The Supreme Court sought the Centre's response to news publishers' challenge against the data protection framework. The case raises concerns about journalistic freedom, privacy requirements and citizens' access to information.Stock photo used for illustrationNewdelhi,Oct 27, 2026 16:46 ISTThe Supreme Court on Tuesday sought the Centre's response to a petition challenging the Digital Personal Data Protection Act, 2023, and the Digital Personal Data Protection Rules, 2025, news agency Press Trust of India reported.The petition was filed by the Digital News Publishers Association, which represents 21 prominent news organisations.
It has argued that the law, which does not provide an exemption for journalism, could severely affect news gathering and weaken citizens' right to information.The Act, passed by Parliament in August 2023, is India's first comprehensive law for protecting digital personal data. It requires any entity processing such data, described as a “Data Fiduciary”, to obtain the consent of the person concerned or process it for a limited set of permitted purposes listed under Section 7.Section 7 says a Data Fiduciary may process personal data “for the specified purpose for which the Data Principal has voluntarily provided her personal data to the Data Fiduciary, and in respect of which she has not indicated to the Data Fiduciary that she does not consent to the use of her personal data”.
Violations can attract penalties of up to Rs 250 crore. The Ministry of Electronics and Information Technology notified the accompanying Rules on November 13, 2025.
Their implementation will be staggered over 18 months.According to the publishers, the central concern is that news reporting is not included among the permitted uses under Section 7 or the exemptions under Section 17. Earlier versions of the proposed law in 2018, 2019 and 2021 had included such an exemption.
Section 17 lists situations in which personal data protection requirements do not apply. These include the processing of personal data to enforce a legal right or claim.
The exemptions also cover courts, tribunals and legally authorised bodies processing personal data to carry out judicial, quasi-judicial, regulatory or supervisory functions.The publishers have argued that without an exemption for journalism, a reporter writing about a person may first have to obtain that person's consent.The Rules explain how consent, notices and the reporting of data breaches will work. One of the disputed provisions is Rule 23, framed under Section 36 of the Act.
It allows the Centre, through an authorised person, to require any Data Fiduciary or intermediary to provide information. It can also prevent them from disclosing that such a request was made.The petition also challenges Section 44(3) of the Act, which amended Section 8(1)(j) of the Right to Information Act.
Earlier, personal information could be withheld only if it was unrelated to any public activity or would cause an unwarranted invasion of privacy. It could still be disclosed if a larger public interest justified its release.The amended provision now exempts “information which relates to personal information”.
The Supreme Court has sought the Centre's response to the publishers' concerns that the data protection law and its Rules could restrict journalism and access to information.- Ends