This is a research article based on the Gazette text of the statute and the Rules and on press reports of the court proceedings. The matter is sub judice. Nothing here is legal advice.

I. Introduction: Newsrooms in Court

On 27 October 2026, the Supreme Court issued notice on a writ petition filed under Article 32 of the Constitution by the Digital News Publishers Association (DNPA), an organisation comprising the digital wings of twenty-one major news organisations including The Indian Express, The Hindu, India Today, the Times Group, Zee, NDTV and Network18. An independent investigative journalist based in New Delhi, Yukta Mudgal, is a co-petitioner. The petition challenges Sections 7, 17(2), 18, 19, 27, 29, 36, 37 and 44(3) of the Digital Personal Data Protection Act, 2023, and Rules 16, 17 and 23 of the Digital Personal Data Protection Rules, 2025. It was filed through ADP Law Offices and Advocate Anuj Tiwari, and argued by Senior Advocate Madhavi Divan before a bench comprising Chief Justice of India Surya Kant and Justices Joymalya Bagchi and V. Mohana.

The Court issued notice on the petition as well as on the application for interim stay, declined to grant any interim relief, tagged the matter with the pending petitions concerning the amendment to the Right to Information Act, and made it returnable on 17 November 2026. The petitioners’ case, in Divan’s formulation, is stark: “The provisions will shut down the newsroom.” The earlier legislative avatars of the data protection law, she submitted, had expressly excluded journalistic activity; the enacted statute does not. “If I am left to the mercy of the data principal on whether he or she will give consent, the concept of news will be gone… News has to be new.” The Chief Justice responded that a balance has to be struck between the rights of citizens and those of the media, and invited the petitioners, as domain experts, to suggest safeguards to the Union. The petition records that the DNPA had already submitted a detailed representation to the Ministries of Information and Broadcasting and Electronics and Information Technology on 10 August 2026, followed by a meeting with Ministry officials on 25 August 2026.

This article examines each challenged provision on its text, explains precisely how it bites on journalistic activity, and tests the petitioners’ constitutional objections. The statutory provisions are reproduced verbatim from the Gazette print of the Act hosted by the Ministry of Electronics and Information Technology, and the Rules from Gazette Notification G.S.R. 846(E) dated 13 November 2025.

II. The Architecture of the Act

The DPDP Act received the President’s assent on 11 August 2023 as Act No. 22 of 2023. Its commencement is phased. By Notification G.S.R. 843(E), Sections 1(2) and 2, Sections 18 to 26, Sections 35 and 38 to 43, and sub-sections (1) and (3) of Section 44 came into force on 13 November 2025; the substantive obligations, including Sections 3 to 17 and Sections 27 to 34, 36 and 37, follow eighteen months later. The DPDP Rules, 2025 were notified on 13 November 2025, with Rules 1, 2 and 17 to 21 taking immediate effect and the operational rules to follow. Two consequences flow from this phasing. First, the challenge to most of the provisions is anticipatory, since the consent and enforcement machinery is not yet live. Second, the challenge to Sections 18, 19 and 44(3), and to Rule 17, concerns law that is already in force: the Board is being constituted now, and the RTI amendment already governs every information request decided after 13 November 2025.

Three definitions do the heavy lifting for the press. “Personal data” in Section 2(t) means any data about an individual who is identifiable by or in relation to such data: a name, photograph, designation, address or financial detail in a news report is personal data. “Processing” in Section 2(x) includes collection, sharing, disclosure by transmission, and dissemination or otherwise making available: publication is processing. A “Data Fiduciary” in Section 2(i) is any person who alone or in conjunction with others determines the purpose and means of processing: every publisher, editor and reporter qualifies. Section 4 then lays down the default rule:

Section 4. Grounds for processing personal data. 

(1) A person may process the personal data of a Data Principal only in accordance with the provisions of this Act and for a lawful purpose, (a) for which the Data Principal has given her consent; or (b) for certain legitimate uses. 
(2) For the purposes of this section, the expression "lawful purpose" means any purpose which is not expressly forbidden by law.

Consent, under Section 6, must be free, specific, informed, unconditional and unambiguous, signified by a clear affirmative action, and limited to personal data necessary for the specified purpose. The entire edifice is therefore consent-first. The question the petition poses is whether a consent-first statute can accommodate an activity whose essence is publishing true information about identifiable persons without asking them first.

III. Section 7: Certain Legitimate Uses, and the Missing Journalistic Ground

The petition’s first target is Section 7, the catalogue of non-consensual grounds on which personal data may be processed. It reads:

Section 7. Certain legitimate uses. 

A Data Fiduciary may process personal data of a Data Principal for any of following uses, namely: 
(a) for the specified purpose for which the Data Principal has voluntarily provided her personal data to the Data Fiduciary, and in respect of which she has not indicated to the Data Fiduciary that she does not consent to the use of her personal data; 
(b) for the State and any of its instrumentalities to provide or issue to the Data Principal such subsidy, benefit, service, certificate, licence or permit as may be prescribed; 
(c) for the performance by the State or any of its instrumentalities of any function under any law for the time being in force in India or in the interest of sovereignty and integrity of India or security of the State; 
(d) for fulfilling any obligation under any law for the time being in force in India on any person to disclose any information to the State or any of its instrumentalities; 
(e) for compliance with any judgment or decree or order issued under any law for the time being in force in India, or any judgment or order relating to claims of a contractual or civil nature under any law for the time being in force outside India; 
(f) for responding to a medical emergency involving a threat to the life or immediate threat to the health of the Data Principal or any other individual; 
(g) for taking measures to provide medical treatment or health services to any individual during an epidemic, outbreak of disease, or any other threat to public health; 
(h) for taking measures to ensure safety of, or provide assistance or services to, any individual during any disaster, or any breakdown of public order; or 
(i) for the purposes of employment or those related to safeguarding the employer from loss or liability, such as prevention of corporate espionage, maintenance of confidentiality of trade secrets, intellectual property, classified information or provision of any service or benefit sought by a Data Principal who is an employee.

The omission is conspicuous. Clauses (b), (c) and (d) carve out generous non-consensual space for the State and its instrumentalities. Clause (e) covers compliance with judgments, but not reporting on them. Clause (a), the voluntarily-provided-data ground, is the closest a newsroom could come to, and it fails exactly where journalism matters most: investigative reporting is, by definition, the processing of personal data that the subject has not volunteered and would not consent to. A reporter documenting corruption in public office, or publishing the affidavit disclosures of a candidate, cannot first seek the subject’s free, specific and informed consent without defeating the purpose of the exercise. Divan’s phrase for this was “pre-censorship“: the subject of the story becomes the gatekeeper of the story.

The constitutional objection has two limbs. The first is under Article 19(1)(a). Freedom of the press is not a separate right but is folded into freedom of speech and expression, and newsgathering and dissemination are its core. A statute that makes routine reporting conditional on the subject’s consent, on pain of penalties reaching fifty crore rupees for breach of “any other provision” of the Act, burdens the exercise of that freedom in a manner no other recent press regulation has attempted. The second limb is comparative and legislative: the petition points out that the State’s own crime-prevention processing is exempted under Section 17(1)(c), while the press, which the Supreme Court has repeatedly described as a watchdog performing a public function, is given no equivalent ground. The asymmetry is the point the petition presses under Article 14 as well, and it resurfaces in the challenge to Section 17(2).

IV. Section 17(2) and Rule 16: An Exemption for Archives, None for the Newsroom

Section 17 contains the Act’s exemptions. Sub-section (1) exempts, among others, processing necessary for enforcing legal rights or claims, processing by courts and tribunals, and processing for prevention, detection, investigation or prosecution of offences. Sub-section (2), the provision challenged, reads:

Section 17. 

Exemptions. (2) The provisions of this Act shall not apply in respect of the processing of personal data 
(a) by such instrumentality of the State as the Central Government may notify, in the interests of sovereignty and integrity of India, security of the State, friendly relations with foreign States, maintenance of public order or preventing incitement to any cognizable offence relating to any of these, and the processing by the Central Government of any personal data that such instrumentality may furnish to it; and 
(b) necessary for research, archiving or statistical purposes if the personal data is not to be used to take any decision specific to a Data Principal and such processing is carried on in accordance with such standards as may be prescribed.

Rule 16 of the DPDP Rules, 2025 operationalises clause (b):

Rule 16. Exemption from Act for research, archiving or statistical purposes. 

The provisions of the Act shall not apply to the processing of personal data necessary for research, archiving or statistical purposes if it is carried on in accordance with the standards specified in Second Schedule.

The petitioners’ Article 14 argument is straightforward. The statute exempts research, archiving and statistical processing, activities whose public-interest value is real but diffuse, while declining any exemption for journalism, an activity the Constitution treats as the institutional vehicle of the public’s right to know. The classification, the petition contends, lacks an intelligible differentia connected to the object of the law. If the object is to protect personal data while permitting socially valuable processing, there is no rational basis for preferring a statistical abstract over an investigative report.

The provision also produces a near paradox for the petitioners’ own members. A newspaper’s archive is, literally, archiving, and may fall within clause (b) and Rule 16. But the reporting that creates the archive is not exempt. The statute thus protects the warehouse while regulating the factory out of existence. The Union’s likely answer is Section 17(5), which empowers the Central Government to notify, within five years of commencement, that any provision of the Act shall not apply to any Data Fiduciary or class of Data Fiduciaries for a specified period. That is an executive safety valve, not a right, and its exercise is entirely discretionary. Whether a fundamental freedom can be left to the mercy of a future notification is itself part of what the Court will have to decide.

V. The Rights Overhang: Access, Correction, Erasure and Grievance

Although Sections 11 to 13 are not individually challenged, the petition complains of the “notice, prior consent and erasure” regime as a whole, and the rights chapter is where the erasure threat lives. Section 11 gives the Data Principal the right to obtain a summary of her personal data being processed and the identities of fiduciaries with whom it has been shared. Section 12 gives the right to correction and erasure of personal data. Section 13 gives the right to grievance redressal against the fiduciary, with escalation to the Data Protection Board.

Applied to a newsroom, these rights convert every published story into a potential compliance file. A person named in an investigative report could demand a summary of all personal data the publication holds on her, demand correction of characterisations she disputes, demand erasure of the online story, and, on an unsatisfactory response, complain to the Board, which may inquire and penalise under Section 27(1)(b). There is no public-interest balancing test in Section 12 comparable to Article 17(3)(a) of the GDPR, which expressly preserves processing necessary for exercising the right of freedom of expression and information from the erasure obligation. The result, the petition argues, is a privatised censorship regime: erasure at the instance of the powerful, adjudicated by an executive-appointed Board, with the archive as the casualty.

The counterweight the statute does offer is thin. Section 3(c)(ii) excludes personal data made publicly available by the Data Principal herself or under a legal obligation, but investigative journalism routinely deals in personal data that is neither. The illustrations to the Act contemplate bloggers and shoppers, not newsrooms. The design simply did not contemplate the press.

VI. Sections 18 and 19, read with Rule 17: Who Judges the Data Fiduciary

The petition challenges the constitution of the Data Protection Board of India. Section 18 establishes it:

Section 18. Establishment of Board. 

(1) With effect from such date as the Central Government may, by notification, appoint, there shall be established, for the purposes of this Act, a Board to be called the Data Protection Board of India. 
(2) The Board shall be a body corporate by the name aforesaid, having perpetual succession and a common seal, with power, subject to the provisions of this Act, to acquire, hold and dispose of property, both movable and immovable, and to contract and shall, by the said name, sue or be sued. 
(3) The headquarters of the Board shall be at such place as the Central Government may notify.

Section 19 governs composition and qualifications:

Section 19. Composition and qualifications for appointment of Chairperson and Members. 

(1) The Board shall consist of a Chairperson and such number of other Members as the Central Government may notify. 
(2) The Chairperson and other Members shall be appointed by the Central Government in such manner as may be prescribed. 
(3) The Chairperson and other Members shall be a person of ability, integrity and standing who possesses special knowledge or practical experience in the fields of data governance, administration or implementation of laws related to social or consumer protection, dispute resolution, information and communication technology, digital economy, law, regulation or technoregulation, or in any other field which in the opinion of the Central Government may be useful to the Board, and at least one among them shall be an expert in the field of law.

The “manner as may be prescribed” is Rule 17 of the DPDP Rules, 2025, already in force:

Rule 17. Appointment of Chairperson and other Members. 

(1) The Central Government shall constitute a Search-cum-Selection Committee, with the Cabinet Secretary as the chairperson and the Secretaries to the Government of India in charge of the Department of Legal Affairs and the Ministry of Electronics and Information Technology and two experts of repute having special knowledge or practical experience in a field which, in the opinion of the Central Government may be useful to the Board as members, to recommend individuals for appointment as Chairperson. 
(2) The Central Government shall constitute a Search-cum-Selection Committee, with the Secretary to the Government of India in the Ministry of Electronics and Information Technology as the chairperson and the Secretary to the Government of India in charge of the Department of Legal Affairs, and two experts of repute having special knowledge or practical experience in a field which in the opinion of the Central Government may be useful to the Board as members, to recommend individuals for appointment as a Member other than the Chairperson. 
(3) The Central Government shall, after considering the suitability of individuals recommended by the Search-cum-Selection Committee, appoint the Chairperson or other Member, as the case may be.

The petitioners’ objection is structural. Both selection committees are chaired by serving bureaucrats, the Cabinet Secretary and the MeitY Secretary respectively; the “experts of repute” are chosen by the Central Government itself; and the final appointment is the Government’s, on its assessment of suitability. No judicial member is required, though Section 19(3) does mandate at least one law expert. Members hold office for two years and are eligible for reappointment under Section 20(2), which ties their future to the very executive whose instrumentalities are the Act’s largest processors. The statute declares in Section 28(1) that the Board “shall function as an independent body“, and Section 21(2) requires an opportunity of hearing before removal, but the petitioners argue that independence declared is not independence secured.

This is the terrain of the Madras Bar Association line of cases, in which the Supreme Court has repeatedly held that tribunals exercising adjudicatory power over rights must be insulated from executive dominance in selection, tenure and service conditions. The Board is not styled a tribunal, but as the next section shows, its functions are unmistakably adjudicatory, and they include the imposition of monetary penalties running into hundreds of crores.

VII. Section 27: Adjudication Without a Judge

Section 27 gives the Board its teeth:

Section 27. Powers and functions of Board. 

(1) The Board shall exercise and perform the following powers and functions, namely: 
(a) on receipt of an intimation of personal data breach under sub-section (6) of section 8, to direct any urgent remedial or mitigation measures in the event of a personal data breach, and to inquire into such personal data breach and impose penalty as provided in this Act; 
(b) on a complaint made by a Data Principal in respect of a personal data breach or a breach in observance by a Data Fiduciary of its obligations in relation to her personal data or the exercise of her rights under the provisions of this Act, or on a reference made to it by the Central Government or a State Government, or in compliance of the directions of any court, to inquire into such breach and impose penalty as provided in this Act; 
(c) on a complaint made by a Data Principal in respect of a breach in observance by a Consent Manager of its obligations in relation to her personal data, to inquire into such breach and impose penalty as provided in this Act; 
(d) on receipt of an intimation of breach of any condition of registration of a Consent Manager, to inquire into such breach and impose penalty as provided in this Act; and 
(e) on a reference made by the Central Government in respect of the breach in observance of the provisions of sub-section (2) of section 37 by an intermediary, to inquire into such breach and impose penalty as provided in this Act. 
(2) The Board may, for the effective discharge of its functions under the provisions of this Act, after giving the person concerned an opportunity of being heard and after recording reasons in writing, issue such directions as it may consider necessary to such person, who shall be bound to comply with the same. 
(3) The Board may, on a representation made to it by a person affected by a direction issued under sub-section (1) or sub-section (2), or on a reference made by the Central Government, modify, suspend, withdraw or cancel such direction and, while doing so, impose such conditions as it may deem fit, subject to which the modification, suspension, withdrawal or cancellation shall have effect.

Clause (b) is the provision that converts a reader’s complaint about a story into a Board inquiry against the publisher. Section 28 arms the Board for that inquiry with the powers of a civil court: summoning and examining persons on oath, compelling discovery and production of documents, and inspecting “any data, book, document, register, books of account or any other document“. For a newsroom, compelled production of documents and data, with no reporter-privilege carve-out anywhere in the Act, is the point at which data protection enforcement collides with source protection. Section 28(10) additionally permits interim orders during inquiry, after hearing, for reasons recorded in writing: an interim direction to a publisher, in the life of a news cycle, can function as a restraint even when it is styled as procedure.

The penalties give the restraint its bite. The Schedule to the Act permits penalties up to two hundred and fifty crore rupees for breach of the security-safeguards obligation in Section 8(5), and up to fifty crore rupees for breach of “any other provision of this Act or the rules made thereunder“. A consent or notice failure in respect of a single investigative story could therefore attract a fifty-crore penalty, imposed by a body whose members are selected by the executive, serve two-year renewable terms, and need include no judge.

The petitioners’ argument is that adjudication of this consequence, touching as it does the fundamental right under Article 19(1)(a), cannot be entrusted to a body constituted in this manner. The Union will answer that Section 28(1) mandates independence, Section 28(6) mandates natural justice and recorded reasons, and Section 29 provides an appeal. The petitioners’ reply is that these are procedural cushions around a structural defect.

VIII. Section 29: Appeal to a Telecom Tribunal

Section 29 provides the appellate remedy:

Section 29. Appeal to Appellate Tribunal. 

(1) Any person aggrieved by an order or direction made by the Board under this Act may prefer an appeal before the Appellate Tribunal. (2) Every appeal under sub-section (1) shall be filed within a period of sixty days from the date of receipt of the order or direction appealed against and it shall be in such form and manner and shall be accompanied by such fee as may be prescribed. 
(3) The Appellate Tribunal may entertain an appeal after the expiry of the period specified in sub-section (2), if it is satisfied that there was sufficient cause for not preferring the appeal within that period. 
(4) On receipt of an appeal under sub-section (1), the Appellate Tribunal may, after giving the parties to the appeal, an opportunity of being heard, pass such orders thereon as it thinks fit, confirming, modifying or setting aside the order appealed against. 
(5) The Appellate Tribunal shall send a copy of every order made by it to the Board and to the parties to the appeal. 
(6) The appeal filed before the Appellate Tribunal under sub-section (1) shall be dealt with by it as expeditiously as possible and endeavour shall be made by it to dispose of the appeal finally within six months from the date on which the appeal is presented to it. (10)

In respect of appeals filed under the provisions of this Act, the Appellate Tribunal shall, as far as practicable, function as a digital office, with the receipt of appeal, hearing and pronouncement of decisions in respect of the same being digital by design.

The “Appellate Tribunal” is defined in Section 2(a) as the Telecom Disputes Settlement and Appellate Tribunal established under the Telecom Regulatory Authority of India Act, 1997. The petitioners challenge this forum choice. TDSAT is a sectoral tribunal designed for telecom disputes; press-freedom adjudication, involving the balancing of privacy against the public’s right to know, is not its institutional competence. A further appeal lies to the Supreme Court under Section 18 of the TRAI Act, but only after the tribunal stage. The objection is best understood as an adjunct to the Sections 18, 19 and 27 challenge: if the primary adjudicator is structurally suspect, the appellate forum must be capable of curing the defect, and a telecom tribunal, however distinguished, is an odd repository for that corrective function. The Union’s answer will be that Parliament is entitled to designate an existing tribunal, that TDSAT has a judicial chairperson, and that the Supreme Court remains the ultimate forum. The petitioners will press the principle from L. Chandrakumar that an alternative adjudicatory mechanism must be an effective substitute, judged by its capacity to decide the rights actually in issue.

IX. Section 36 and Rule 23: The Power to Call for Information, and the Gag

Section 36 is a single sentence, and its brevity is the complaint:

Section 36. Power to call for information. 

The Central Government may, for the purposes of this Act, require the Board and any Data Fiduciary or intermediary to furnish such information as it may call for.

Rule 23 operationalises it:

Rule 23. Calling for information from Data Fiduciary or intermediary. 

(1) The Central Government may, for such purposes of the Act as are specified in Seventh Schedule, acting through the corresponding authorised person specified in the said Schedule, require any Data Fiduciary or intermediary to furnish such information as may be called for, within the specified period as may be given in such order. 
(2) Where the disclosure of furnishing of information as referred to in sub-rule (1) is likely to prejudicially affect the sovereignty and integrity of India or security of the State, the Central Government may require the Data Fiduciary or intermediary to not disclose such furnishing to affected Data Principal or any other person except with the previous permission, in writing, of the authorised person. 
(3) For the purposes of this rule, the expression "intermediary" shall have the same meaning as assigned to it in the Information Technology Act, 2000.

The Seventh Schedule lists three purposes: use of personal data by the State or its instrumentalities in the interests of sovereignty and integrity of India or security of the State; use by the State for performing functions under law or fulfilling legal disclosure obligations; and assessment for notifying Significant Data Fiduciaries. The authorised persons are officers of the Central Government designated against each purpose.

The petitioners’ objections are fourfold. First, there is no threshold of necessity or proportionality in either the section or the rule: the Government “may” call for “such information as it may call for“, a formulation that states a power without stating its limits. Second, there is no prior judicial oversight and no notice to the affected individual, departing from the safeguards the Supreme Court has insisted upon for state intrusion into informational privacy since Puttaswamy. Third, Rule 23(2) adds a gag: where disclosure of the request is “likely” to prejudice sovereignty, integrity or security, the recipient may be forbidden from telling the affected person or anyone else, without the authorised person’s prior written permission. The likelihood is assessed by the requester, the gag has no statutory time limit, and no independent review is provided. Fourth, and most acutely for the press, a news publisher is a Data Fiduciary like any other. An information call directed at a publisher’s records, combined with the Board’s document-inspection powers under Section 28(7), can reach notes, communications and metadata that identify confidential sources. India has no general shield law for journalists; the closest protection, Section 15(2) of the Press Council Act, 1978, only bars compelling disclosure of sources in the Council’s own inquiries. The petition argues that Section 36, read with Rule 23, therefore exposes the source network on which investigative journalism depends, with a chilling effect that no subsequent remedy can undo.

X. Section 37: Blocking Directions in the Interests of the General Public

Section 37, marginally headed “Power of Central Government to issue directions”, is the Act’s blocking power:

Section 37. 

(1) The Central Government or any of its officers specially authorised by it in this behalf may, upon receipt of a reference in writing from the Board that 
(a) intimates the imposition of monetary penalty by the Board on a Data Fiduciary in two or more instances; and 
(b) advises, in the interests of the general public, the blocking for access by the public to any information generated, transmitted, received, stored or hosted, in any computer resource that enables such Data Fiduciary to carry on any activity relating to offering of goods or services to Data Principals within the territory of India, after giving an opportunity of being heard to that Data Fiduciary, on being satisfied that it is necessary or expedient so to do, in the interests of the general public, for reasons to be recorded in writing, by order, direct any agency of the Central Government or any intermediary to block for access by the public or cause to be blocked for access by the public any such information. 
(2) Every intermediary who receives a direction issued under subsection (1) shall be bound to comply with the same. 
(3) For the purposes of this section, the expressions "computer resource", "information" and "intermediary" shall have the meanings respectively assigned to them in the Information Technology Act, 2000.

The petitioners contend that this is a prior-restraint power dressed as data protection enforcement. The trigger is administrative, not judicial: two Board penalties, a Board advice, a hearing, and an executive satisfaction that blocking is “necessary or expedient” in “the interests of the general public“. That last phrase is strikingly broad. Section 69A of the Information Technology Act, 2000, the closest analogue, permits blocking only on grounds that mirror Article 19(2), and it was upheld in Shreya Singhal v. Union of India precisely because of its procedural safeguards, including recorded reasons and committee review. Section 37 offers fewer guardrails and a wider ground, and its target can be “any information” on the fiduciary’s computer resource, which for a news publisher means its website and archives. The petitioners’ deeper point is structural: a data-protection statute is an unlikely and dangerous home for a content-blocking power, because it allows the executive to reach, through the sideways route of data-compliance penalties, the very publications it could not directly censor. Two penalties for consent or notice failures in respect of investigative stories could become the runway to a blocking reference. Against this, the Union will stress the hearing requirement, the recorded reasons, and the Board reference as a filter. The petitioners’ answer is that a hearing before the executive about whether the executive may block is not the safeguard that Shreya Singhal contemplated.

XI. Section 44(3): The RTI Act Amendment

Section 44(3) amends the Right to Information Act, 2005. Before the amendment, Section 8(1)(j) of the RTI Act read:

Section 8(1)(j), RTI Act, 2005 (before 13 November 2025): 

"information which relates to personal information the disclosure of which has no relationship to any public activity or interest, or which would cause unwarranted invasion of the privacy of the individual unless the Central Public Information Officer or the State Public Information Officer or the appellate authority, as the case may be, is satisfied that the larger public interest justifies the disclosure of such information: Provided that the information which cannot be denied to the Parliament or a State Legislature shall not be denied to any person."

Section 44(3) of the DPDP Act substitutes this with:

Section 8(1)(j), RTI Act, 2005 (from 13 November 2025): "information which relates to personal information."

The amendment deletes both filters that kept the exemption within bounds: the requirement that the information have no relationship to any public activity or interest, and the larger-public-interest override. What was a calibrated exception is now, on its face, a blanket rule: if it relates to personal information, it need not be disclosed. The petitioners argue that this sacrifices the fundamental right to know at the altar of privacy, citing the Supreme Court’s decision in Association for Democratic Reforms v. Union of India, the electoral bonds case, for the proposition that the public’s right to information about public affairs is itself a fundamental right under Article 19(1)(a). Investigative journalism in India has long depended on RTI disclosures about public servants acting in their official capacity: service records, asset declarations, file notings on public decisions. The petition contends that the amended clause shuts that pipeline without regard to whether the information concerns public activity or whether disclosure serves a larger public interest.

Two qualifications must be noted in fairness. First, Section 8(2) of the RTI Act survives unamended: “a public authority may allow access to information, if public interest in disclosure outweighs the harm to the protected interests.” The Union will certainly rely on it. The petitioners’ answer is that Section 8(2) is discretionary (“may”), decided at the level of the public authority, and structured as an exception to an now-absolute exemption, which reverses the earlier scheme where disclosure was the rule and the public-interest override was built into the clause itself. Second, petitions challenging this very amendment were referred by the Supreme Court to a three-judge bench in February 2026, so the DNPA petition will now be tagged with them. Unlike most of the challenged DPDP provisions, the RTI amendment is already in force, having commenced on 13 November 2025, which gives this limb of the petition a live and immediate injury.

XII. Legislative History: The Exemption That Was

The petition leans heavily on legislative history, and the history supports the telling. The Personal Data Protection Bill, 2018, based on the Justice Srikrishna Committee report, contained in Section 47 an express exemption for processing necessary for or relevant to a “journalistic purpose“, defined to mean any activity intended towards the dissemination, through print, electronic or any other media, of factual reports, analysis, opinions, views or documentaries regarding news, recent or current events, or any other information which the data fiduciary believes the public, or any significantly discernible class of the public, to have an interest in. The exemption was conditioned on compliance with any code of ethics issued by the Press Council of India or a media self-regulatory organisation. The Personal Data Protection Bill, 2019 and the Data Protection Bill, 2021 retained journalistic carve-outs. The draft Digital Personal Data Protection Bill, 2022 dropped the specific exemption, leaving exemptions to be notified by the Central Government. The enacted 2023 Act followed the 2022 draft.

The significance is twofold. As a matter of statutory interpretation, the deliberate deletion of an exemption that three successive Bills had carried is evidence that Parliament adverted to journalism and chose not to protect it, which strengthens the petitioners’ arbitrariness argument and weakens any claim of inadvertence. As a matter of remedy, the 2018 model shows the Court a workable template: a defined journalistic purpose, tethered to news and public interest, conditioned on press ethics codes. The petitioners are not asking the Court to invent press exceptionalism from whole cloth; they are asking it to restore what the legislative process had repeatedly recognised and then abandoned.

XIII. Comparative Glimpses

Other data protection regimes have faced the same collision and resolved it in favour of accommodation. Article 85 of the European Union’s General Data Protection Regulation requires Member States to reconcile, by law, the right to the protection of personal data with the right to freedom of expression and information, including processing for journalistic purposes, and permits derogations from the Regulation’s core chapters where necessary for that reconciliation. The United Kingdom’s Data Protection Act, 2018, in paragraph 26 of Part 5 of Schedule 2, exempts journalistic processing from several GDPR provisions where the controller reasonably believes that publication would be in the public interest and that compliance would be incompatible with the journalistic purpose, with regard to be had to compliance with relevant codes of practice. Singapore’s Personal Data Protection Act, 2012 permits news organisations to collect, use and disclose personal data without consent solely for their news activity. The Indian statute stands nearly alone among major data protection laws in offering the press no foothold at all, a contrast the petitioners will press as evidence that the omission is not a global necessity but a domestic choice.

XIV. The Constitutional Framework

The petition moves on three constitutional planes. The first is Article 19(1)(a). Freedom of speech and expression includes the freedom of the press, and the Supreme Court has located newsgathering, publication and circulation within it. Restrictions must fall within Article 19(2) and must be reasonable. A consent precondition on truthful reporting about identifiable persons, backed by penal consequences, is tested not against whether privacy is a legitimate aim, it plainly is after Puttaswamy, but against whether the restriction is narrowly drawn. Prior restraint occupies a specially suspect place in this jurisprudence, from Romesh Thappar and Brij Bhushan onwards, and both the consent requirement and the Section 37 blocking power invite that scrutiny.

The second plane is Article 14. The petitioners argue that the classification in Section 17(2), which exempts research, archiving and statistics but not journalism, is manifestly arbitrary in the sense explained in Shayara Bano: a classification without a rational nexus to the statute’s object. The object, stated in the preamble, is to recognise both the individual’s right to protect personal data and the need to process such data for lawful purposes. Journalism is a lawful purpose of the highest constitutional pedigree, and preferring statistical processing over it is difficult to defend as reasoned.

The third plane is Article 21 and the independence of adjudication. Puttaswamy’s proportionality test demands legality, a legitimate aim, proportionality between the aim and the means, and procedural safeguards. Sections 36 and 37 and Rule 23 are most vulnerable on the third and fourth prongs: a one-line information power, a gag without time limit or review, and a blocking power on the elastic ground of the general public interest. The Board’s constitution is tested against the Madras Bar Association principles: where the state creates an adjudicatory body that determines rights and imposes ruinous penalties, the selection, tenure and service conditions of its members must secure independence from the executive. A two-year renewable term, executive-chaired selection committees, and no required judicial member sit uneasily with that demand, even allowing for the mandated law expert and the declaration of independence in Section 28(1).

The Union’s strongest constitutional card is Puttaswamy itself, privacy is a fundamental right, and the DPDP Act is Parliament’s chosen instrument for giving it effect. Rights conflict is not resolved by declaring one absolute. The petitioners’ answer, and the doctrinally honest one, is that conflict of rights calls for structured balancing, of the kind Article 85 of the GDPR mandates and the 2018 Bill attempted, and that the present statute performs no balancing at all for the press.

XV. The Middle Path: What the Court Could Do

Few observers expect the Court to strike down the DPDP Act’s core. The more likely judicial responses lie on a spectrum. At one end, the Court could read down the challenged provisions or issue a declaration that they do not apply to bona fide journalistic processing, effectively writing back the exemption the 2022 draft deleted. At the middle, it could direct the Central Government to consider a notification under Section 17(5) exempting journalistic processing, or to frame guidelines tethering the exemption to press ethics codes on the 2018 model, an outcome the Chief Justice’s invitation to the petitioners to suggest safeguards seems to foreshadow. On the Board, the Court could require a judicial member or a judge-led selection process on Madras Bar Association lines, a remedy it has granted for other tribunals. On Sections 36 and 37 and Rule 23, it could read in requirements of necessity, proportionality, recorded satisfaction and time-bound, reviewable gag orders, and confine Section 37 blocking to grounds relatable to Article 19(2) with Shreya Singhal style safeguards. On the RTI amendment, the tagged three-judge bench could harmoniously read the amended clause (j) with the surviving Section 8(2), restoring a structured public-interest test. The least the petition will achieve, even if every provision survives, is a judicially supervised negotiation between the press and the executive over the safeguards the statute omitted. That negotiation has already begun: the DNPA’s August 2026 representation and the Court’s 17 November hearing are its first two sittings.

XVI. Conclusion

The DNPA petition is best understood not as an attack on data protection but as an attack on a design flaw: a consent-first statute that forgot the one profession constitutionally tasked with publishing personal data without consent. The provisions under challenge form a coherent chain. Section 7 denies journalism a lawful ground; Section 17(2) and Rule 16 deny it an exemption granted to lesser claimants; the rights chapter arms every subject of a story with erasure; Sections 18, 19 and 27 place adjudication in an executive-selected body wielding civil-court powers and hundred-crore penalties; Section 29 routes appeals to a telecom tribunal; Section 36 and Rule 23 open the newsroom’s records to executive information calls under gag; Section 37 adds a blocking power on the vague ground of the general public interest; and Section 44(3) closes the RTI pipeline that feeds investigative reporting. Taken together, they do what Divan told the Court they do: they make the journalist answerable, at every stage from newsgathering to archiving, to the subject of the story and to the state. Whether the Supreme Court dismantles that chain or merely re-engineers it, the case will define the boundary between privacy and the press for the digital decades ahead.

Notes and Sources

Statute and Rules

[1] The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), Gazette print hosted by the Ministry of Electronics and Information Technology. All section texts reproduced above are verbatim from this print.

[2] The Digital Personal Data Protection Rules, 2025, Gazette Notification G.S.R. 846(E) dated 13 November 2025.

[3] Commencement Notification G.S.R. 843(E) dated 13 November 2025, bringing Sections 1(2) and 2, 18 to 26, 35, 38 to 43 and 44(1) and (3) into force.

Proceedings

[4] LiveLaw report, “‘Newsrooms Will Shutdown’: Digital Wings Of Legacy Media Move Supreme Court Challenging Personal Data Protection Law”, published 27 October 2026, reporting the hearing before CJI Surya Kant and Justices Joymalya Bagchi and V. Mohana, the submissions of Senior Advocate Madhavi Divan, the DNPA representation dated 10 August 2026 and meeting dated 25 August 2026, and the returnable date of 17 November 2026.

Legislative history and comparative material

[5] The Personal Data Protection Bill, 2018, Section 47 (journalistic purpose exemption); PRS Legislative Research summary of the 2018 Bill.

[6] Regulation (EU) 2016/679 (General Data Protection Regulation), Article 85 (processing and freedom of expression and information) and Article 17(3)(a) (erasure exception).

[7] Data Protection Act, 2018 (UK), Schedule 2, Part 5, paragraph 26 (journalism exemption).

[8] Personal Data Protection Act, 2012 (Singapore), news organisation provisions.

Case law cited

[9] Justice K.S. Puttaswamy (Retd.) v. Union of India (2017) 10 SCC 1 (privacy as a fundamental right; proportionality).

[10] Association for Democratic Reforms v. Union of India (2024) (electoral bonds; the right to know).

[11] Romesh Thappar v. State of Madras AIR 1950 SC 124 and Brij Bhushan v. State of Delhi AIR 1950 SC 129 (prior restraint).

[12] Indian Express Newspapers v. Union of India (1985) 1 SCC 641 (freedom of the press).

[13] Maneka Gandhi v. Union of India (1978) 2 SCC 621 (fair procedure).

[14] Shayara Bano v. Union of India (2017) 9 SCC 1 (manifest arbitrariness).

[15] Madras Bar Association v. Union of India (2010) 11 SCC 1; (2014) 10 SCC 1; (2020) 12 SCC 767; (2021) 7 SCC 369 (tribunal independence).

[16] L. Chandrakumar v. Union of India (1997) 3 SCC 261 (effective alternative remedy).

[17] Shreya Singhal v. Union of India (2015) 5 SCC 1 (Section 69A safeguards).

[18] Anuradha Bhasin v. Union of India (2020) 1 SCC 1 (proportionality).

[19] R. Rajagopal v. State of Tamil Nadu (1994) 6 SCC 632 (privacy and publication).