A coalition of 21 Indian news publishers has challenged provisions of the Digital Personal Data Protection (DPDP) Act, 2023, in the Supreme Court, arguing that the law could interfere with investigative journalism and put confidential sources at risk. The petition, filed by the Digital News Publishers Association (DNPA) on October 6, seeks to overturn provisions that the publishers say do not adequately protect journalistic activities.
On October 27, 2026, the Supreme Court issued notice to the Centre on the petition and an application seeking a stay on the challenged provisions. The next hearing is scheduled for November 17. The case brings a significant legal question into focus: how should India balance the protection of personal data with the press’s ability to investigate wrongdoing and report matters of public interest?
Key Takeaways
- 21 publishers involved: The DNPA has challenged provisions of the DPDP Act and the Digital Personal Data Protection Rules, 2025.
- Supreme Court action: The court issued notice to the Centre on October 27 and scheduled the next hearing for November 17, 2026.
- Press freedom concerns: Publishers argue that consent, data-erasure and government information-request provisions could complicate investigative reporting.
- Confidential sources: The petition raises concerns that journalists could be required to disclose information identifying whistleblowers.
- Implementation timeline: Many substantive obligations under the framework are scheduled to take effect on May 13, 2027.
- No final ruling yet: The court’s notice does not mean the law has been struck down or that the publishers’ arguments have been accepted.
Why Have News Publishers Challenged the DPDP Act?
The Digital Personal Data Protection Act establishes a framework for collecting, processing and protecting individuals’ digital personal data. Its provisions cover how organisations obtain consent, explain their data practices, safeguard information and respond to individuals’ requests concerning their personal data.
The DNPA argues that the framework does not provide a sufficiently clear exemption for journalistic activities. According to the publishers, applying the law to investigative reporting without specific safeguards could make it harder to investigate public officials, businesses and other subjects without alerting them in advance.
The association’s petition argues that the absence of a journalism-specific exemption could affect freedom of speech and expression under Article 19(1)(a) of the Indian Constitution. It also raises concerns about how the framework interacts with principles discussed in the Supreme Court’s 2017 privacy judgment in K.S. Puttaswamy v. Union of India.
The legal challenge does not mean that all processing of personal data for journalism is automatically prohibited under the Act. Instead, the publishers are contesting the scope and application of the provisions and seeking explicit safeguards for reporting in the public interest.
Which News Publishers Are Involved?
The challenge has brought together media organisations operating across television, newspapers and digital news platforms.
The DNPA’s membership includes major publishers such as:
- Network18, which operates several news platforms and is associated with Reliance Industries chairman Mukesh Ambani.
- NDTV, part of Gautam Adani’s media interests.
- The Indian Express, a major newspaper publisher.
- Times Internet, part of the Times of India group.
The group has argued that the law’s requirements could affect the day-to-day work of journalists, particularly when investigations depend on confidential sources, unpublished documents or information about alleged misconduct.
The case is notable because it involves established media organisations challenging the application of a major data-protection framework. Its outcome could influence how digital newsrooms approach personal information in investigative stories.
The Three Main Concerns Raised by Publishers
1. Consent requirements could alert investigation subjects
One of the publishers’ central objections concerns the rules governing notice and consent when personal data is processed.
The DNPA argues that applying these requirements to investigative reporting could force journalists to notify people whose activities they are investigating or seek their consent before processing relevant information.
In certain investigations, alerting the subject in advance could create practical risks. The publishers say it might allow evidence to be destroyed, witnesses to be intimidated or information to be concealed before publication.
The issue is whether general data-protection obligations can be applied to investigative reporting without undermining legitimate journalistic work. The publishers are seeking clearer legal protection for investigations that serve the public interest.
2. Data-erasure requests could affect published reports
The petition also raises concerns about the DPDP Act’s provisions concerning the correction, updating and erasure of personal data.
Publishers fear that people mentioned in investigative reports could invoke data-protection rights to demand that information be removed or substantially redacted. They argue that without an explicit public-interest safeguard, such requests could create uncertainty about whether factual reports can remain available.
However, the Act’s data-erasure provisions do not establish an unconditional right to delete any news article. Their application depends on the relevant statutory conditions and circumstances.
The dispute concerns whether the law adequately distinguishes between inappropriate processing of personal information and the retention of information that is necessary for accurate public-interest reporting.
3. Government information requests could expose confidential sources
A third concern involves government powers to request information from organisations handling personal data.
The DNPA argues that these powers could expose records identifying confidential journalistic sources. If whistleblowers believe their identities could be disclosed through legal demands, they may become less willing to provide information about alleged corruption, corporate misconduct or electoral malpractice.
The association has also questioned whether the framework grants broad exemptions to the state without providing equivalent explicit protections for journalists.
These arguments remain part of the pending legal challenge. The Supreme Court will need to consider the statutory language, constitutional principles and the competing interests involved.
What Is India’s DPDP Act, and When Will It Take Effect?
India enacted the Digital Personal Data Protection Act in August 2023. The government subsequently notified the Digital Personal Data Protection Rules, 2025, in November 2025, establishing a phased implementation schedule.
The framework is intended to give individuals greater control over their digital personal data while placing obligations on organisations that process it. Depending on the applicable provisions, these obligations include providing information about data processing, obtaining valid consent, implementing security safeguards and responding to requests from individuals.
The framework also establishes financial penalties for specified violations. The maximum penalty can reach ₹250 crore for failure to take reasonable security safeguards to prevent personal data breaches, while certain violations involving children’s personal data can attract penalties of up to ₹200 crore.
The implementation schedule is important for the news industry. Many substantive provisions, including those governing notice, consent and certain data rights, are scheduled to take effect on May 13, 2027. The court challenge therefore arrives before those requirements become fully operational.
| Development | Date | Significance |
|---|---|---|
| DPDP Act enacted | August 2023 | Establishes India’s digital personal-data protection framework |
| DPDP Rules notified | November 2025 | Sets out implementation rules and a phased timeline |
| DNPA petition filed | October 6, 2026 | Challenges provisions affecting journalistic activity |
| Supreme Court issues notice | October 27, 2026 | Seeks the Centre’s response to the legal challenge |
| Next scheduled hearing | November 17, 2026 | Further proceedings in the case |
| Many substantive provisions scheduled to take effect | May 13, 2027 | Key compliance date under the phased implementation framework |
What Happens Next in the Supreme Court?
The Supreme Court’s notice asks the government to respond to the challenge. The court has also listed the publishers’ application seeking a stay on the challenged provisions for consideration.
Issuing notice is a procedural step, not a final judgment. It does not mean the Supreme Court has suspended the Act, accepted the DNPA’s interpretation or ordered the government to introduce a journalism exemption.
At the next hearing, the proceedings may clarify the issues the court will examine and how it intends to consider the request for interim relief. The eventual outcome could depend on the precise wording of the challenged provisions, the constitutional arguments and the government’s response.
For news organisations, the immediate question is whether clearer safeguards will be established before the relevant provisions take effect. For the government, the challenge presents an opportunity to explain how the data-protection framework is intended to operate alongside the constitutional protection of free expression.
The Bigger Picture
The case highlights a difficult policy question facing governments around the world: how to protect personal information without preventing legitimate public-interest reporting. Data-protection laws can help individuals challenge misuse of their personal data, but investigative journalism sometimes requires processing information about people who would not voluntarily provide it.
The challenge is therefore not simply about whether privacy or press freedom should prevail in every situation. It is about whether legislation can establish clear rules for both interests, including safeguards for confidential sources and appropriate limits on the use of personal data. The Supreme Court’s examination of the DPDP framework could help clarify how those competing concerns should be addressed under Indian law.
FAQs
1. What is the DPDP Act?
The Digital Personal Data Protection Act, 2023, is India’s law governing the processing and protection of digital personal data. It establishes obligations for organisations handling such information and provides individuals with specified rights concerning their data.
2. Why are news publishers challenging the DPDP Act?
The DNPA argues that the framework lacks a sufficiently clear exemption for journalistic activities. Publishers say consent requirements, data-erasure requests and government powers to seek information could complicate investigative reporting and expose confidential sources.
3. Which media organisations are involved?
The DNPA represents 21 news publishers. Its membership includes Network18, NDTV, The Indian Express and Times Internet, among other organisations.
4. Has the Supreme Court struck down the DPDP Act?
No. On October 27, 2026, the Supreme Court issued notice to the Centre on the petition and an application seeking a stay on the challenged provisions. The court has not issued a final ruling in the case.
5. When will the main DPDP requirements take effect?
Under the phased implementation schedule, many substantive provisions are scheduled to take effect on May 13, 2027. The precise application of the challenged provisions will depend on the law, the implementation framework and any subsequent court orders.
Looking Ahead
The next hearing, scheduled for November 17, 2026, will be an important point in the legal challenge. News publishers will seek clarity on whether the framework can be applied to investigative journalism without jeopardising confidential sources or restricting the publication of factual information in the public interest. The Centre’s response and any interim directions from the court will be key developments to watch.
More broadly, the dispute could shape how Indian news organisations handle personal data as the DPDP framework moves toward implementation. The eventual legal position will need to address both the protection of individuals’ privacy and the role of independent journalism in uncovering matters of public interest.
Get the day’s top stories in your inbox
One concise email. No spam, unsubscribe anytime.
