DNPA’s Challenge to the DPDP Act: Press Freedom, Statutory Exemptions, and the Constitutional Limits of Data Protection

Supreme Court Notice to the Union: A Critical Juncture for Data Protection and Media Freedom

The Supreme Court’s issuance of notice on 27 October 2026 in the petition filed by the Digital News Publishers Association (DNPA) marks the first significant constitutional challenge to the Digital Personal Data Protection Act, 2023 (DPDP Act) and the accompanying Rules of 2025. By declining to grant an interim stay and listing the matter for 17 November 2026, the Court has signalled that it will examine the Union’s defence before deciding whether the statutory regime requires immediate judicial intervention. For practitioners, this is not merely a procedural skirmish; it is the opening round in what may become a definitive ruling on the balance between privacy as a fundamental right and the freedom of the press under Article 19(1)(a).

The DNPA’s Core Grievance: Investigative Journalism and the Absence of a Public Interest Exemption

At the heart of the DNPA’s challenge lies the argument that the DPDP Act, as currently drafted, fails to carve out a robust exemption for journalistic activity conducted in the public interest. Section 17(1) of the Act enumerates specific exemptions—such as processing for the purposes of legal proceedings, research, and statistical purposes—but does not expressly include investigative journalism or news gathering. The petition contends that this omission will have a chilling effect on the media’s ability to collect, process, and publish personal data in the course of exposés, particularly where the subject of the investigation is a public figure or a corporate entity. The DNPA’s concern is not abstract: newsrooms rely heavily on the processing of personal data—sources, documents, digital trails—to substantiate stories of public importance. If every act of data processing by a journalist requires compliance with the full panoply of obligations under the Act—notice, consent, data minimisation, purpose limitation—the practical effect may be to render investigative reporting legally hazardous.

Constitutional Framework: Puttaswamy, Article 19(1)(a), and the Doctrine of Proportionality

The legal battle will inevitably be framed by the Supreme Court’s landmark judgment in Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1, which recognised privacy as a fundamental right but also acknowledged that it is not absolute and must be balanced against other competing rights and interests. The DNPA will argue that the DPDP Act, by failing to provide a clear journalistic exemption, disproportionately restricts the freedom of the press under Article 19(1)(a) and does not satisfy the four-pronged proportionality test laid down in Puttaswamy and later refined in Modern Dental College v. State of Madhya Pradesh, (2016) 7 SCC 353. The Union, on the other hand, will likely rely on the doctrine of reasonable restrictions under Article 19(2) and argue that the Act’s provisions are necessary to protect the privacy and autonomy of data principals, and that the press can operate within the framework by relying on the exemptions that do exist—such as processing for the purposes of legal proceedings or for the performance of a task carried out in the public interest by the State.

The DNPA’s challenge is not merely about statutory interpretation; it is about whether the DPDP Act, in its current form, creates an impermissible hierarchy of rights in which privacy trumps press freedom in all circumstances, even when the public interest demands disclosure.

Comparative Perspective: The GDPR’s Journalistic Exemption and India’s Divergence

Practitioners should note that the General Data Protection Regulation (GDPR) of the European Union expressly addresses this tension. Article 85 of the GDPR requires Member States to reconcile the right to data protection with the right to freedom of expression and information, including processing for journalistic purposes. Several Member States have enacted broad exemptions for journalism, recognising that the public interest in a free press often necessitates the processing of personal data without the consent of the data subject. India’s DPDP Act, by contrast, does not contain an equivalent provision. This legislative choice—or oversight—now lies at the heart of the DNPA’s petition. If the Supreme Court were to read down the Act or direct the Union to introduce a journalistic exemption, it would align India’s data protection regime more closely with international best practice. Conversely, if the Court upholds the Act as is, news organisations will need to develop robust compliance frameworks to mitigate legal risk.

Practical Implications for Legal Practitioners and Newsrooms

Pending the Supreme Court’s decision, legal advisors to media houses should adopt a cautious approach. First, newsrooms should conduct a data audit to map the categories of personal data they process and the purposes for which it is processed. Second, they should review their privacy notices and consent mechanisms to ensure that, where consent is required, it is obtained in a manner that is informed, specific, and unambiguous. Third, they should consider whether their activities can be brought within the existing exemptions under Section 17(1), particularly the exemption for processing necessary for the establishment, exercise, or defence of legal claims. Finally, they should monitor the proceedings closely, as the Court’s interim observations may provide guidance on the scope of permissible data processing by the press. The Union’s reported openness to suggestions from the media, as articulated by IT Minister Ashwini Vaishnaw, suggests that a legislative or regulatory amendment may be on the table, but practitioners should not assume that relief will be forthcoming before the Act’s substantive provisions come into force on 13 May 2027.

Conclusion: A Defining Moment for India’s Data Protection Jurisprudence

The DNPA’s petition is the first major test of the DPDP Act’s constitutional validity, and its outcome will have far-reaching implications for the media, for data fiduciaries, and for the broader architecture of privacy law in India. The Supreme Court has an opportunity to clarify the contours of the right to privacy in the context of press freedom and to ensure that the DPDP Act does not inadvertently stifle investigative journalism. For now, the legal community awaits the Union’s response and the Court’s next hearing on 17 November 2026 with considerable interest.