Media association challenges govt.’s data privacy law in Supreme Court

1. At a Glance

• The Digital News Publishers Association (DNPA) has gone to the Supreme Court against specific provisions of the Digital Personal Data Protection (DPDP) Act, 2023 and the DPDP Rules, 2025. It argues that they violate journalistic freedom [1].
• The main complaint is that the law has no exemption for journalistic activity as a separate class of data processing. The DNPA says this protection is owed under Article 14 and Article 19(1)(a) [1].
• The case sets the right to privacy against the freedom of speech and expression and the right to information. This conflict between fundamental rights is a core topic for GS-II and Essay [1].
• The DPDP framework is India's first full statute on digital personal data. It works through Data Fiduciaries, Data Principals, Consent Managers and a Data Protection Board of India (DPBI) [2][4].

2. Why in the News

• 27 October 2026: A three-judge Bench headed by CJI Surya Kant was listed to hear a batch of petitions against the DPDP law filed by activists. The DNPA petition is listed before the same Bench [1].
• The DNPA says the law goes against the Supreme Court's own privacy judgment, which held privacy to be inviolable and fundamental to human dignity and life [1].
• The petition says the provisions "impermissibly restrict the fundamental right to information and freedom of speech and expression" [1].
• DNPA members come from across the media spectrum, including outlets owned by the Ambani and Adani Groups. The Hindu is also a member [1].

3. Background & Evolution

• The DPDP Act, 2023 was enacted as India's law on processing digital personal data [1][2].
• Draft DPDP Rules were released by the Government (PIB, MeitY) for public consultation before the final rules were notified [6].
• November 2025: The DPDP Rules, 2025 were notified. Official dates differ: PIB gives 14 Nov 2025 [2], while a later PIB note and a Lok Sabha answer give 13 Nov 2025 [3][4].
• November 2025: The Data Protection Board of India was established [4].
• May 2026: Applications were invited for the posts of Chairperson and Members of the Board [4].
• The Government later released a simplified compliance framework for start-ups and certain Data Fiduciaries under the Act and Rules [5].
• 2026: Activists' petitions, and then the DNPA's petition, were listed before a three-judge SC Bench [1].
• Not checked against the retrieved sources (confirm from a standard text): the "privacy judgment" is generally understood to be K.S. Puttaswamy v. Union of India (2017), a nine-judge Bench ruling.

4. Core Static Facts

Item	Fact
Parent law	Digital Personal Data Protection Act, 2023 [1]
Subordinate legislation	DPDP Rules, 2025, notified Nov 2025 (13 or 14 Nov, as sources differ) [2][4]
Nodal ministry	Ministry of Electronics and Information Technology (MeitY) [4]
Regulator	Data Protection Board of India, designed as a fully digital body [2]
Board composition	Chairperson + four Members, appointed through a Search-cum-Selection Committee [4]
Appellate body	TDSAT (Telecom Disputes Settlement and Appellate Tribunal) [2]
Rollout	Three phases over 18 months [4]
Phase 1	Setting up and running the Data Protection Board [4]
Phase 2	Registration and functioning of Consent Managers, within one year [4]
Phase 3	Data Fiduciary obligations (Data Principal rights, security safeguards, breach notification), within 18 months [4]
Response time for rights requests	At most 90 days [2]
Maximum penalty cited	Up to ₹200 crore for failing to notify the Board or affected persons of a personal data breach [2]
Articles invoked by DNPA	Art. 14 (equality) and Art. 19(1)(a) (speech and expression) [1]
SC Bench	Three judges, headed by CJI Surya Kant [1]

Key terms

• Data Principal: the individual the data relates to [2].
• Data Fiduciary: the entity that decides the purpose and means of processing [2].
• Consent Manager: a registered intermediary through which Data Principals give, manage and withdraw consent [4].

5. Multi-Dimensional Analysis

Legal / Constitutional

• The case is a conflict between rights: privacy (dignity and life) against the freedom of the press, which is part of Art. 19(1)(a), and the right to information [1].
• The DNPA's equality argument is that journalism is a distinct kind of processing. Treating it the same as commercial processing is said to violate Art. 14 [1].
• Because the petition attacks both the Act and the Rules, the Court may have to review delegated legislation as well as the parent statute [1].

Ethical / Governance

• The petition says the law threatens the "full spectrum of journalistic activity". It names journalists, ground reporters, citizens, whistleblowers and RTI activists [1].
• Accountability concern: if the law requires consent before processing personal data, reporting on public figures could be blocked.
• Counter-view: privacy is also a fundamental right. A blanket exemption for the press could be misused for doxxing or surveillance journalism.

Administrative

• The phased rollout delays the main fiduciary obligations by up to 18 months, which leaves room for judicial review before full compliance is due [4].
• The Board was set up in November 2025, but applications for its members were invited only in May 2026. This raises questions about whether the Board is ready to work [4].
• TDSAT hears appeals, so data-protection disputes go to a telecom tribunal and not a dedicated data tribunal [2].

Economic

• Penalties of up to ₹200 crore create heavy compliance costs for digital publishers treated as Data Fiduciaries [2].
• The simplified compliance framework for start-ups shows the Government is calibrating obligations by the size of the entity [5].

Scientific / Technological

• A "digital by design" Board, consent-manager systems and breach-notification processes reflect a techno-legal approach to regulation [2][4].

6. Recent Developments (last 12–18 months)

• 13/14 Nov 2025: DPDP Rules, 2025 notified [2][3][4].
• Nov 2025: Data Protection Board of India established [4].
• 2025–26: Simplified compliance framework announced for start-ups and certain fiduciaries [5].
• May 2026: Applications invited for Board Chairperson and Members [4].
• 27 Oct 2026: SC three-judge Bench under CJI Surya Kant listed to hear the activists' petitions and the DNPA petition [1].

7. Prelims Hooks

• The DPDP Rules were notified in November 2025, under the DPDP Act, 2023 [2].
• The DPDP Rules give an 18-month phased rollout in three phases [4].
• Consent Managers must be registered within one year of notification (Phase 2) [4].
• The Data Protection Board of India is designed as a fully digital body [2].
• The Board has a Chairperson + four Members, chosen by a Search-cum-Selection Committee [4].
• Appeals against Board decisions go to TDSAT, not a High Court in the first instance [2].
• Data Fiduciaries must answer Data Principal requests within 90 days at most [2].
• The penalty for breach-notification failure can reach ₹200 crore [2].
• The nodal ministry is MeitY, not the Ministry of Information and Broadcasting [4].
• DNPA = Digital News Publishers Association [1].
• The DNPA invoked Articles 14 and 19(1)(a) [1].
• The challenge is heard by a three-judge Bench headed by CJI Surya Kant [1].

8. Why a Law Made for Companies Also Catches Reporters

• The Act's default rule is "ask first"
• Personal data can be processed only for a lawful purpose and only after the person agrees (consent) [7].
• A notice must come before consent, and consent can be withdrawn at any time [7].

• A story about a minister's land deal is full of personal data. Under this rule, the reporter would need the minister's permission to use it.

• The list of exceptions does not include journalism

• Consent is not needed for a few "legitimate uses" (cases the law itself allows without asking). These are: data the person shared voluntarily, government benefits and services, medical emergencies, and employment [7].
• Reporting, investigation and public-interest writing are not on this list [7].

• So a newsroom is treated like any other Data Fiduciary. It must keep data accurate and delete it once the purpose is over, and the person reported on can ask for erasure [7].

• The Rules did not fix this gap

• After the Rules were notified in November 2025, the Editors Guild said they "fail to safeguard journalistic work" [9].
• The Guild said the MeitY Secretary had told press bodies that journalism would not come under the Act. That promise was never written into the Act or the Rules [9].
• An oral promise does not bind a court or the Data Protection Board. That is why the DNPA has gone to the Supreme Court [1].

9. The RTI Change Behind the Journalists' Worry

• Section 44(3) of the DPDP Act rewrites Section 8(1)(j) of the RTI Act
• Section 8(1)(j) is the RTI clause that lets officials refuse to give out personal information [8].
• The old clause allowed refusal only if the information had no link to public activity or interest, or would be an unwarranted invasion of privacy [10].

• Critics say the new wording drops this public-interest test, so any personal information can now be refused [10].

• Why this hurts reporters in particular

• Many investigations start with an RTI reply, for example an officer's assets or a contractor's payments. The DNPA petition names RTI activists among those affected [1].

• If the RTI door closes and the DPDP consent rule applies to the newsroom, both the source of the data and its use get squeezed.

• The Government's reply

• PIB says Section 8(2) of the RTI Act still works. Section 8(2) lets officials release exempt information when public interest outweighs the harm [8].

• The Minister said information that other laws require to be disclosed, such as details of public representatives and welfare schemes, will still be given [8].

• The dispute is already in Parliament and in Court

• INDIA bloc MPs asked the Centre to repeal Section 44(3) [10].
• The Supreme Court has asked the Centre to respond to petitions against this amendment [11].

10. Why the Equality Argument Has Teeth

• The State gets wide exemptions. The press gets none.
• The Centre can exempt its own agencies from the whole law by notification, on grounds such as the security of the state and public order [7].
• The 2023 law does not require any procedure or safeguard for such an exemption [7].

• Government agencies also need not delete personal data after its purpose is over [7].

• Earlier drafts were stricter on the State

• The 2018 Draft Bill said State processing must be authorised by law and be necessary and proportionate [7].

• The Joint Parliamentary Committee (2021) wanted the exemption order to follow a procedure that is "fair, just and reasonable" [7].

• How this links to Article 14

• Article 14 forbids treating unlike things alike, and like things unalike, without a good reason.
• The DNPA says journalism is a different kind of processing, so treating it like commercial processing is unequal [1].

• The contrast above makes the case stronger: the law can make carve-outs for the State and for start-ups [5], yet makes none for the press.

• How the Court will test it: proportionality

• In Puttaswamy (2017), the Supreme Court held that any limit on privacy must be proportionate (no wider than the need) [7].
• The same test works in reverse. A limit on press freedom in the name of privacy must also be the least restrictive option. A blanket consent rule may fail that test.

11. The Strongest Case for the Government — and Where It Falls Short

• The argument: privacy is also a fundamental right
• Puttaswamy made privacy part of Article 21 [7]. The press cannot simply override it.
• A wide "journalism" exemption raises a hard question: who is a journalist? A YouTuber, a blogger, or a data-scraping firm calling itself a news site could all claim it.

• The Srikrishna Committee (2018) itself said privacy rights must be balanced against free speech and the right to receive information [7].

• What is right about it

• A total exemption would leave people with no protection against doxxing (publishing someone's private details to harass them) or leaks of health records dressed up as news.

• So the honest answer is not "exempt the press fully". It is "exempt journalism with limits".

• Where it falls short

• The Government says journalism will not be hit and that RTI's public-interest route survives [8][9]. If so, there is little cost in writing that into the law.
• Leaving it to an oral promise gives the executive (the government of the day) a choice it can change later. That uncertainty itself can make reporters stay quiet. Courts call this a chilling effect (people censor themselves out of fear).
• The 2023 law also dropped the right to be forgotten that the 2018 and 2019 Bills had [7]. This shows Parliament can tune individual rights when it wants to. The silence on journalism was a choice, not an oversight.

12. Can a Two-Year Board Judge Big Media Fairly?

• The Board will decide complaints against newsrooms
• The Board checks compliance and imposes penalties [7].

• So if a politician complains about a story, a Board with heavy powers to fine will rule on it.

• Its members have short terms and can be reappointed

• Board members serve two years and can be reappointed [7].
• The Supreme Court in Rojer Mathew v. South Indian Bank (2019) said short terms with reappointment increase the executive's influence and control over tribunals [7].

• A member hoping for another term may hesitate to rule against the government's view.

• Other regulators get longer terms

• CERC and the Competition Commission of India: five years. SEBI: five years. TRAI: three years [7].

• The Board was also slow to start

• It was set up in November 2025, but applications for its Chairperson and Members were invited only in May 2026 [4].
• Until it has members, nobody can give guidance on how journalism will be treated.

13. What the Court, MeitY and Parliament Could Do

• MeitY: use the tool it already used for start-ups
• The Act lets the Centre exempt notified classes of Data Fiduciaries from certain duties [7].
• MeitY has already used this approach for a simplified compliance framework for start-ups [5].

• The same route can exempt bona fide journalism from consent and erasure duties. The Editors Guild has asked for exactly this [9].

• Parliament: put the public-interest test back into RTI Section 8(1)(j)

• This is what INDIA bloc MPs have demanded [10].

• It would make the Government's own promise, that public-interest disclosure survives, part of the law itself [8].

• Parliament: give Board members a longer, single term

• PRS points out that CCI and CERC members get five years [7].

• A longer term with no reappointment follows the Supreme Court's concern in Rojer Mathew [7].

• Supreme Court: read the law down instead of striking it down

• To "read down" means the Court keeps a law but narrows its meaning so that it stays constitutional.
• The Court can apply the Puttaswamy proportionality test [7] and hold that consent rules do not apply to public-interest journalism about people in public life.
• The Srikrishna Committee (2018) already named the factors for this balance: how sensitive the data is, its relevance to the public, and the person's role in public life [7].

14. Anchors for Answers

• Data: Board members serve a 2-year term with reappointment, against 5 years for CCI, CERC and SEBI and 3 years for TRAI [7]
• Data: Penalty of up to ₹200 crore for breach-notification failure, which is the scale of risk for a newsroom treated as a Data Fiduciary [2]
• Report/Committee: Justice B.N. Srikrishna Committee (2018), which said privacy must be balanced against free speech using public relevance and the person's public role [7]; Joint Parliamentary Committee on the PDP Bill, 2019 (2021) [7]
• Law/Case: K.S. Puttaswamy v. Union of India (2017), the proportionality test [7]; Rojer Mathew v. South Indian Bank (2019), short terms weaken independence [7]; DPDP Act Section 44(3), which amends RTI Section 8(1)(j) [8]
• Comparison: The UK's Data Protection Act 2018 gives security exemptions, but bulk government data processing needs a warrant approved by a Judicial Commissioner under the Investigatory Powers Act, 2016. India's exemption needs only an executive notification [7]
• Scheme: Simplified compliance framework for start-ups, which shows MeitY can carve out classes of Data Fiduciaries and is a ready model for journalism [5]

15. Mains Relevance

• GS-II: Fundamental Rights (Arts. 14, 19, 21); judicial review; statutory and regulatory bodies; transparency and accountability (RTI).
• GS-III: Cyber security; challenges to internal security through communication networks; IT and the digital economy.
• GS-IV / Essay: Ethics of privacy against the public's right to know; ethics of media.
• Possible question stems: 1. The absence of a journalistic exemption in the DPDP Act, 2023 sets privacy against press freedom. Critically examine how constitutional courts should balance the two. (250 words) 2. Discuss the institutional design of the Data Protection Board of India. Is it adequately independent to enforce the DPDP framework? (150 words) 3. Privacy and transparency are both facets of democratic accountability. Comment in the context of recent data protection law in India. (250 words)

16. Related Topics to Study Next

• The Puttaswamy (2017) privacy judgment: the constitutional benchmark the petitioners rely on.
• Right to Information Act, 2005: petitioners say the DPDP law affects RTI activism [1].
• Article 19(2) reasonable restrictions: the test any curb on press freedom must pass.
• IT Act, 2000 and IT Rules, 2021: the overlapping digital-media regulatory regime.
• EU GDPR (Art. 85, journalistic exemption): a comparative model for carve-outs for the media.
• TDSAT: its expanded role as the data-protection appellate body [2].
• Justice B.N. Srikrishna Committee (2018): the origin of India's data protection bill.
• Consent Manager framework and DEPA: the technical architecture of consent [4].

17. NCERT Concepts to Revise

• Right to privacy (Polity): Privacy is the right the Act protects and the DNPA says the law over-extends against journalism.
• K.S. Puttaswamy case (Polity): The 2017 nine-judge ruling is the benchmark both sides cite, with its legality, necessity and proportionality test.
• Freedom of the press (Polity): The DNPA's core claim is that the Act harms press freedom, which flows from Article 19(1)(a).
• Reasonable restrictions (Polity): Any curb on speech or press must pass Article 19(2) reasonableness, which is how the Court will test the law.
• Digital Personal Data Protection Act 2023 (Polity): This is the law under challenge, with its consent rules, fiduciary duties and the Data Protection Board.
• Delegated legislation (Polity): The petition attacks the 2025 Rules as well as the Act, so rule-making powers and their limits matter.

18. Common Errors / Trap Areas

• Wrong ministry: the DPDP Act and Rules belong to MeitY, not MIB [4].
• Act and Rules confused: the Act is from 2023 and the Rules from 2025. The DNPA challenges both [1].
• Notification date: official sources give both 13 and 14 Nov 2025. Learn "November 2025" [2][4].
• Appellate forum: appeals go to TDSAT, not the NCLAT or a new data tribunal [2].
• Board strength: Chairperson + four Members. The Chairperson is counted separately [4].
• Articles invoked: the DNPA's main claims rest on Art. 14 + 19(1)(a). Art. 21 is the basis of privacy, which the petitioners say the law misreads [1].