DPDP Act and Press Freedom: Why News Publishers Went to the Supreme Court
India's data protection law, the Digital Personal Data Protection (DPDP) Act, 2023, protects your personal data. But it has no special exemption for journalism. News publishers say this means a reporter may need the consent of the very person being investigated before using their data. On 27 October 2026 the Supreme Court issued notice to the Centre on their plea, but refused to stay the law for now. Here is the clash between privacy and press freedom in simple words.
What happened on 27 October 2026
A bench of Chief Justice Surya Kant, Justice Joymalya Bagchi and Justice V. Mohana issued notice to the Union government on a petition by the Digital News Publishers Association (DNPA), a body of major news media companies, challenging parts of the DPDP Act, 2023 and the DPDP Rules, 2025.
Senior advocate Madhavi Divan, for the DNPA, argued that the law has no exemption for journalistic activity, so consent rules could make journalists dependent on the people they report on, expose confidential sources and work like a "pre-censorship regime". The plea also questions the Centre's power to call for information under the Act. The bench refused an interim stay, saying it would never pass an order without hearing the other side, and tagged the case with other pending petitions on the DPDP law for hearing on 17 November 2026.
At a GlanceDPDP Act Press Freedom Case: Key Facts
| Point | Fact |
|---|---|
| Law challenged | Digital Personal Data Protection Act, 2023 (Act 22 of 2023) and DPDP Rules, 2025 |
| Petitioner | Digital News Publishers Association (DNPA) |
| Bench | CJI Surya Kant, Justice Joymalya Bagchi, Justice V. Mohana |
| Main complaint | No exemption for journalistic activity in the Act |
| Other grounds | Consent burden on reporters, risk to confidential sources, Centre's power to call for information |
| Order on 27 Oct 2026 | Notice to Centre; no interim stay |
| Next hearing | 17 November 2026, with other pending DPDP petitions |
| Penalty under the Act | Up to Rs 250 crore per breach, imposed by the Data Protection Board of India |
Under the DPDP Act, anyone who uses a person's digital data, called a data fiduciary, usually needs that person's consent, must use it only for a stated purpose and must delete it when the purpose is over. A news organisation is also a data fiduciary. So if a reporter collects the phone records, property papers or emails of a corrupt official, the law does not clearly say the reporter is free from these duties.
🏠 Everyday analogy
Think of a teacher who makes a rule: "no one may write about a classmate without that classmate's permission." The rule protects shy students, but it also stops the school newspaper from reporting that the class monitor took money from the picnic fund.
🇮🇳 Real Indian example
An investigative story on a fake-degree racket or a bank fraud often uses names, documents and messages of the people involved. Publishers fear such people could use the DPDP Act to demand deletion or complain to the Data Protection Board.
The Missing ExemptionHow the Journalism Exemption Disappeared
| Year | Draft or law | Journalism exemption? |
|---|---|---|
| 2018 | Justice B.N. Srikrishna Committee draft bill | Yes, for journalistic purposes, with conditions |
| 2019 | Personal Data Protection Bill, 2019 | Yes, for journalistic purposes |
| 2022 | Draft DPDP Bill, 2022 | No |
| 11 Aug 2023 | DPDP Act, 2023 gets President's assent | No; Section 17 lists other exemptions |
| Nov 2025 | DPDP Rules, 2025 notified, with phased commencement | No |
| 27 Oct 2026 | Supreme Court notice on the DNPA plea | Question now before the Court |
- Section 17 of the Act exempts processing for things like enforcing legal rights, courts and tribunals, prevention and investigation of offences, and research, archiving or statistics, but not news reporting.
- Section 36 lets the Central Government call for information from the Data Protection Board or any data fiduciary; publishers fear this could be used against newsrooms.
- Section 44(3) amended Section 8(1)(j) of the RTI Act on personal information; that change is also under challenge in separate petitions.
Official TextArticle 19(1)(a), Article 19(2) and Article 21
Constitution of India, Article 19(1)(a) and 19(2). Protection of certain rights regarding freedom of speech, etc.
(1) All citizens shall have the right—
(a) to freedom of speech and expression;
(2) Nothing in sub-clause (a) of clause (1) shall affect the operation of any existing law, or prevent the State from making any law, in so far as such law imposes reasonable restrictions on the exercise of the right conferred by the said sub-clause in the interests of the sovereignty and integrity of India, the security of the State, friendly relations with foreign States, public order, decency or morality, or in relation to contempt of court, defamation or incitement to an offence.
Article 21. Protection of life and personal liberty.
No person shall be deprived of his life or personal liberty except according to procedure established by law.
- Press freedom is not written separately; the Supreme Court has read it into Article 19(1)(a) since Romesh Thappar v State of Madras (1950) and Indian Express Newspapers v Union of India (1985).
- Privacy is a fundamental right under Article 21, as held by a nine-judge bench in K.S. Puttaswamy v Union of India (2017). The DPDP Act is meant to give effect to that right.
- Article 19(2) allows only reasonable restrictions on listed grounds. The Court will weigh whether the DPDP rules, as applied to journalists, are reasonable and proportionate.
Why It MattersPrivacy vs Press Freedom: Both Sides
Case for the law as it is
- Privacy is a fundamental right (Puttaswamy)
- A blanket media exemption can be misused by anyone calling themselves a journalist
- Doxxing and leaks of private data hurt ordinary people
- Courts can still protect genuine public-interest reporting
Case for a journalism exemption
- Investigative stories need data without the subject's consent
- Confidential sources may be exposed
- Fear of Rs 250 crore penalties can chill reporting
- Most data laws, including Europe's GDPR, carve out journalism
The likely middle path is a balancing test: protect reporting that serves a real public interest, while stopping misuse of people's private data for gossip or harassment. Earlier drafts tried this with conditions; the Court may now decide whether the Constitution requires it.
UPSC CornerDPDP Act and Press Freedom for UPSC Prelims and Mains
- Prelims: DPDP Act, 2023: data principal (the person), data fiduciary (who uses data), consent manager, Data Protection Board of India, penalty up to Rs 250 crore.
- Prelims: Press freedom flows from Article 19(1)(a); restrictions only under Article 19(2). Privacy is under Article 21 (Puttaswamy, 2017).
- Prelims: The 2019 Bill had a journalism exemption; the 2023 Act does not.
- Mains (GS II): "Data protection must not become a tool of censorship." Examine the absence of a journalistic exemption in the DPDP Act, 2023.
Practice MCQTest Yourself: DPDP Act vs Press Freedom: SC Notice to Centre
With reference to the Digital Personal Data Protection Act, 2023, consider the following statements: (1) It provides a specific exemption for processing of personal data for journalistic purposes. (2) Penalties under the Act are imposed by the Data Protection Board of India. (3) The Act gives effect to the right to privacy recognised under Article 21. Which of the statements given above is/are correct?
Doubts ClearedFrequently Asked Questions
What is the DNPA's case against the DPDP Act?
The Digital News Publishers Association says the DPDP Act, 2023 and its Rules have no exemption for journalism, so consent and other duties could stop investigative reporting and expose sources. It wants the Court to read in or require such an exemption.
Did the Supreme Court stay the DPDP Act?
No. On 27 October 2026 the Court only issued notice to the Centre and refused an interim stay. The case will be heard with other DPDP petitions on 17 November 2026.
Does the DPDP Act apply to journalists?
The Act applies to anyone who processes digital personal data, and Section 17 has no exemption for journalism. So, on the text, news organisations are data fiduciaries like others. The Court will now examine whether this is constitutional.
Is press freedom a fundamental right in India?
Yes. It is not written separately, but the Supreme Court has held since 1950 that freedom of the press is part of freedom of speech and expression under Article 19(1)(a), subject to reasonable restrictions under Article 19(2).
What is the maximum penalty under the DPDP Act?
Up to Rs 250 crore for failing to take reasonable security safeguards to prevent a personal data breach, imposed by the Data Protection Board of India after an inquiry.
Sources and further readingSources We Checked
Facts checked against the reports below on 29 October 2026. The Centre's reply had not been filed when we checked; the case is pending and this page will be updated.
- Tribune (PTI): Supreme Court notice to Centre on news publishers' plea challenging data protection law (27 Oct 2026)
- Telangana Today: SC notice to Centre on news publishers' plea challenging data protection law (27 Oct 2026)
- ETV Bharat: SC notice to Centre on news publishers' plea challenging data protection law (27 Oct 2026)
- The News Mill: Supreme Court seeks Centre's reply on media plea challenging DPDP Act (Oct 2026)
- StartupTalky: SC issues notice to Centre on DNPA's DPDP Act plea
- India Code: Digital Personal Data Protection Act, 2023