Representative image. Sindugab, CC BY 4.0, Wikimedia Commons
The Supreme Court on 27 October 2026 asked the Centre to respond to a petition from the Digital News Publishers Association (DNPA) that challenges parts of the DPDP Act (Digital Personal Data Protection Act), India’s 2023 personal data law, on the ground that it leaves no room for journalism. A bench of Chief Justice of India Surya Kant, Justice Joymalya Bagchi and Justice V Mohana issued notice on the petition and on a request for an interim stay, and listed the case for 17 November, LiveLaw and The Hindu reported.
The DNPA groups the digital arms of 21 news organisations, including The Indian Express, The Hindu, India Today, the Times Group, Zee, NDTV and Network 18, according to LiveLaw, which reported that the association argues the provisions hurt press freedom. Yukta Mudgal, an independent investigative journalist in New Delhi, is a second petitioner. Separately, on 21 October 2026 the Information and Broadcasting Ministry told news channels to mute abusive debates under a 1995 TV law, as NewsPlainly reported.
What the DPDP Act petition asks the court to strike down
The petition, filed under Article 32 of the Constitution, asks the court to declare nine provisions of the Digital Personal Data Protection Act, 2023 unconstitutional: Sections 7, 17(2), 18, 19, 27, 29, 36, 37 and 44(3). It also challenges Rules 16, 17 and 23 of the DPDP Rules, 2025, LiveLaw reported.
The core complaint is simple. Under the law, an organisation that handles people’s personal data has to give notice, take consent and erase data on request. The publishers say that regime now covers editors, reporters and correspondents, and that a journalist investigating corruption could end up needing consent from the very person being investigated. The petition calls this incompatible with ordinary news work under the data protection law, according to LiveLaw.
Senior Advocate Madhavi Divan, appearing for the publishers, told the bench the provisions would “shut down the newsroom”. She argued that if a newspaper must wait for the subject of a story to agree, “the concept of news will be gone”, LiveLaw reported. The Hindu quoted her saying the privacy law was not meant for journalists, who are already answerable to bodies such as the Press Council of India.
| Provision challenged | What the Act says | The publishers’ objection (as reported) |
|---|---|---|
| Section 17(2) | Exempts notified state agencies, and research, archiving or statistics where no decision is taken about a person | Research is exempt but journalism is not, which the petition calls arbitrary |
| Section 36 | The Centre may require the Data Protection Board, any data fiduciary or intermediary to furnish information it calls for | No judicial oversight or notice; could be used to trace confidential sources |
| Section 37 | After the Board fines a company in two or more cases and advises it, the Centre may order public access to information blocked | Power to block “in the interests of the general public” is too broad and could hit news |
| Sections 18, 19, 27 | Set up the Data Protection Board, its members and its powers to inquire and penalise | Members are picked by the executive and no judicial member is required |
| Section 44(3) | Rewrites Section 8(1)(j) of the Right to Information (RTI) Act to exempt “information which relates to personal information” | A blanket bar, even where a public official or public interest is involved |
What the Chief Justice said about the DPDP Act challenge
The bench did not stay the law. “We cannot pass ex parte orders of stay,” Chief Justice Kant said, according to The Hindu, meaning the court would not pause the law without first hearing the government. The Hindu also reported that the publishers’ lawyers said they were not pressing for an immediate stay but wanted the Centre to answer their plea for one.
The Chief Justice told the publishers they were the domain experts and invited them to suggest safeguards against misuse, LiveLaw reported. He said a balance had to be struck between citizens’ rights and those of the media. The Hindu reported that he welcomed suggestions on how to weigh the rights of innocent citizens against misuse of press freedom, while protecting the media’s right to inform the public.
Divan said the DNPA had already raised its concerns with the government. According to the petition, as reported by LiveLaw, the association sent a detailed representation to the Ministries of Information and Broadcasting and of Electronics and Information Technology on 10 August 2026, and its representatives met ministry officials on 25 August 2026. The reports read did not carry a response from the Centre in court; its reply is now due before the 17 November hearing.
How the journalism exemption disappeared from the data protection law
The publishers’ sharpest point is about history. Earlier drafts of the data protection law carried a specific carve-out for journalism, the petition says. The final law does not.
- 2018: the Personal Data Protection Bill exempted journalistic purposes under Section 47.
- 2019 and 2021: the Personal Data Protection Bill, 2019 and the Data Protection Bill, 2021 kept provisions exempting journalism.
- 2022: the draft Digital Personal Data Protection Bill dropped the specific exemption and left exemptions to be notified by the Centre.
- 11 August 2023: the DPDP Act was enacted without a journalism exemption, as the Gazette text shows.
- 10 and 25 August 2026: the DNPA’s representation to two ministries, and a meeting with officials.
- 27 October 2026: the Supreme Court issues notice. Next hearing: 17 November 2026.
The 2018 to 2022 entries are as described in the petition, according to LiveLaw. NewsPlainly checked the 2023 Act’s exemption section: Section 17(2) names notified state agencies and research, archiving or statistical work, and nothing for news reporting.
Why the RTI change matters to readers who never file a story
Section 44(3) is the part most likely to reach ordinary people. It replaced the personal information exemption in the RTI Act, the 2005 law that lets citizens ask public offices for records. The new clause, in the Act’s own words, exempts “information which relates to personal information”.
The earlier clause allowed personal information to be withheld only when it had no link to any public activity or interest, and let it be released when a larger public interest justified it, LiveLaw reported. The publishers argue the rewrite removes that balance, even for records about public officials acting in their official role. They cite the Supreme Court’s electoral bonds judgment on the citizen’s right to know.
This is not the only case on the RTI change. LiveLaw reported that in February the Supreme Court referred petitions against the amendment to a three-judge bench, and Divan told the court that other challenges are pending. The Times of India reported that the publishers’ case will be heard on 17 November along with pending petitions.
What penalties the Data Protection Board can impose
The petition also questions the Data Protection Board, the body that hears complaints and imposes fines under the DPDP Act. The money involved explains why publishers worry about who sits on it. The Schedule to the Act sets maximum penalties per breach, including these:
- Up to ₹250 crore for failing to take reasonable security safeguards against a data breach.
- Up to ₹200 crore each for failing to report a breach, and for breaching the extra duties on children’s data.
- Up to ₹150 crore for breaching the extra duties of a Significant Data Fiduciary.
- Up to ₹50 crore for a breach of any other provision of the Act or its rules.
The petitioners argue that a body with these powers, whose chairperson and members are chosen by the executive, needs a judicial member, LiveLaw reported. Under Section 37, a company the Board fines in two or more cases can also face an order blocking public access to its information, after a hearing.
