The Supreme Court has sought the central government’s response to a petition by the Digital News Publishers Association (DNPA) challenging the Digital Personal Data Protection (DPDP) Act, 2023, and the DPDP Rules, 2025. The petition argues that the absence of an exemption for journalism threatens press freedom and the right to information under Article 19.
A bench headed by Chief Justice Surya Kant, with Justices Joymalya Bagchi and V Mohana, issued notice on the petition and on an application for an interim stay on the challenged provisions. It, however, declined to grant an ex parte stay without hearing the Union government. The matter will next be heard on 17 November, along with other pending challenges.
The DPDP Act, passed by Parliament in August 2023, is the first comprehensive legislation on the protection of digital personal data. Breaches can attract penalties of up to Rs 250 crore. The ministry of electronics and information technology (MeitY) notified the accompanying Rules on 13 November 2025, with implementation to be staggered over 18 months.
The DNPA represents the digital arms of 21 major news organizations, including The Indian Express, The Hindu, India Today, the Times Group, Zee, NDTV and Network18. Journalist Yukta Mudgal is a co-petitioner. The petition seeks to strike down nine provisions of the Act and three rules.
Senior Advocate Madhavi Divan said news reporting finds no place among the “legitimate uses” in Section 7 or the exemptions in Section 17. Earlier drafts of the law, in 2018, 2019 and 2021, had carried such an exemption. The DNPA also questioned why research, archiving and statistical processing are exempt while journalism is not.
Under the notice, consent and deletion requirements, a reporter may first need the subject’s permission. “If I have to ask for permission and consent, what is the point?” Divan asked, warning of pre-censorship. The petition says seeking consent from those under investigation could tip them off, allowing evidence to be destroyed or witnesses intimidated. It adds that the right to demand erasure could be used to pressure publishers into deleting factual reports.
Government powers and the Board
The petition targets Rule 23, framed under Section 36, which lets the Center require any data fiduciary or intermediary to furnish information and bar it from disclosing the request. The DNPA says this lacks safeguards and could expose confidential sources, including whistleblowers. It also questions the government’s power to restrict public access to information.
It further challenges the independence of the Data Protection Board, citing the executive-led selection of its members and the lack of a judicial member. Breaches can attract penalties of up to Rs 250 crore. The Rules were notified on November 13, 2025, with implementation staggered over 18 months.
The DNPA also challenges Section 44(3) of the DPDP Act, which rewrote Section 8(1)(j) of the RTI Act. The earlier provision allowed personal information to be withheld only if it bore no relation to public activity or would cause an unwarranted invasion of privacy, and permitted disclosure where the larger public interest justified it.
The amended clause exempts all “information which relates to personal information”. The petitioners cite the electoral bonds judgment to argue that the right to information is integral to free speech. In February, the SC referred petitions against the RTI amendment to a three-judge bench.
Bench’s remarks
CJI Kant said the petitioners, given their expertise, could suggest safeguards to prevent misuse of personal data, stressing the need to balance privacy with the media’s freedom to report. Divan said the DNPA had submitted a representation to the Information and Broadcasting and Electronics and IT ministries on 10 August followed by a meeting on 25 August.
