News Publishers Move SC To Challenge The DPDP Act

A coalition of 21 prominent news publishers has filed a lawsuit against India's Digital Personal Data Protection (DPDP) Act in the Supreme Court, arguing that the legislation could impede investigative journalism and expose journalists' sources. The legal action, filed on October 6, asserts that the DPDP Act's provisions on consent, data deletion, and government access to information could hinder news reporting and compel publishers to remove factual stories.

The case is set to be heard on October 27, as per a Reuters report. This challenge follows nearly a year since the Centre announced the Digital Personal Data Protection Rules, 2025 in November of the previous year. The overarching DPDP Act, 2023, and the accompanying Rules create a framework for how entities collect, process, and safeguard individuals' digital personal data.

The Digital News Publishers Association (DNPA), representing the publishers, contends that the law lacks a specific exemption for journalistic activities. According to the confidential filing, the association claims that the lack of such safeguards could compromise press freedom and investigative reporting. The members of the DNPA include Network18, NDTV, the Indian Express, and Times Internet, a subsidiary of the Times of India group.

One major concern raised by the publishers is the necessity to secure consent prior to handling personal data. The DNPA argues that necessitating journalists to inform subjects of investigations and obtain their consent could enable them to erase evidence or intimidate witnesses. The association has also pointed out clauses allowing individuals to revoke consent and request the deletion of their personal data.

The absence of a public-interest safeguard, according to the filing, could force publishers to remove or extensively edit factual news reports. The publishers have also expressed worries about provisions empowering the government to request information from organizations handling personal data, which they believe could expose confidential journalistic sources and discourage whistleblowers from disclosing details about corruption, corporate misconduct, and electoral malpractice.

The filing also challenges the government's authority to limit access to information in the public interest, contending that the provisions could curtail press freedom. The DNPA has requested the dismissal of several contentious provisions of the law, most of which are set to take effect from May 2027, as reported by Reuters. The association has also argued that the government has extended broad exemptions to the state without providing comparable protections to the press.

This marks one of the most significant challenges to the DPDP framework thus far, prompting inquiries about how India's data protection obligations will intersect with press freedom and investigative reporting. The DPDP Act, enacted in August 2023, establishes obligations for processing digital personal data. The subsequent DPDP Rules, issued in November 2025, outline a phased implementation plan, granting organizations up to 18 months to comply with specified requirements.

The framework mandates platforms to obtain consent for processing personal data, furnish clear information about its use, and implement security measures. It also grants individuals rights to access, rectify, update, and request the deletion of their personal data, subject to applicable provisions. This latest case represents one of the more notable challenges to the DPDP framework, prompting questions about how India's data protection requirements will interact with press freedom and investigative reporting.

The Act provides for monetary penalties of up to ₹250 Cr for failing to establish reasonable security safeguards. Other infractions, including certain breaches related to children's personal data, can attract penalties of up to ₹200 Cr. However, the publishers contend that the framework does not sufficiently address the needs of investigative journalism, particularly when reporting involves personal information gathered in the public interest.

The government maintains that the framework safeguards citizens' privacy while promoting responsible data handling.