Law & Justice
Supreme Court to Hear Challenge to India’s Data Protection Law Over Press Freedom Concerns
The Digital Personal Data Protection (DPDP) Act, 2023, which Parliament passed in August 2023, aims to give citizens greater control over their personal information and hold organisations accountable for how they collect, store and use it. The law has sparked debate over whether its safeguards could affect investigative journalism, the Right to Information (RTI) framework and government accountability.
The Digital News Publishers Association (DNPA), representing 21 news organisations, has filed a petition with the Supreme Court. It argues that several provisions of the DPDP Act and its accompanying rules could restrict journalistic activities, compromise confidential sources and undermine the RTI framework. The Court issued a notice to the Centre on 27 October and scheduled a hearing for 17 November.
The government has said it is open to amending the rules or the law if necessary to address press‑freedom concerns. Parliament passed the DPDP Act to regulate the processing of digital personal information in a rapidly expanding digital economy, where personal data is used in banking, e‑commerce, healthcare, social media and government welfare schemes. The Act follows the Supreme Court’s 2017 Puttaswamy judgment, which recognised privacy as a fundamental right.
Key features of the Act include: • Two categories: Data Fiduciaries (organisations that determine the purpose and means of processing personal data) and Data Principals (the individuals whose data is processed). • Consent requirements for Data Fiduciaries, except in specified circumstances. • Rights for Data Principals: access, correction, erasure, withdrawal of consent and grievance redressal. • Security safeguards and breach notification to the Data Protection Board of India. • Additional safeguards for children’s data, including parental consent and restrictions on targeted advertising. • Penalties up to ₹250 crore for failure to implement security safeguards and up to ₹200 crore for breach‑notification and children’s data violations.
The DNPA’s main concerns are: 1. Lack of a specific exemption for journalistic activity. Journalists often rely on personal information to investigate public officials, companies and government decisions. Requiring consent could alert subjects and compromise investigations. 2. The DPDP’s notice, consent and erasure requirements could make time‑sensitive reporting difficult. 3. Section 44(3) of the Act amends Section 8(1)(j) of the RTI Act, removing a balancing mechanism between privacy and public interest. Critics fear it could hinder access to information about public officials. 4. Sections 36 and 37 grant the Centre powers to seek information from Data Fiduciaries and block access to information, potentially affecting confidential sources. 5. The composition of the Data Protection Board of India, which may lack independence from the executive.
Legal experts offer differing views. Advocate Adhitya Srinivasan believes constitutional press‑freedom protections and judicial scrutiny can resolve competing interests without an explicit exemption. He argues the Act is not intended to restrict reporting but to discourage doxxing and voyeurism. Advocate Mayank Arora, however, warns that the absence of an explicit exemption could create a chilling effect on investigative journalism and that an explicit exemption would provide stronger protection.
The government, represented by Minister Ashwini Vaishnaw, has rejected claims that the law intends to restrict journalistic freedom. Vaishnaw said freedom of the press is constitutionally guaranteed and that the Centre is open to discussing concerns with editors and media professionals. Senior MeitY officials have said the law targets Data Fiduciaries such as banks, telecoms and insurers, not journalists, and that exemptions could be incorporated into the rules.
Implementation of the DPDP Rules began in November 2025, with key provisions coming into force immediately and the main obligations scheduled for 13 May 2027, giving organisations 18 months to prepare.
The Supreme Court will hear the DNPA’s petition on 17 November. The outcome could shape how privacy rights, access to public information and investigative freedom are balanced under India’s digital regulatory framework. The debate underscores the challenge of ensuring strong privacy protections while maintaining transparency and the public’s right to know.
Abhishek Mishra, Digital Content Producer at The Times of India, writes on foreign policy, defence, geopolitics and Indian politics.