Watch the video explainer · open on YouTube
VIDEO EXPLAINER | 3 NOVEMBER 2026
On 27 October 2026 the Supreme Court of India issued notice to the Union Government on a petition by the Digital News Publishers Association challenging the Digital Personal Data Protection Act, 2023 (the DPDP Act) and the DPDP Rules, 2025. The bench of Chief Justice Surya Kant, Justice Joymalya Bagchi and Justice V. Mohana did not grant any interim stay. Chief Justice Surya Kant said that no ex parte order would be passed without hearing the other side. The case sets two fundamental-right ideas against each other: freedom of the press and the right to privacy.
What the publishers say
The Association filed its petition on 6 October 2026. Its main argument is that the DPDP Act contains no exemption for journalism. As a result, the Act’s duties of taking consent from, and erasing data about, news sources and the subjects of stories operate, in the petitioners’ words, like pre-censorship. In other words, a reporter might need permission before publishing, which is the opposite of how a free press works.
The petition also attacks two powers. The first is the power of the Data Protection Board to impose fines. The second is the Centre’s power to call for information, which, the petitioners say, can reach privileged communications such as a journalist’s contact with a source. These are the petitioners’ claims and prayers; the Court has not decided any of them.
Where the case stands
Two facts keep the picture balanced. First, the Court issued notice but gave no interim relief, so the Act and Rules remain in force as they were. Second, the machinery is not fully built: as of August 2026 the Chairperson and Members of the Data Protection Board had not been appointed, and the Act’s main duties are due to apply from around May 2027.
This is not the first challenge. On 16 February 2026 the Court had already issued notice on petitions by the Reporters Collective Trust, NCPRI and Venkatesh Nayak. Notice does not mean the law is struck down or even suspended; it only asks the Union to respond.
Constitutional and legal framework
- Article 19(1)(a): freedom of speech and expression, which includes the press.
- Article 19(2): grounds for reasonable restrictions on that freedom.
- Article 21: right to life and personal liberty, within which privacy sits.
- K. S. Puttaswamy v. Union of India (2017): nine-judge bench; privacy is a fundamental right.
- DPDP Act, 2023 (enacted 11 August 2023) and DPDP Rules, 2025: the laws under challenge.
- Data Protection Board: independent body corporate that imposes penalties; appeals go to TDSAT.
Two rights in tension: Article 19 and Article 21
Article 19(1)(a) gives every citizen the freedom of speech and expression, and Article 19(2) allows the State to impose reasonable restrictions on it. Privacy, on the other hand, sits within Article 21. In Puttaswamy (2017) a nine-judge bench held privacy to be a fundamental right. The DPDP challenge asks how far a data-protection duty that protects privacy can go before it becomes an unreasonable restriction on the press.
Static facts about the DPDP Act
The Act was enacted on 11 August 2023. It provides only monetary penalties, not imprisonment. The ceiling of Rs 250 crore applies to failure to maintain reasonable security safeguards, while failure to notify a data breach, or breach of the duties relating to children’s data, carries a ceiling of Rs 200 crore. An appeal against an order of the Data Protection Board lies to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) within 60 days. The Board itself is not a tribunal; it is an independent body corporate.
The CLAT angle
- Legal Reasoning: a passage may ask whether a data-protection duty without a journalism exemption is a reasonable restriction under Article 19(2).
- Keep apart what the petitioners allege and what the Court decided; a notice without a stay decides nothing.
- GK: penalty ceilings (Rs 250 crore versus Rs 200 crore), the 60-day appeal and TDSAT are classic fact questions.
- Know that the Board is not a tribunal, so the appeal goes outside it.
- Remember Puttaswamy (2017, nine judges) as the source of privacy as a fundamental right.
Key facts
| Fact | Detail |
|---|---|
| Petitioner | Digital News Publishers Association |
| Petition filed | 6 October 2026 |
| Notice issued | 27 October 2026; no interim stay |
| Bench | CJI Surya Kant, Justice Joymalya Bagchi, Justice V. Mohana |
| Laws challenged | DPDP Act, 2023 and DPDP Rules, 2025 |
| Act enacted | 11 August 2023 |
| Security-safeguard failure | Penalty ceiling Rs 250 crore |
| Breach notification / children’s data failure | Penalty ceiling Rs 200 crore |
| Appeal | To TDSAT within 60 days |
| Earlier notice | 16 February 2026 |
Memory hook
“Notice is not a Nay.” On 27 October the Court only asked the Centre to reply; no stay, no verdict. And for money: 250 for Security, 200 for Breach and Children.
Frequently asked questions
Did the Supreme Court stay the DPDP Act?
No. On 27 October 2026 the Court issued notice to the Centre on the Digital News Publishers Association petition but granted no interim stay.
Does the DPDP Act have a journalism exemption?
The petitioners say it has none, which is the core of their challenge; the Court has not ruled on this.
What is the maximum penalty under the DPDP Act?
Rs 250 crore for failure to maintain security safeguards; Rs 200 crore for failure to notify a breach or breach of children’s data duties. Penalties are monetary only.
Sources
Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025; reports of the Supreme Court hearing of 27 October 2026; the petition by the Digital News Publishers Association; the Supreme Court’s notice of 16 February 2026 on earlier petitions.
Free in the CLAT Gurukul app
These notes (as a PDF lesson) and the 10-question CBT are in the app under Current Affairs → 3 Nov 2026. Get the app on Google Play or open app.clatgurukul.com.
Practice Quiz — 10 CLAT-Style Questions
Click an option to reveal the answer and explanation.
