Supreme Court issues notice on news publishers' challenge to the data protection law
In one line: The Supreme Court has agreed to examine whether India's data protection law, which has no exemption for journalism, unreasonably restricts the press and the right to information.
Published 28 October 2026. Written by Pratidin from the reports linked at the end; every fact checked by a separate review before publishing. How we work
On 27 October 2026 a Supreme Court bench of Chief Justice Surya Kant and Justices Joymalya Bagchi and V. Mohana issued notice to the Centre on a petition by the Digital News Publishers Association (DNPA) and independent journalist Yukta Mudgal challenging parts of the Digital Personal Data Protection (DPDP) Act, 2023 and the DPDP Rules, 2025. Notice was issued on both the writ petition, filed under Article 32, and the application for a stay, and the matter was made returnable on 17 November. The DNPA represents the digital arms of 21 news organisations, including The Indian Express, The Hindu, India Today, the Times Group, Zee, NDTV and Network 18. "Newsrooms will shut down if we have to ask for permission. This will set in a regime of pre-censorship," Senior Advocate Madhavi Divan argued.
The petition targets Sections 7, 17(2), 18, 19, 27, 29, 36, 37 and 44(3) of the Act and Rules 16, 17 and 23. Its central complaint is that the Act has no specific exemption for journalism, so reporters processing personal data would need the consent of the very people they investigate. It says Section 17(2) is arbitrary because it exempts research, archiving and statistical processing but not public-interest journalism. It argues that Section 36 read with Rule 23 lets the Centre call for information without judicial oversight, which could expose journalists' sources; that Section 37(1) allows overbroad blocking; that the Data Protection Board, which adjudicates and imposes penalties under Sections 18, 19 and 27, is chosen by the executive and need not have a judicial member; and that Section 44(3), which rewrites Section 8(1)(j) of the Right to Information (RTI) Act, imposes a blanket bar on disclosing personal information.
The petition traces the history of the law: the Personal Data Protection Bill, 2018 had a journalistic exemption (in its Section 47), as did the 2019 Bill and the Data Protection Bill, 2021, but the 2022 draft dropped it in favour of exemptions the Centre could notify. The DNPA says it raised its concerns with the Ministries of Information and Broadcasting and of Electronics and IT in August 2026. The Act's provisions are being brought into force in phases, with the remaining duties of data fiduciaries due from 13 May 2027. Separate petitions against the RTI amendment are already pending; in February 2026 the Court referred them to a larger bench. The Act came after the Supreme Court's 2017 Puttaswamy judgment, which held privacy to be a fundamental right; the Centre is yet to file its reply in this case.
Prelims facts
- On 27 October 2026 the Supreme Court issued notice on the Digital News Publishers Association's challenge to the DPDP Act, 2023 and DPDP Rules, 2025, returnable on 17 November.
- The core grievance is the absence of a journalistic exemption; Section 17(2) exempts research, archiving and statistical processing but not journalism.
- Section 44(3) of the DPDP Act amends Section 8(1)(j) of the RTI Act to bar disclosure of personal information.
- The Personal Data Protection Bill, 2018 had a journalistic exemption in Section 47; the 2022 draft dropped it.
- In Puttaswamy (24 August 2017) the Supreme Court held privacy to be a fundamental right under Article 21 and Part III.
Quick recall
- Who challenged the DPDP Act in the Supreme Court in October 2026?
- The Digital News Publishers Association (digital arms of 21 news organisations) and journalist Yukta Mudgal.
- On what date is the publishers' case returnable?
- 17 November 2026.
- Which section of the DPDP Act amends the RTI Act?
- Section 44(3), which amends Section 8(1)(j).
- Which DPDP Act section exempts research, archiving and statistical processing?
- Section 17(2).
- When did the DPDP Act receive Presidential assent?
- 11 August 2023.
- Which draft law had a journalistic exemption in its Section 47?
- The Personal Data Protection Bill, 2018.
- When was privacy held to be a fundamental right?
- 24 August 2017, Justice K.S. Puttaswamy (Retd.) v. Union of India.
- When are the remaining provisions of the DPDP Act due to come into force?
- 13 May 2027.
Prelims practice question
With reference to the Digital Personal Data Protection Act, 2023, consider the following statements:
1. It contains a specific exemption for processing of personal data for journalistic purposes.
2. It amends the Right to Information Act, 2005.
3. It provides for a Data Protection Board to adjudicate breaches.
Which of the statements given above are correct?
- 1 and 2 only
- 2 and 3 only
- 1 and 3 only
- 1, 2 and 3
Show answer
Answer: (b) 2 and 3 only. 1 is wrong: the absence of a journalistic exemption is exactly what news publishers challenged in October 2026 (earlier drafts of 2018, 2019 and 2021 had one). 2 is correct: Section 44(3) amends Section 8(1)(j) of the RTI Act. 3 is correct: the Data Protection Board under Section 18 adjudicates and imposes penalties.
Use this in UPSC Mains: previous-year questions
Recurring theme: Privacy, data protection and their balance with free speech and transparency
- How to use this
Show how Puttaswamy's privacy right now interacts with free speech through the DPDP Act and its challenge.
- The DPDP Act, 2023 implements Puttaswamy, but has no journalistic exemption, which the 2018 Bill had in Section 47.
- In October 2026 the Supreme Court issued notice on news publishers' plea that the Act chills press freedom under Article 19(1)(a).
- How to use this
Use the DPDP Act's RTI amendment to show how accountability through RTI can be eroded by new privacy rules.
- Section 44(3) of the DPDP Act rewrote RTI Section 8(1)(j), removing the public-interest override for personal information.
- Challenges to this change were referred to a larger bench in February 2026; news publishers raised it again in October 2026.
Tests the Article under which privacy is placed, the constitutional base of the DPDP Act.
Mains practice question
The Digital Personal Data Protection Act, 2023 seeks to protect privacy but has been challenged as a threat to press freedom and the right to information. Critically examine. (250 words)
Model answer
The DPDP Act, 2023 gives effect to the right to privacy recognised in Puttaswamy (2017). On 27 October 2026 the Supreme Court issued notice on a challenge by the Digital News Publishers Association, which says the law would chill journalism.
Privacy gains
- Consent-based processing, duties on data fiduciaries and penalties for breaches.
- A Data Protection Board to adjudicate complaints.
- Phased rollout, with remaining duties of data fiduciaries due from 13 May 2027.
Concerns for press freedom
- No journalistic exemption: the 2018, 2019 and 2021 Bills had one; the 2022 draft dropped it. Reporters may need consent from those they investigate.
- Arbitrary classification: Section 17(2) exempts research, archiving and statistics but not journalism (Article 14).
- Source protection: Section 36 with Rule 23 lets the Centre call for information without judicial oversight.
- Blocking: Section 37(1) allows broad restriction of public access.
- Independence: the Board is executive-selected with no required judicial member.
Concerns for transparency
- Section 44(3) rewrites RTI Section 8(1)(j) into a blanket bar on personal information, removing the public-interest override; challenges are before a larger bench.
- Petitioners cite the electoral bonds judgment on the citizen's right to know.
Arguments for the law
- Privacy is itself a fundamental right; the Act lets the Centre notify exemptions; careless use of personal data by media can also harm individuals.
Way forward
- A narrowly drawn public-interest journalism exemption, as in earlier Bills.
- Judicial or independent oversight for Section 36 demands.
- Restore a public-interest test in RTI.
Privacy and a free press both flow from Part III; the law must balance, not subordinate, one to the other.
The basics
Why this matters
Data protection, privacy, press freedom and the right to information are four of the most examined rights themes in GS2. The challenge to the Digital Personal Data Protection Act, 2023 by India's major news publishers brings all four into one case, which the Supreme Court admitted on 27 October 2026.
What the Act does
The Act regulates how 'data fiduciaries' (any entity that decides why and how personal data is processed) handle the personal data of 'data principals' (the people the data is about). The default rule is consent. Breaches are adjudicated by the Data Protection Board of India.
- 24 August 2017Puttaswamy: privacy is a fundamental right
- 2018Personal Data Protection Bill drafted, with a journalistic exemption
- 11 August 2023DPDP Act receives Presidential assent
- 13 November 2025First provisions in force, including the Data Protection Board and the RTI amendment
- 27 October 2026Supreme Court issues notice on news publishers' challenge
- 13 May 2027Remaining provisions due to take effect
Why journalists object
A newspaper investigation is, in legal terms, processing of personal data. Without an exemption, the subject of a story could refuse consent. The petitioners say this makes the law a regime of 'pre-censorship'.
- 1Section 17(2)Exempts research, archiving, statistics but not journalism
- 2Section 36 with Rule 23Centre can call for information without judicial oversight
- 3Section 37(1)Broad power to block public access
- 4Sections 18, 19, 27Executive-chosen Board adjudicates and penalises
- 5Section 44(3)Blanket bar on personal information under RTI
The RTI angle
Section 8(1)(j) of the Right to Information Act, 2005 earlier allowed personal information to be withheld unless a larger public interest justified disclosure. The DPDP Act's Section 44(3) removes that balancing, so information about officials' conduct could be denied simply as 'personal'. Activists' challenges to this change are before a larger bench.
- Personal information exempt if it had no link to public activity or interest
- Could be disclosed if larger public interest justified it
- Information that cannot be denied to Parliament could not be denied to a citizen
- Exemption for information relating to personal information
- No public-interest override in the clause
- Petitioners call it a blanket bar
The constitutional balance
Both sides invoke Part III. Privacy, recognised in Puttaswamy and the right to privacy, supports the law; freedom of the press under Article 19(1)(a) and the right to know support the challengers. The Court will have to decide whether the law balances these or lets one swallow the other.
Go deeper
Why it matters for UPSC
The case links privacy (Article 21), free speech (Article 19(1)(a)), transparency (RTI) and regulatory design. Prelims can test the Act's sections and timeline; Mains asks how to balance privacy with press freedom and the right to know.
The core idea
The Digital Personal Data Protection Act, 2023 makes consent the default basis for processing personal data. Journalism is not exempt, though research and archiving are. Publishers say this, plus the powers of the Centre and of the Data Protection Board of India, chills reporting. The Act also rewrote the personal information clause of the Right to Information Act, 2005. Supporters of the law invoke Puttaswamy and the right to privacy.
Numbers and dates to remember
- 27 October 2026: notice issued; returnable 17 November.
- 21: news organisations whose digital arms form the DNPA.
- Sections 7, 17(2), 18, 19, 27, 29, 36, 37, 44(3) and Rules 16, 17, 23 challenged.
- 11 August 2023: assent; 13 November 2025: first provisions in force; 13 May 2027: the rest.
Where to go next
- Digital Personal Data Protection Act, 2023: what the law requires.
- Data Protection Board of India: the adjudicator and its independence.
- Right to Information Act, 2005: how Section 8(1)(j) changed.
- Puttaswamy and the right to privacy: the constitutional base for the law.
Go deeper: privacy versus the press
The publishers' case. Earlier drafts, from the 2018 Bill to the 2021 Bill, carried a journalistic exemption; the 2022 draft dropped it. Without it, an investigation into a public figure is processing that may need the subject's consent. Section 17(2) exempts research, archiving and statistics, so, the petition argues, singling out journalism fails Article 14. Section 36 with Rule 23 lets the Centre demand information without notice or judicial check, which could expose sources. The Data Protection Board of India is chosen by the executive and need not have a judicial member, yet can impose heavy penalties.
The case for the law. Supporters argue that the Digital Personal Data Protection Act, 2023 gives effect to the State's duty, flowing from Puttaswamy and the right to privacy, to protect personal data. The Act lets the Centre notify exemptions, and privacy harms from media, such as exposure of private lives, are real. A blanket media exemption could be misused by any website calling itself news.
The transparency question. Section 44(3) rewrote the personal information exemption in the Right to Information Act, 2005. Earlier, officials' records could be disclosed when the larger public interest justified it. Critics say the new text lets authorities deny almost anything that names a person. Those challenges are before a larger bench, and the petitioners lean on the electoral bonds judgment's recognition of the right to know.
Likely tests. The Court may apply proportionality, asking whether the restriction pursues a legitimate aim through the least restrictive means. A narrow public-interest journalism exemption, as in the earlier Bills, is the obvious middle path.
Digital Personal Data Protection Act, 2023
What the law requires.
In one line: The DPDP Act, 2023 is India's first comprehensive law on digital personal data, built around consent and duties on those who process data.
Key features
- Applies to digital personal data processed in India, and to processing abroad for offering goods or services in India.
- 'Data fiduciaries' must process data for lawful purposes with consent or for certain 'legitimate uses' (Section 7), keep it secure and report breaches.
- Exemptions in Section 17 cover, among others, prevention and investigation of offences, and, under 17(2), research, archiving and statistics.
- A Data Protection Board adjudicates breaches; penalties can reach ₹250 crore.
Timeline
Lok Sabha passed it on 7 August 2023 and Rajya Sabha on 9 August; assent came on 11 August 2023. Provisions are commencing in phases from 13 November 2025, with the remainder due on 13 May 2027.
Where to go next
Digital Personal Data Protection Act, 2023: every story that connects to it (3)
Data Protection Board of India
The adjudicator and its independence.
In one line: The Data Protection Board is the body set up under Section 18 of the DPDP Act to inquire into data breaches and impose penalties.
Role
It receives complaints from data principals and breach reports from fiduciaries, inquires into them, directs remedial measures and imposes monetary penalties under Section 27. Its provisions were among the first brought into force on 13 November 2025.
The independence debate
The Board's chairperson and members are appointed by the Central Government. The news publishers argue that a body that adjudicates rights and imposes heavy penalties should be insulated from the executive and include a judicial member. Critics note that the government can itself be a data fiduciary and a party before the Board. Supporters say a specialised regulator is faster than courts.
Where to go next
Data Protection Board of India: every story that connects to it (2)
Right to Information Act, 2005
How Section 8(1)(j) changed.
In one line: The RTI Act gives citizens a right to information held by public authorities, subject to exemptions listed in Section 8.
Section 8(1)(j) before 2023
It exempted personal information that had no relation to public activity or interest, or would cause unwarranted invasion of privacy, unless the information officer was satisfied that the larger public interest justified disclosure. A proviso said information that cannot be denied to Parliament or a State Legislature cannot be denied to any person.
What changed
Section 44(3) of the DPDP Act replaced this with an exemption for 'information which relates to personal information', without the public-interest balancing. Transparency activists call it a blanket bar; petitions against it were referred to a larger bench in February 2026, and the news publishers have now added their challenge.
Where to go next
Right to Information Act, 2005: every story that connects to it (2)
Puttaswamy and the right to privacy
The constitutional base for the law.
In one line: In Justice K.S. Puttaswamy (Retd.) v. Union of India, decided on 24 August 2017, a nine-judge bench held that privacy is a fundamental right.
What it held
Privacy is protected as an intrinsic part of the right to life and personal liberty under Article 21 and as part of the freedoms in Part III. Any restriction must satisfy legality (a law), a legitimate aim, and proportionality. The judgment noted the need for a data protection regime, which eventually led to the DPDP Act.
Why in news
The DPDP Act is widely seen as the legislative follow-up to Puttaswamy. The news publishers accept the need for privacy law but argue that the Act fails the proportionality test where it restricts journalism and the right to know under Article 19(1)(a).
Where to go next
Take the 28 October 2026 quiz: 24 Prelims-style questions with answers