Why In News?

The Supreme Court issued a formal notice to the Ministry of Electronics and Information Technology (MeitY) on a writ petition filed by the Digital News Publishers Association (DNPA) challenging the constitutional validity of the Digital Personal Data Protection Act, 2023 (DPDP Act, 2023) and the Digital Personal Data Protection Rules, 2025 (DPDP Rules, 2025).

What Is The DPDP Act, 2023?

The DPDP Act, 2023 is India's national privacy framework enacted in August 2023 to regulate the collection, storage, and processing of digital personal data while safeguarding individual privacy rights.

Key Statutory Provisions & Framework 

  • Notice and Consent Mandate: The Act requires data fiduciaries (entities processing data) to establish a lawful basis— through clear notice and prior consent from "data principals" (individuals)—before processing their digital personal data.

  • Data Erasure & Withdrawal Rights: Individuals possess statutory rights to withdraw consent at any time and demand the erasure or deletion of their personal data.

  • Regulatory Oversight: Sections 18, 19, and 27 establish the Data Protection Board of India (DPBI) as an adjudicatory body empowered to investigate data breaches, determine statutory violations, and levy financial penalties.

  • Executive Requisition and Blocking Powers: Section 36 (read with Rule 23 of the DPDP Rules, 2025) grants the Central Government broad authority to order data handling organizations to furnish requested information.

    • Section 37(1) empowers the government to block or restrict public access to information in the interest of the general public.

    Free Mentorship Need Guidance for UPSC / WBCS / State PSC?
    100% Free & Confidential • Quick Callback

  • Amendment to the RTI Act, 2005: Section 44(3) of the DPDP Act amends Section 8(1)(j) of the Right to Information Act, 2005, removing the statutory provision that previously allowed Public Information Officers to disclose personal information if justified by a larger public interest.

  • Omission of Journalistic Exemptions: Unlike earlier legislative versions—such as Section 47 of the Personal Data Protection Bill, 2018, as well as the 2019 and 2021 draft bills—and international laws like Article 85 of the EU GDPR, the enacted DPDP Act contains no explicit statutory carve-outs or exemptions for news reporting, investigative journalism, or source protection.  

What Is The DPDP Rules 2025?

The Digital Personal Data Protection Rules, 2025 were notified by the Ministry of Electronics and Information Technology in November 2025, to operationalize the Digital Personal Data Protection Act, 2023. 

  • Itemized Notices: Data Fiduciaries must provide clear, simple, plain-language notices detailing the specific purpose of data collection before processing data. 

  • Data Retention & Logs: Personal data must be erased once its purpose is fulfilled; processing logs and traffic data must be retained for a minimum of 1 year. Specialized platforms (e.g., e-commerce, gaming, social media with 2+ crore/50+ lakh users) have a 3-year data retention rule under Schedule III. 

  • Data Breach Reporting: Breaches must go through a strict response plan requiring notification to the Data Protection Board and affected individuals within 72 hours.  

  • Children's Data Protection: Processing personal data of minors (under 18) requires verifiable parental or guardian consent. Behavioral monitoring, profiling, and targeted advertising directed at children are strictly prohibited.  

  • Data Principal Rights: Citizens can access, correct, or erase their data, withdraw consent (followed by a 48-hour notice prior to deletion), and seek grievance redressal within 90 days. 

  • Financial Penalties for Non-Compliance

  • Up to ₹250 crore: For failing to implement reasonable security safeguards to prevent data breaches.

  • Up to ₹200 crore: For failing to notify the Board or affected individuals of a data breach, or violating children's data provisions.

  • Up to ₹150 crore: For non-compliance with Significant Data Fiduciary (SDF) obligations (such as mandatory Data Protection Impact Assessments and audits).

  • Up to ₹50 crore: For any other general violations of the Act or Rules.

Why Is It Being Challenged In The Supreme Court?

The Digital News Publishers Association (DNPA)—representing 21 major digital wings of legacy media outlets (including The Indian Express, The Hindu) alongside independent journalists—filed a writ petition in the Supreme Court challenging key provisions of the Act and the DPDP Rules, 2025. 

  • The petitioners contend that the law poses severe risks to press freedom, investigative journalism, and democratic accountability for the following core reasons:

Violation of Fundamental Rights: Compelling journalists to secure prior consent from individuals under investigation infringes upon Article 19(1)(a) (Freedom of Speech and Expression) and Article 19(1)(g) (Freedom of Trade and Profession), conflicting with the constitutional balance affirmed in K S Puttaswamy vs Union of India (2017).

Arbitrary Classification Under Article 14: Section 17(2) of the DPDP Act, 2023 grants statutory processing exemptions for academic research, archiving, and statistical analysis, yet arbitrarily excludes public-interest journalism, violating the principle of equal protection under Article 14.

Imposition of Systemic Pre-Censorship: Requiring newsrooms to notify investigation targets prior to data processing enables subjects to destroy evidence, intimidate whistleblowers, or seek preemptive gag orders, creating a regime of pre-censorship.

Blanket Dilution of the RTI Act, 2005: Section 44(3) of the DPDP Act, 2023 amends clause (j) of Section 8(1) of the Right to Information Act, 2005, removing the statutory proviso that allowed Public Information Officers to disclose personal information if justified by a larger public interest. 

  • This blanket bar contradicts the ruling in Association for Democratic Reforms v. Union of India (2024), which held that the public right to know cannot be subordinated to unchecked privacy claims.

What Are The Challenges In Balancing Privacy With Freedom Of The Press?

Absence of Statutory Balancing Mechanisms: The law treats public-interest news reporting under the same compliance standards as commercial data processing, lacking a statutory mechanism to balance individual privacy under Article 21 against the public right to know under Article 19(1)(a).

Systemic Closure of Administrative Transparency: Amending the RTI Act, 2005 creates an absolute exemption for personal data, preventing citizens and journalists from uncovering administrative irregularities or public fund misuse.

Effect on Whistleblower Ecosystems: Broad surveillance powers and the lack of reporter-source privilege deter informants from sharing evidence regarding financial fraud, corporate corruption, or maladministered schemes.

  • Example: Reporters Without Borders World Press Freedom Index (2026), survey data documenting India's rank at 157th among 180 countries due to regulatory ambiguity, threats to source confidentiality, and pre-publication legal notices against investigative journalists.

Way Forward

Statutory Notification Under Section 17(5): The Central Government must exercise its powers under Section 17(5) of the DPDP Act, 2023 to notify news publishers and accredited journalists as an exempted class of data fiduciaries for public-interest reporting.

  • Example: European Union General Data Protection Regulation (EU GDPR Article 85 Model), statutory mandate requiring member states to reconcile personal data protection with freedom of expression through explicit legislative exemptions for journalistic, academic, artistic, and literary processing.

Reconstitution of the Data Protection Board with Judicial Safeguards: Amend Sections 18 and 19 of the DPDP Act, 2023 to ensure the DPBI operates under judicial leadership recommended by the Chief Justice of India, while mandating prior judicial authorization before issuing data requisition orders under Section 36.

  • Example: United Kingdom Data Protection Act (UK DPA 2018 Special Purposes Framework), statutory operational mechanism incorporating public-interest balancing tests, pre-condition judicial determination for source disclosures, and independent information commissioner oversight.

Restoration of Public Interest Exceptions Under RTI: Re-amend Section 8(1)(j) of the RTI Act, 2005 to reinstate the public interest balancing test, ensuring that information affecting public accountability remains accessible.

  • Example: Association for Democratic Reforms Judicial Precedent Model (2024), operational constitutional standard established by the Supreme Court holding that fundamental rights to information and public scrutiny cannot be subordinated to blanket claims of privacy in governance matters.

Conclusion

Constitutional democracy requires an equilibrium where individual privacy under Article 21 and press freedom under Article 19(1)(a) reinforce one another. Notifying journalistic exemptions under Section 17(5) and establishing judicial safeguards within the DPDP Act, 2023 are essential to preserve investigative journalism and public accountability.

Source: INDIANEXPRESS

PRACTICE QUESTION

Q. Consider the following constitutional rights and legal precedents regarding Press Freedom in India:

  1. Freedom of the Press is explicitly mentioned under Article 19(1)(a) of the Constitution of India.

  2. In K.S. Puttaswamy vs Union of India, the Supreme Court held that Right to Privacy is a fundamental right under Article 21, subject to reasonable restrictions of legality, necessity, and proportionality.

  3. In Association for Democratic Reforms v. Union of India (2024), the Supreme Court ruled that the public's fundamental right to know cannot be completely subordinated to privacy.

Which of the statements given above are correct?

(a) 1 and 2 only

(b) 2 and 3 only

(c) 1 and 3 only

(d) 1, 2, and 3

Answer: (b)

Explanation:

Statement 1 is incorrect: Freedom of the press is not explicitly mentioned in the Constitution of India. Instead, judicial interpretations—most notably in Romesh Thappar v. State of Madras (1950) and Indian Express Newspapers v. Union of India (1985)—have firmly established that press freedom is implicitly covered under the broader Right to Freedom of Speech and Expression guaranteed by Article 19(1)(a).

Statement 2 is correct: In the landmark judgment K.S. Puttaswamy v. Union of India (2017), a nine-judge Constitution Bench held that the Right to Privacy is a fundamental right intrinsic to life and personal liberty under Article 21. The Court ruled that any restriction on this right must pass the three-fold test of:

  • Legality (backed by an existing law),

  • Necessity / Legitimate state aim, and

  • Proportionality (ensuring the least restrictive measure is adopted).

Statement 3 is correct: In Association for Democratic Reforms (ADR) v. Union of India (2024) (the Electoral Bonds case), a five-judge Constitution Bench struck down the Electoral Bond Scheme, holding that the voters' fundamental right to know under Article 19(1)(a) cannot be completely subordinated to political donors' right to informational privacy under Article 21, and that blanket anonymity failed the proportionality test.