Janvi Patidar
Digital Personal Data Protection Act is at the centre of a major constitutional challenge before the Supreme Court of India. On February 17, 2026, the Court admitted three PILs questioning the validity of the Act and the Rules framed under it. The petitions argue that the law weakens the Right to Information, harms investigative journalism, and increases state surveillance.
Digital Personal Data Protection Act was enacted to protect citizens’ digital privacy. However, the petitioners claim that instead of strengthening rights, the law creates new barriers to transparency and public accountability. The Court issued notice to the Centre and listed the matter before a Constitution Bench in March, but refused to stay the Act for now.he petitions rely on the landmark privacy ruling in Justice K.S. Puttaswamy v. Union of India, which requires any restriction on fundamental rights to pass the proportionality test.
What Is the Digital Personal Data Protection Act, 2023?
The Digital Personal Data Protection Act, 2023 (DPDP Act) sets out India’s framework for protecting digital personal data. It explains how organisations can collect and process personal data. The law follows a SARAL approach to keep compliance simple and clear.
The Act rests on seven principles:
- Consent and transparency
- Purpose limitation
- Data minimisation
- Accuracy
- Storage limitation
- Security safeguards
- Accountability
The law also creates the Data Protection Board of India to oversee compliance and impose penalties.
Also Read: Supreme Court Reviews Doctors under Consumer Protection Act, 2019
https://vidhigya.com/blog/doctors-under-consumer-protection-act-2019/
Why Has the DPDP Act Been Challenged?
Three PILs challenge the DPDP Act. They come from NCPRI, transparency advocate Venkatesh Nayak, and The Reporters’ Collective Trust. All three raise concerns on three core issues.
1) Privacy vs Transparency (Impact on RTI)
Section 44(3) of the DPDP Act amends Section 8(1)(j) of the RTI Act, 2005.
Earlier, officials could disclose personal information if larger public interest justified it. The amended provision now exempts “information which relates to personal information” from disclosure.
The petitioners argue this change removes the public interest override. They say it turns a limited privacy exemption into a blanket ban. According to them, this shields wrongdoing and weakens transparency. They also claim the change is manifestly arbitrary and fails the proportionality test under the Puttaswamy judgment.
2) Impact on Investigative Journalism
The petitions warn that journalists can be treated as “data fiduciaries” under the Act. This may require notice and consent from people under investigation. The petitioners say this is impractical for journalism.
They also point to Section 12. If consent is refused, data may need to be erased. This can block post-publication verification. The high penalties under the Act, going up to Rs 250 crore, may create a chilling effect on public interest reporting.
3) State Power and Surveillance
Section 36 allows the Union government to seek information from any data fiduciary. The petitions argue this enables unreasonable digital searches without safeguards. They say the provision is vague and overbroad.
They also point out that there is no appeal or review against orders under Section 36. This, they argue, can lead to abuse of power and forced disclosure of journalistic sources.
Independence of the Data Protection Board
The petitions also question the independence of the Data Protection Board of India.
Under the Rules, the selection committee for appointing members includes only government secretaries and experts nominated by the government.
The petitioners argue that since the Board performs quasi-judicial functions, executive control over appointments violates the separation of powers. They also note that the State is the largest data collector. This raises concerns about impartiality.
What Are the DPDP Rules, 2025?
The Digital Personal Data Protection Rules, 2025 operationalise the Act.
They introduce:
- An 18-month compliance window
- Simple, purpose-specific consent notices
- Mandatory breach notifications to affected users
- Stricter duties for Significant Data Fiduciaries
- A fully digital Data Protection Board
- Appeals to Telecom Disputes Settlement and Appellate Tribunal
- Rights for individuals to access, correct, update, or delete data
The framework places citizens at the center of data protection.
Why This Case Matters
This challenge will shape the balance between privacy, transparency, and press freedom in India. The Court will test whether the DPDP Act meets the proportionality standard laid down in Puttaswamy. The outcome can affect how citizens access information, how journalists report on public interest issues, and how the State exercises data powers.
