India's data protection regime has now found itself at the centre of an important constitutional challenge concerning the future of investigative journalism. The Digital News Publishers Association (DNPA), representing the digital arms of 21 major Indian news organisations, including The Indian Express, The Hindu, India Today, NDTV, Network18 and the Times Group has approached the Supreme Court challenging several provisions of the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025.

The petitioners contend that the framework, particularly its requirements concerning notice, consent and personal data processing, fails to account for the realities of journalistic work, where information of legitimate public interest often has to be collected, verified and reported without the consent—or even the knowledge—of the person concerned. The petition thus raises a larger constitutional question: whether a law enacted to protect informational privacy can, in its application, impose a disproportionate burden on press freedom and the public's right to know.

On 27 October 2026, a Bench comprising Chief Justice Surya Kant and Justices Joymalya Bagchi and V. Mohana issued notice on the petition. The Court declined to grant an interim stay without hearing the Union Government. The matter is next listed for hearing on 17 November 2026.^[1]

From legislative recognition to regulatory omission

The present challenge has its roots in a legislative shift that began several years earlier. The Personal Data Protection Bill, 2018, expressly recognised journalistic purposes and provided an exemption under Section 47. A similar protection appeared in the 2019 Personal Data Protection Bill and was considered by the Joint Parliamentary Committee examining that legislation. The Committee acknowledged the importance of freedom of expression to the functioning of the media, while also recognising the need to prevent misuse of personal information in the name of journalism. However, the proposed exemption disappeared from the Draft Digital Personal Data Protection Bill, 2022, and was not restored in the legislation enacted in 2023.^[2]

This progression is significant because Parliament had previously considered a mechanism to reconcile journalistic freedom with individual privacy. The eventual omission of that protection, without providing an alternative safeguard, raises the question whether the final framework adequately accommodates the constitutional requirements of investigative reporting.

The Act and the Rules have a phased commencement framework. While the institutional provisions, including Sections 18 to 26, and the amendment to Section 8(1)(j) of the RTI Act under Section 44(3), came into force on 13 November 2025, the substantive provisions governing the processing of personal data, including Sections 3 to 17, together with Sections 36 and 37, are scheduled to come into force on 13 May 2027. Similarly, Rule 17, concerning the appointment of the Chairperson and Members of the Data Protection Board, commenced earlier, whereas Rules 16 and 23 are scheduled to commence on 13 May 2027.^[3]

What exactly has been challenged?

The petition challenges Sections 7, 17(2), 18, 19, 27, 29, 36, 37 and 44(3) of the DPDP Act, along with Rules 16, 17 and 23 of the DPDP Rules. The challenge broadly concerns four areas.

1. Absence of a journalistic exemption

Sections 5 and 6 establish the notice and consent framework, while Section 7 deals with certain legitimate uses of personal data. The petitioners' objection is that journalism has not been recognised as a distinct basis for processing personal information in the public interest. Section 17(2), which provides specified exemptions, including for research, archiving and statistical purposes, is also challenged for excluding journalism.

Consider an investigation into the assets of a public official or irregularities in the award of government contracts. Requiring the journalist to notify the very individual under investigation, or obtain consent before processing relevant information, could defeat the investigation itself. The difficulty is that the law appears to proceed on the assumption that personal data processing ordinarily takes place within a relationship between an identifiable individual and an organisation, in which notice and consent can meaningfully regulate the use of information. Investigative journalism operates on a fundamentally different premise.

Investigative journalism operates differently from ordinary commercial data processing. It often begins with whistleblowers, public records, leaked documents and independent verification. The absence of a journalistic exemption risks treating legitimate public-interest investigations in the same manner as indiscriminate commercial exploitation of personal data.

2. Executive control over the Data Protection Board

Sections 18, 19 and 27, concerning the constitution, composition and powers of the Data Protection Board, are challenged on the ground that substantial adjudicatory and enforcement functions have been entrusted to an executive-controlled institution without adequate safeguards. Section 29, dealing with penalties, is also challenged as part of this enforcement framework. Rule 17, which prescribes the appointment mechanism, assumes significance in examining the Board's institutional independence.

The concern is not merely administrative. Where a regulator can adjudicate alleged violations and impose substantial monetary penalties, regulatory uncertainty may influence editorial decisions, particularly when reporting concerns powerful public officials or institutions.

Institutional independence is therefore not simply an administrative consideration; it is a constitutional safeguard against indirect State influence over speech and editorial autonomy.

3. Governmental powers and protection of journalistic sources

Section 36 empowers the Central Government to call for information from a Data Fiduciary, intermediary or the Board for specified purposes. Rule 23, read with the Seventh Schedule, prescribes the mechanism for such requisitions and permits restrictions on disclosure in specified circumstances. The petitioners contend that these powers lack adequate safeguards against the exposure of confidential journalistic sources.

The protection of sources is essential to investigative journalism. Whistleblowers exposing corruption or institutional misconduct may share information only on the assurance that their identities will remain confidential.

The possibility of compelled disclosure may discourage potential sources from approaching journalists even before any actual disclosure takes place. The chilling effect thus extends beyond the newsroom to the very individuals who provide information necessary for exposing wrongdoing.

Section 37 raises a separate concern. It empowers the Government, subject to specified statutory conditions, including a reference from the Board following repeated monetary penalties, to direct the blocking of public access to information in the interests of the general public. Although the provision incorporates procedural safeguards, its potential impact on digital publishers and public access to news warrants constitutional scrutiny.

4. Dilution of the right to information

Section 44(3) substitutes Section 8(1)(j) of the Right to Information Act, 2005. The earlier provision expressly balanced personal privacy against public activity and interest, subject to the larger public-interest override. The substituted provision broadly exempts information relating to personal information.

The amendment does not eliminate the public-interest override under Section 8(2). Nevertheless, the removal of the earlier balancing language may make disclosure more difficult in matters involving public officials, conflicts of interest, public appointments and the exercise of governmental authority.

Information may be personal in character but public in consequence. Transparency in public administration cannot always be achieved without disclosure of information that has a direct bearing on public accountability.

The constitutional tension: A chilling effect on investigative journalism

The cumulative impact of these provisions may be more significant than their individual operation. Investigative journalism involves acquiring information, verifying facts, protecting sources and eventually publishing findings. Uncertainty at each stage may discourage journalists from pursuing stories involving personal information, whistleblowers from sharing documents and news organisations from undertaking investigations carrying substantial regulatory risks.

Consider a journalist who receives documents from a whistleblower concerning alleged corruption in a government department. The documents contain personal information about public officials and third parties. The journalist must verify the information, contact relevant individuals, examine financial records and obtain corroborating material. If the subject is informed prematurely, the investigation may be compromised. If the source's identity or related information becomes vulnerable to requisition, the whistleblower may refuse to cooperate. If the newsroom faces substantial financial penalties for non-compliance, editorial decisions may become influenced by regulatory risk.

This raises the familiar constitutional problem of the chilling effect: freedom of the press may be impaired not only through direct censorship, but also through legal obligations and penalties that induce self-censorship.

The Constitutional Balance: The right to privacy, recognised as a fundamental right under Article 21 in K.S. Puttaswamy v. Union of India, protects individuals against arbitrary collection, use and disclosure of personal information.^[4] Equally, press freedom under Article 19(1)(a), recognised as an essential component of freedom of speech and expression, enables journalists to investigate matters of public concern and hold public institutions accountable. The Supreme Court has repeatedly emphasised its importance, including in Bennett Coleman & Co. v. Union of India.^[5]

The framework in Puttaswamy also establishes that restrictions upon fundamental rights must satisfy constitutional standards of legality, legitimate State aim, necessity and proportionality. As elaborated in Modern Dental College and Research Centre v. State of Madhya Pradesh (2016), the means adopted must bear a proportionate relationship to the objective sought to be achieved.^[6]

The existence of a legitimate objective of protecting personal data cannot, by itself, justify every restriction imposed upon journalistic activity. The constitutional inquiry must consider whether the regulatory framework is proportionate and whether less restrictive alternatives, such as a carefully defined public-interest exemption, could protect privacy without obstructing legitimate investigations.

Further, this is not merely a dispute between publishers and the State. It also concerns the citizen's right to know and democratic accountability. From State of U.P. v. Raj Narain to CPIO, Supreme Court of India v. Subhash Chandra Agarwal and Association for Democratic Reforms v. Union of India^[7], the Supreme Court has recognised the importance of access to information in democratic governance. Restrictions affecting the ability of journalists to investigate and disseminate information consequently affect the public's capacity to scrutinise those exercising power.

Comparative law also demonstrates that privacy and journalism need not be mutually exclusive. The United Kingdom's Data Protection Act, 2018, under Schedule 2, Part 5, paragraph 26, provides a qualified exemption for journalistic processing undertaken with a view to publication in the public interest, where compliance with specified data-protection obligations would be incompatible with those purposes.^[8] Such an approach recognises the special requirements of journalism without granting the media unrestricted immunity.

Ultimately, the question before the Supreme Court is not whether privacy deserves protection or whether journalism should be exempt from all regulation. It is whether informational privacy can be protected without impairing the constitutional conditions that make a free press possible. A democracy must protect individuals against unwarranted exposure of their private lives, but it must equally protect citizens against the concealment of matters legitimately belonging in the public domain.

Privacy must protect people, not insulate power; and data protection must not become a gag on the press or a barrier to the citizen's right to know.

1. Digital News Publishers Association & Anr. v. Union of India, Diary No. 45589/2026, Supreme Court of India, proceedings dated 27 October 2026. ↑

2. Personal Data Protection Bill, 2018, Section 47; Personal Data Protection Bill, 2019, Clause 36(e); Report of the Joint Parliamentary Committee on the Personal Data Protection Bill, 2019. ↑

3. DPDP Act commencement notification, G.S.R. 843(E), dated 13 November 2025; DPDP Rules, 2025, G.S.R. 846(E), dated 13 November 2025. ↑

4. K.S. Puttaswamy v. Union of India, (2017) 10 SCC 1 ↑

5. Bennett Coleman & Co. v. Union of India, (1972) 2 SCC 788. ↑

6. Modern Dental College and Research Centre v. State of Madhya Pradesh, (2016) 7 SCC 353. ↑

7. State of U.P. v. Raj Narain, (1975) 4 SCC 428; CPIO, Supreme Court of India v. Subhash Chandra Agarwal, (2020) 5 SCC 481; Association for Democratic Reforms v. Union of India, 2024 INSC 113. ↑

8. Data Protection Act, 2018 (United Kingdom), Schedule 2, Part 5, paragraph 26. ↑

   Author is an Advocate practicing at Supreme Court of India & Delhi High Court. Views are personal.