raise questions about whether consent is required before such information may be collected or used.
Further, the association emphasized that earlier versions of data protection legislation, drafted in 2018, 2019, and 2021, included exemptions for journalistic purposes. They have been removed from the final framework and are a key part of the legal challenge.
Moreover, the dispute also involves amendments to the Right to Information Act (RTI Act), which raise concerns regarding the impact of the new provisions on transparency and access to government information.
DPDP Rule 23 also presents a challenge, which provides the Central Government with the authority to request information from Data Fiduciaries and intermediaries through an authorized agent. Moreover, the rule prohibits these entities from disclosing the fact that a request has been made.
News publishers have expressed concern over the possibility that the provision could affect the confidentiality of journalistic sources and create confusion regarding the handling of information obtained during investigations.
Moreover, the association has questioned the amendment to Section 8(1)(j) of the Right to Information Act, which was implemented by Section 44(3) of the DPDP Act.
A public authority previously had the option of withholding personal information that had no connection to public activities or that could cause an unwarranted invasion of privacy. If a larger public interest justified the disclosure, information could be released.
Information related to personal information has been broadly exempted from the amended provision.
Publishers argue that this change could make it more difficult for them to obtain government records required for investigations of matters such as conflicts of interest, public appointments and the use of public funds. Those seeking information about welfare programs, recruitment processes, and government services can also benefit from such information.
However, the amendment does not remove every route for disclosure.
Information may be released in accordance with Section 8(2) of the RTI Act when the public interest outweighs the potential harm to protected interests. Despite the government's assertion that stronger privacy safeguards are necessary for preventing misuse of personal information, the current provision pertaining to public interest continues to protect transparency as it does today.
In addition, the legal dispute involves constitutional protections of privacy.
In its 2017 Justice K.S. Puttaswamy decision, the Supreme Court recognized privacy as a fundamental right under Article 21, albeit clarifying that the right is not absolute. This case raises the question as to how that protection should be applied simultaneously with freedom of speech and information access rights for the public.
After issuing notice to the Centre, the Supreme Court declined to grant an interim stay on the challenged provisions before hearing the government's response.
According to the bench, a blanket restriction on disclosure of digital personal information is not necessary, but a more proportionate approach is required. Additional hearings will be held on November 17, 2026 in regards to this matter.
An examination by the court may have broader implications for how the privacy laws in India apply to news organizations, investigative reporting, and the public's right of access to public records.
It is expected that the Supreme Court's decision in this case will have a significant impact on the balance between individuals' rights to privacy, freedom of the press, and access to information for the general public. Its findings may also affect the way news organizations handle personal data when conducting investigations in India.
