Explainer: Why News Publishers Challenged Data Protection Law In Supreme Court

The Supreme Court on Tuesday sought the Centre's response on a petition filed by the Digital News Publishers Association (DNPA) challenging the Digital Personal Data Protection (DPDP) Act, 2023 and the DPDP Rules, 2025.

The association, which represents 21 prominent news organisations, has said that the law, which carries no exemption for journalism, could cripple news gathering and dilute the citizen's right to information.

What is the DPDP Act?

The law, passed by Parliament in August 2023, is the first comprehensive legislation on the protection of digital personal data. It requires any entity processing personal data, termed a "Data Fiduciary", to do so either with the consent of the individual concerned or for a limited set of "legitimate uses" listed in Section 7 of the DPDP Act, which provides for the legitimate uses of data.

It says a Data Fiduciary may process personal data of a Data Principal for any of the following uses, namely: "(a) for the specified purpose for which the Data Principal has voluntarily provided her personal data to the Data Fiduciary, and in respect of which she has not indicated to the Data Fiduciary that she does not consent to the use of her personal data."

Breaches can attract penalties of up to Rs 250 crore.

The Ministry of Electronics and Information Technology (MeitY) notified the accompanying Rules on November 13, 2025, with implementation to be staggered over 18 months.

Why do publishers say it hurts journalism?

At the heart of the challenge is the absence of any carve-out for news reporting, which finds no place either among the legitimate uses in Section 7 or the exemptions in Section 17.

Section 17 lists out instances where personal data protection does not apply and they include legal claims where personal data is processed to enforce a legal right or claim.

It also includes judicial and regulatory functions where courts, tribunals or legally authorised bodies process personal data as necessary to perform their judicial, quasi-judicial, regulatory or supervisory functions.

Earlier versions of the law, in 2018, 2019 and 2021, had carried such an exemption.

According to the publishers, this means a reporter writing about a person may first need that person's consent.

What do the Rules add?

The Rules lay down how consent, notices and breach reporting are to work in practice.

Among the most contested is Rule 23, framed under Section 36 of the Act, which allows the Centre, acting through an authorised person, to require any Data Fiduciary or intermediary to furnish information and also bar them from disclosing that such a request was made.

What is the RTI angle?

The petition also targets Section 44(3) of the DPDP Act, which rewrote Section 8(1)(j) of the Right to Information Act.

Earlier, personal information could be withheld only if it bore no relation to public activity or would cause an unwarranted invasion of privacy, and could still be released where a larger public interest justified it.

The amended clause now simply exempts "information which relates to personal information".

(Except for the headline, this story has not been edited by NDTV staff and is published from a syndicated feed.)