Policies · eGov
A challenge by 21 news publishers before the Supreme Court has placed the Digital Personal Data Protection Act, 2023 and its 2025 Rules at the centre of a constitutional debate over privacy, press freedom and State power.
✦ AI SUMMARY 30-second read
- On 27 October 2026, a Bench headed by Chief Justice Surya Kant issued notice to the Union Government on the DNPA's challenge to multiple provisions of the DPDP Act and the 2025 Rules.
- Publishers argue the law lacks a specific journalistic exemption and that Section 44(3), which amends the Right to Information Act, threatens public-interest disclosure.
- The principal compliance framework under the Act is scheduled to commence on 13 May 2027, with the matter listed for further hearing on 17 November 2026.
Why it matters: The outcome will shape how India balances constitutionally protected privacy against press freedom and governmental accountability in an increasingly data-driven society.
This summary was generated by AI. Editors may review and update it.
Document details
| Document type | Rules & Regulation |
|---|---|
| Issued by | Government of India |
| Region | India |
| Published | 15 November 2026 |
The Digital Personal Data Protection Act, 2023 received presidential assent on 11 August 2023 and the DPDP Rules, 2025 were notified on 13 November 2025. Together they establish India's framework for regulating the processing of digital personal data, placing obligations on entities that determine the purpose and means of such processing and recognising a set of individual rights over personal information.
The law has since drawn a constitutional challenge from the Digital News Publishers Association, representing 21 news publishers. On 27 October 2026, a Supreme Court Bench headed by Chief Justice Surya Kant issued notice to the Union Government. The Court declined to grant interim relief without first hearing the Union, and the matter is listed for further hearing on 17 November 2026.
The case has acquired broader significance for regions such as Jammu and Kashmir, where digital platforms are central to education, employment, banking and access to public services, and where the intersection of digital rights and State power carries particular weight.
What the document says
The DPDP Act regulates personal data collected in digital form and non-digital data subsequently digitised. Its framework rests on consent, purpose limitation, data minimisation, reasonable security safeguards and accountability. Individuals have the right to access information about their personal data, seek correction and erasure, obtain grievance redressal and nominate another person to exercise their rights in specified circumstances.
For children below eighteen years, the Act generally requires verifiable parental consent and restricts tracking, behavioural monitoring and targeted advertising, subject to statutory exemptions. Financial penalties of up to Rs. 250 crore are provided for specified contraventions. The principal compliance framework is scheduled to commence on 13 May 2027.
What the challenge argues
The DNPA's petition targets several provisions, including Sections 7, 17, 18, 19, 27, 29, 36, 37 and 44(3), as well as certain provisions of the Rules. A central objection is the absence of a specific exemption for journalistic activity. Investigative reporting frequently requires collecting and verifying personal information without the subject's knowledge; a consent requirement could obstruct investigations into alleged corruption or misuse of public office before they begin.
Section 44(3) amends Section 8(1)(j) of the Right to Information Act, 2005, altering the statutory treatment of personal information in response to RTI requests. Publishers and commentators argue this change has implications for transparency and public-interest disclosure that warrant constitutional scrutiny.
Section 17, which concerns exemptions available to the State, also raises questions about the scope of governmental access to personal data and whether adequate safeguards exist against disproportionate use of that power. The constitutional provisions at issue are Articles 14, 19(1)(a) and 21.
Background
The constitutional foundation of privacy in India was established by the Supreme Court's nine-judge Bench in Justice K.S. Puttaswamy (Retd.) v. Union of India in 2017, which recognised privacy, including informational privacy, as a fundamental right. The Court held that State interference with privacy must satisfy standards of legality, legitimate purpose, necessity and proportionality.
India's framework differs from comparable international regimes in notable respects. Unlike the European Union's General Data Protection Regulation, the DPDP Act does not expressly recognise a general right to data portability or a general right to object to processing, and it does not provide a general private right to claim compensation directly under the statute. Enforcement and grievance redressal operate principally through the Data Protection Board.
What happens next
The Supreme Court is to hear the matter further on 17 November 2026. The Union Government is yet to respond on the merits, having been issued notice on 27 October 2026 without interim relief being granted.
The Court's forthcoming consideration presents an opportunity to clarify the constitutional relationship between the right to privacy under Article 21, the freedom of expression under Article 19(1)(a), and the public's right to information. The compliance deadline of 13 May 2027 means that clarity on these questions carries direct practical consequences for data fiduciaries, news publishers and citizens alike.