BW Legal World: New Delhi: Friday, 20 March 2026.
The petition argues that the DPDP framework does not provide adequate exemptions for journalistic activity, potentially undermining investigative reporting and press freedom. Because journalists collect and process personal data as part of their work, the law may classify them as “data fiduciaries,” requiring them to obtain consent from individuals before processing information.
The Supreme Court of India issued notice in a Public Interest Litigation challenging key provisions of the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025, raising significant constitutional concerns relating to privacy, surveillance, press freedom, and the independence of India’s data protection regulator. The petition has been filed by senior journalist Geeta Seshu and the Software Freedom Law Center, India (SFLC.in) under Article 32 of the Constitution of India, seeking judicial review of provisions of the DPDP framework that allegedly violate fundamental rights under Articles 14, 19 and 21 of the Constitution.
The matter came up for hearing before the Hon’ble Supreme Court on March 12th, 2026, where the Bench headed by the Chief Justice of India issued notice to the Respondents, calling for their response to the constitutional challenge.
During the hearing, the Court acknowledged that the petition raises issues concerning the implications of the data protection regime on constitutional rights and agreed to examine the matter further.
Background of the Petition
The petition challenges specific provisions of the DPDP Act and the DPDP Rules on the ground that, rather than strengthening privacy protections following the Hon’ble Supreme Court’s landmark judgment in Justice K.S. Puttaswamy v. Union of India, the current framework weakens several safeguards and creates structural risks to civil liberties.
The petition seeks the striking down or reading down of provisions including Sections 7, 17(2)(a), 24, 36, 44(2)(a), and 44(3) of the DPDP Act, along with certain rules and schedules under the DPDP Rules, 2025.
According to the petition, these provisions:
The Bench observed that the issues raised required consideration and accordingly issued notice to the Union Government.
Key Constitutional Concerns Raised in the Petition
The petition organizes its challenge around five core constitutional concerns.
1. Lack of Journalistic Exemptions
The petition argues that the DPDP framework does not provide adequate exemptions for journalistic activity, potentially undermining investigative reporting and press freedom. Because journalists collect and process personal data as part of their work, the law may classify them as “data fiduciaries,” requiring them to obtain consent from individuals before processing information. The petition also challenges the amendment to RTI Act which will allow the govt to deny information requests relating to personal information, even if sought in public interest and was previously permissible under the RTI act
According to the petition, such requirements would make it impossible to produce and publish investigative reports involving individuals who may refuse consent. The petition highlights that earlier legislative drafts and international data protection frameworks include specific exemptions for journalistic work.
2. Overbroad Powers for the State
The petition challenges provisions that allow the State to process personal data for certain governmental functions and empower the Central Government to exempt its own agencies from compliance with the law.
The petition argues that these provisions effectively allow the State to process personal data “in a legal vacuum”, without being bound by fundamental data protection principles such as consent, purpose limitation, or storage limitation.
3. Absence of Compensation for Data Breach Victims
The petition also challenges the repeal of Section 43A of the Information Technology Act, 2000, which previously provided individuals the right to seek compensation for wrongful loss caused by negligent handling of personal data.
The DPDP Act replaces this framework with a penalty regime where fines are paid to the government rather than to affected individuals. The petition argues that this creates a“compensation vacuum”, leaving individuals without a meaningful remedy even when their personal data is misused or leaked.
4. Lack of Independence of the Data Protection Board
The petition further raises concerns regarding the structure of the Data Protection Board of India, the adjudicatory body established under the DPDP Act. According to the petition, the Central Government retains extensive control over the Board’s appointments, staffing, and service conditions, despite the fact that government entities themselves may appear before the Board in proceedings.
The petition argues that this arrangement raises serious concerns regarding the independence and impartiality of the regulator.
5. Surveillance Powers Without Safeguards
The petition also challenges provisions that allow the government to require intermediaries and data fiduciaries to furnish information. According to the petition, these provisions create a parallel surveillance mechanism without procedural safeguards comparable to those required under existing interception laws.
The petition argues that these provisions violate the constitutional standards laid down by the Supreme Court in PUCL v. Union of India and fail the proportionality test articulated in Puttaswamy.
About the Petitioners
The petition argues that the DPDP framework does not provide adequate exemptions for journalistic activity, potentially undermining investigative reporting and press freedom. Because journalists collect and process personal data as part of their work, the law may classify them as “data fiduciaries,” requiring them to obtain consent from individuals before processing information.
The Supreme Court of India issued notice in a Public Interest Litigation challenging key provisions of the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025, raising significant constitutional concerns relating to privacy, surveillance, press freedom, and the independence of India’s data protection regulator. The petition has been filed by senior journalist Geeta Seshu and the Software Freedom Law Center, India (SFLC.in) under Article 32 of the Constitution of India, seeking judicial review of provisions of the DPDP framework that allegedly violate fundamental rights under Articles 14, 19 and 21 of the Constitution.
The matter came up for hearing before the Hon’ble Supreme Court on March 12th, 2026, where the Bench headed by the Chief Justice of India issued notice to the Respondents, calling for their response to the constitutional challenge.
During the hearing, the Court acknowledged that the petition raises issues concerning the implications of the data protection regime on constitutional rights and agreed to examine the matter further.
Background of the Petition
The petition challenges specific provisions of the DPDP Act and the DPDP Rules on the ground that, rather than strengthening privacy protections following the Hon’ble Supreme Court’s landmark judgment in Justice K.S. Puttaswamy v. Union of India, the current framework weakens several safeguards and creates structural risks to civil liberties.
The petition seeks the striking down or reading down of provisions including Sections 7, 17(2)(a), 24, 36, 44(2)(a), and 44(3) of the DPDP Act, along with certain rules and schedules under the DPDP Rules, 2025.
According to the petition, these provisions:
- Permit excessive executive control over data governance;
- Create surveillance risks without adequate safeguards;
- Eliminate civil remedies available to individuals affected by data breaches; and
- Undermine journalistic freedom and the right to information.
- Provide extensive Government control over the Data Protection Board’s appointments.
The Bench observed that the issues raised required consideration and accordingly issued notice to the Union Government.
Key Constitutional Concerns Raised in the Petition
The petition organizes its challenge around five core constitutional concerns.
1. Lack of Journalistic Exemptions
The petition argues that the DPDP framework does not provide adequate exemptions for journalistic activity, potentially undermining investigative reporting and press freedom. Because journalists collect and process personal data as part of their work, the law may classify them as “data fiduciaries,” requiring them to obtain consent from individuals before processing information. The petition also challenges the amendment to RTI Act which will allow the govt to deny information requests relating to personal information, even if sought in public interest and was previously permissible under the RTI act
According to the petition, such requirements would make it impossible to produce and publish investigative reports involving individuals who may refuse consent. The petition highlights that earlier legislative drafts and international data protection frameworks include specific exemptions for journalistic work.
2. Overbroad Powers for the State
The petition challenges provisions that allow the State to process personal data for certain governmental functions and empower the Central Government to exempt its own agencies from compliance with the law.
The petition argues that these provisions effectively allow the State to process personal data “in a legal vacuum”, without being bound by fundamental data protection principles such as consent, purpose limitation, or storage limitation.
3. Absence of Compensation for Data Breach Victims
The petition also challenges the repeal of Section 43A of the Information Technology Act, 2000, which previously provided individuals the right to seek compensation for wrongful loss caused by negligent handling of personal data.
The DPDP Act replaces this framework with a penalty regime where fines are paid to the government rather than to affected individuals. The petition argues that this creates a“compensation vacuum”, leaving individuals without a meaningful remedy even when their personal data is misused or leaked.
4. Lack of Independence of the Data Protection Board
The petition further raises concerns regarding the structure of the Data Protection Board of India, the adjudicatory body established under the DPDP Act. According to the petition, the Central Government retains extensive control over the Board’s appointments, staffing, and service conditions, despite the fact that government entities themselves may appear before the Board in proceedings.
The petition argues that this arrangement raises serious concerns regarding the independence and impartiality of the regulator.
5. Surveillance Powers Without Safeguards
The petition also challenges provisions that allow the government to require intermediaries and data fiduciaries to furnish information. According to the petition, these provisions create a parallel surveillance mechanism without procedural safeguards comparable to those required under existing interception laws.
The petition argues that these provisions violate the constitutional standards laid down by the Supreme Court in PUCL v. Union of India and fail the proportionality test articulated in Puttaswamy.
About the Petitioners
- Geeta Seshu is a senior journalist and co-founder of the Free Speech Collective.
- Software Freedom Law Center, India (SFLC.in) is a digital rights organisation engaged in strategic litigation, policy advocacy, and research on technology law and civil liberties












