Supreme Court seeks Centre's reply to news publishers' challenge to DPDP Act

The Supreme Court on Tuesday, October 27, 2026, asked the Union government to respond to a petition by the Digital News Publishers Association (DNPA) that challenges India's main data protection law, the Digital Personal Data Protection Act, 2023, and the rules made under it. A bench of Chief Justice of India Surya Kant and Justices Joymalya Bagchi and V Mohana issued notice to the Centre after hearing senior advocate Madhavi Divan for the publishers, and listed the case for November 17 along with other pending petitions on the law. The court did not pass any interim order. The publishers argue that the law has no exemption for journalism and that this threatens news reporting and the protection of confidential sources.

The DPDP Act sets the rules for how any organisation, from a large platform to a small start-up, collects and uses people's personal data, and it builds that system around consent. The publishers' case is that this framework, applied to newsrooms, would require journalists to seek consent from the very people they report on, with no carve-out for public-interest reporting. Their counsel argued that such a consent requirement could work as pre-censorship and hinder investigative reporting.

According to the petition, earlier drafts of India's data protection law, in 2018, 2019 and 2021, included an exemption for journalism, but it was dropped from the 2022 draft and did not appear in the law Parliament passed. The bench, for its part, said a balance has to be struck between the rights of citizens and the rights of the media, and asked the petitioners to suggest safeguards that could stop a journalism exemption from being misused. That signals the court may look for a middle path rather than simply striking down or upholding the provisions.

The case also matters for the timeline of compliance. The DPDP Rules were notified on November 14, 2025, and set up a fully digital Data Protection Board with four members, where citizens can file and track complaints online. Appeals against the Board go to the Telecom Disputes Settlement and Appellate Tribunal. The core operating obligations of the Act take full effect in May 2027; until then, the older IT Act framework continues to apply. Businesses are using this window to rebuild consent and data-handling systems, so any change the court makes could alter what they need to do.

Short-term: The government will now file its response before the November 17 hearing. The law and rules remain in force as notified, and the compliance timetable is unchanged for now.

Long-term: The outcome could decide whether India's data law carves out space for journalism, and how narrowly. A ruling that adds an exemption with safeguards would shape not only newsrooms but also research, archives and other activities that depend on handling personal information.

Who is affected: Digital news publishers and independent journalists, the Data Protection Board, the Ministry of Electronics and Information Technology, RTI users seeking information about public officials, and the many start-ups and companies preparing to comply with the DPDP Act before May 2027.

Questions and Answers