SC notice to government on DPDP Act challenge shines spotlight on privacy, press freedom

The DPDP Act was formally operationalised with the notification of its rules in the beginning of 2026

• Supreme Court issues notice on DPDP Act challenge petition
• Petition claims DPDP Act undermines privacy and press freedom
• Concerns raised over government exemptions and weak oversight

Did our AI summary help?

The Supreme Court recently asked the Centre to respond by March 23 to a plea challenging several provisions of the Digital Personal Data Protection (DPDP) Act, 2023, reopening debate over the architecture of India’s newly minted data-protection regime.

At the heart of the challenge are the claims that some provisions of the act and Digital Personal Data Protection Rules, 2025, violate the top court’s Right to Privacy judgment. The please also flags concerns about the absence of explicit protections for journalistic work apart from other issues.

What happened?

The plea, a copy of which Moneycontrol has reviewed, argues that the framework undermines privacy protections and could adversely affect press freedom and accountability.

The data protection framework departs from the principles laid down by the Supreme Court in its ruling which recognised privacy as a fundamental right.

"The petitioners are aggrieved by the enactment of the Digital Personal Data Protection Act, 2023, which substantially weakens the protections available to individuals in relation to their personal data and creates an architecture that is prone to misuse," the petition said.

Who filed the petition?

The petition has been filed by journalist Geeta Seshu along with the Software Freedom Law Center, India (SFLC.in).

What does the petition say?

The petition has flagged concerns about the structure of the law and its implementation framework.

• Broad exemptions for the government: The plea argues that the law allows the government wide powers to exempt state agencies from its provisions.

"Section 17 of the DPDP Act empowers the Central Government to exempt any instrumentality of the State from the application of the Act in the interests of sovereignty and integrity of India, security of the State, friendly relations with foreign States, maintenance of public order, or preventing incitement to any cognizable offence," the petition says. Such exemptions lack adequate safeguards, it says.

• Weak oversight and independence concerns: The plea also questions the structure of the Data Protection Board. "The Act establishes a Data Protection Board of India whose composition, appointment, and service conditions are entirely controlled by the Central Government," the petition says.

'The law affects press freedom'

The petition has argued that the absence of a clear exemption for journalistic activities could place journalists under compliance obligations of the DPDP Act, especially when handling personal data during investigations or reporting.

"Journalists and media organisations routinely process personal data while reporting on matters of public interest," it says. It adds that the law could create barriers to such reporting. "In the absence of a clear exemption for journalistic purposes, journalists may be treated as 'data fiduciaries' and be required to comply with onerous obligations under the Act."

What happens next?

The government has to send in its response by March 23. The case is expected to lead to judicial scrutiny of several provisions of the DPDP Act, particularly those relating to government exemptions, regulatory oversight and protections for journalists.