The Supreme Court on Tuesday issued notices to the Union Ministry of Law and Justice, and the Ministry Electronics and Information Technology (MeitY) on a petition filed by Digital News Publishers Association (DNPA), challenging the Digital Personal Data Protection (DPDP) Act, 2023 and the DPDP Rules, 2025.Here is why DNPA, representing 21 prominent news organisations, have challenged the validity of the DPDP Act, 2023 and the DPDP Rules, 2025.Right to Privacy in IndiaIn a landmark verdict in the Justice (Retd.) KS Puttaswamy case, the Supreme Court on August 24, 2017 declared right to privacy a fundamental right under the Constitution.“The right to privacy is protected as an intrinsic part of the right to life and personal liberty under Article 21 and as a part of the freedoms guaranteed by Part III (which deals with Fundamental Rights) of the Constitution,” a nine-judge Constitution Bench headed by the then CJI JS Khehar had ruled in a unanimous verdict.However, the bench had clarified that like other fundamental rights, the right to privacy was not absolute and any encroachment will have to withstand the touchstone of permissible restrictions. A law to survive a challenge on the ground of violation of Article 21 must be fair, just and reasonable, it had noted.Justice BN Srikrishna Committee ReportIn its right to privacy verdict, the Supreme Court supported collection of citizens’ data for national security and welfare schemes saying, “Digital platforms are a vital tool of ensuring good governance in a social welfare state… Apart from national security, the state may have justifiable reasons for the collection and storage of data.”During the hearing, the Centre had told the top court that it had set up a panel of experts under former top court judge BN Srikrishna to suggest a draft law on data protection. The panel submitted its report in July 2018.DPDP Act, 2023Passed by Parliament in August 2023, the DPDP Act is the first comprehensive law on digital personal data protection in India. It requires any entity processing personal data, termed “data fiduciary”, to do so either with the consent of the individual concerned or for a limited set of “legitimate uses” listed in Section 7 of the Act, which provides for legitimate uses of data.Section 7 lists out legitimate uses for which a data fiduciary may process personal data of an individual for the specified purpose for which the data principal has voluntarily provided her personal data to the data fiduciary, and in respect of which she has not indicated to the data fiduciary that she does not consent to the use of her personal data.” A breach can attract penalties of up to Rs 250 crore.MeitY notified the accompanying DPDP Rules, 2025 on November 13, 2025, with implementation staggered over 18 months.DPDP Rules, 2025The Rules lay down how consent, notices and breach reporting are to work in practice. Among the most controversial is Rule 23, framed under Section 36 of the Act, which allows the Centre, acting through an authorised person, to require any data fiduciary or intermediary to furnish information and also bar them from disclosing that such a request was made.Why have news publishers challenged DPDP Act & DPDP RulesThe Digital News Publishers Association has questioned Section 44(3) of the DPDP Act. The news organisations are primarily aggrieved by the absence of any exception for news reporting either among the legitimate uses in Section 7 or the exemptions in Section 17 wherein personal data protection does not apply and they include legal claims where personal data is processed to enforce a legal right or claim.It also includes judicial and regulatory functions where courts, tribunals or legally authorised bodies process personal data as necessary to perform their judicial, quasi-judicial, regulatory or supervisory functions. The 2018, 2019 and 2021 versions of the personal data protection law had included such an exemption.The petitioner association contended that the absence of exception for media outlets meant a reporter writing about a person would first need that person’s consent.Amendment to Section 8(1)(j) of RTI ActThe PILs have challenged the amendment to Section 8(1)(j) of the RTI Act by which the public interest clause for disclosure of personal information was removed.Section 8(1)(j) of the RTI Act, 2005 exempts personal information from disclosure, if it has no relation to any public activity or interest, or if releasing it would lead to an unwarranted invasion of an individual’s privacy. However, authorities may disclose such information despite the exemption, if a larger public interest justifies it.The amendment has altered the earlier provision by removing safeguards that balanced privacy concerns with the public’s right to know as the amended clause now simply exempts “information which relates to personal information”, the petitioners alleged.Supreme Court’s initial observationsWhile refusing to stay the impugned provisions of the DPDP Act, 2023 and the DPDP Rules, 2025, the Supreme Court on Tuesday emphasised the need to strike a balance between right to privacy concerns and journalistic freedom.“The question is whether there can be a blanket prohibition on disclosure of all digital personal information, or whether the legislation has to adopt a proportionate approach… The Right to Information Act operates on a much larger domain. It covers all forms of information, not merely digital information. The Digital Personal Data Protection Act operates in a much narrower sliver, although today that narrow sliver constitutes the overwhelming part of information.“The State appears to have adopted a more cautionary approach. The question is whether that cautionary approach, and the classification it creates, has a reasonable and intelligible differentia having regard to the object of the law,” it had noted in August.