Data Is The Real, True Wealth: Supreme Court Issues Notice In Plea Challenging DPDP Act; Highlights Privacy Concerns

 The Supreme Court, while issuing notice, has highlighted that because data is now handled by massive global companies, protecting data sovereignty and the "right to privacy" has become an urgent global issue that needs clear legal boundaries.

The Court was hearing a plea filed by a journalist, Geeta Seshu and others inter alia seeking direction or declaration quashing and setting aside Sections 7, 17(2)(a), 19(3) 24, 36, 44(2)(a), and 44(3) of the Digital Personal Data Protection Act, 2023, to the extent challenged herein, as being unconstitutional, void and inoperative, and violative of Articles 14, 19(1)(a), 19(1)(g), 21 and 21A of the Constitution of India.

The Bench of Chief Justice Surya Kant, Justice Joymalya Bagchi and Justice Vipul M Pancholi ordered, "Issue notice returnable on 23rd March. It will be taken up along with..."

Senior Advocate Indira Jaisingh appeared on behalf of the Petitioners.

During the hearing, the Bench remarked, "One is the state collecting data, and there is another matter before us. We hope that it will proceed and eventually we'll decide on merits. Where our entire data of the citizens—not only of one nation, maybe a substantial part of the globe—is concerned. It's a global issue. A global issue going into the very big private entities. And that’s where the question of data sovereignty arises...Data is becoming the real, true wealth as of today."

Senior Advocate Indira Jaising, appearing for the petitioners, informed the Supreme Court that the new Data Protection Act is being challenged through multiple petitions, each focusing on different facets of the statute. A primary concern raised was the removal of the "public interest" exception, which previously existed under the RTI Act. Jaising argued that this deletion severely hampers investigative journalism, as reporters may no longer be able to access data concerning public servants or matters of public importance, even when such information is vital for transparency.

Jaisingh submitted, "Your Lordships have issued notice in three previous petitions challenging analogous provisions of this Act. However, the emphasis of each of the petitions is slightly different from the other. So I thought… the statute itself is new, because it talks of data protection for the first time in the country...I may briefly just tell you: one is the journalistic exception. Public interest has been deleted from the RTI Act and also from the Data Protection Act. So, therefore, a journalist cannot access data which is in the public interest. My Lord, we concede that we can't have personal data. A journalist need not have personal data, but if it's in the public interest—for example, if you're writing about a public servant, etc."

Chief Justice Kant said, "Ultimately, the interesting question that will have to be determined is: what is public data and what is personal data?"

Senior Advocate Jaisingh replied, "Yes, My Lord, that's a critical question. The Act doesn't clarify that. So, therefore, My Lord, it will require judicial interpretation. And there is no definition of what is information and what is personal."

"One interesting point can be whether data with respect to a person, so long as he holds a public office, can be termed as personal data or can it be termed as private data...Madam, at the time of hearing, you will have to suggest different hypothetical situations. And then, probably, we will be able to have a better analysis.", Justice Kant remarked.

She submitted, "not only hypothetical, but we can take cases that have actually gone to court under the RTI Act, where either the information has been allowed or disallowed, because these will be analogous provisions. My Lord, in the RTI Act, there was an exception saying you can ask for information which is in the public interest. That has been deleted from the Data Protection Act. Actually, that's what's causing the trouble. Otherwise, there would be no other problem. Then, My Lord, the second is that the state has a right to call for any information. Of course, there are certain categories and sovereignty of the country, but they are overbroad. For example, they can call for information which is related to public order. Now, public order, as we all know, is a very broad category."

The Court observed that the core of the matter lies in distinguishing between public and personal data. He questioned whether information regarding an individual holding public office could truly be classified as "private." The Bench emphasized the need for a balanced approach, requesting that the petitioners suggest specific measures to protect individual privacy without compromising the right to information. Justice Kant noted that neither right should act as an impediment to the effective exercise of the other.

Justice Kant said, "But also, Madam, we will request you to also suggest the measures to protect the individuals also. In a given case, if there are sweeping provisions permitting to have the complete information and where the right to privacy and this conflict comes, then how to protect some individuals also?...So, what can be the measures which can be taken without affecting the right to have this information?"

Singh responded, "Now, especially now, My Lord, we have a right to privacy in this country. So that right also has to be protected. That balancing measure—yes, that is what you [mean]—between the right to privacy and the right to public information."

Chief Justice said, "None of the rights should compromise with the other, and none of the rights should become an impediment in the effectivity of the right."

The discussion also touched upon the doctrine of proportionality and the "overbroad" nature of the Act’s provisions. Jaising highlighted concerns regarding state surveillance, noting that the government has exempted itself from several provisions of the Act. Additionally, she pointed out the removal of the right to compensation for individuals whose data is illegally accessed—a right that existed under the previous IT Act—noting that any penalties would now be directed to the Data Protection Board rather than the victim.

Senior Advocate Jaisingh submitted, "The doctrine of proportionality, overbreadth—all those issues will arise for consideration by the court. And My Lord, last but not the least, the state exempts itself from the provisions of this Act. So, therefore, we'll have to see that they can collect any data about us. There is a certain fear of surveillance also, which emerges from the reading of the provisions of this Act. So we are hoping that this honourable court will give some direction, some enlightenment on these issues. These will be the four issues, My Lord: whether there is a danger of surveillance, whether the state can exempt itself, and whether journalists can write about it."

She further said, "You will have to look at actually all the provisions of the Act. My Lord, one more issue: earlier under the IT Act, we had a right to get compensation if our data was illegally accessed. Now they've deleted that right to compensation if data is illegally accessed. And they've said the compensation, if any, will go to the state. It will go to the Board. It will go to the Data Protection [Board]."

The Court acknowledged the global significance of the issue, describing data as the "true wealth" of the modern era. Justice Kant noted that the case involves broader questions of data sovereignty, especially concerning large private entities and the cross-border access of citizen data. Recognizing the urgency and the "imminently required" nature of the judicial interpretation of these laws, the Court issued notice, returnable on March 23rd, to be heard alongside related petitions.

The Petitioner filed a PIL which prayed for the following reliefs, "a) Issue an appropriate writ, order or direction or declaration quashing and setting aside Sections 7, 17(2)(a), 19(3) 24, 36, 44(2)(a), and 44(3) of the Digital Personal Data Protection Act, 2023, to the extent challenged herein, as being unconstitutional, void and inoperative, and violative of Articles 14, 19(1)(a), 19(1)(g), 21 and 21A of the Constitution of India...b) Issue an appropriate writ, order or direction, or declaration quashing and setting aside Rules 5, 6, 17, 18, 21 and 23, and the Second Schedule, Fifth Schedule, Sixth Schedule and Seventh Schedule of the Digital Personal Data Protection Rules, 2025, to the extent challenged herein, as being unconstitutional, void and inoperative, and violative of Articles 14, 19(1)(a), 19(1)(g), 21 and 21A of the Constitution of India."

Further, it was also prayed, "c) Issue an appropriate writ, order or direction, or declaration quashing and setting aside Section 17(2) of the Digital Personal Data Protection Act, 2023, insofar as it empowers the Central Government to exempt any of its instrumentalities from the application of the provisions of the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025...d) Issue an appropriate writ, order or direction, or declaration quashing and setting aside the Second Schedule of the Digital Personal Data Protection Rules, 2025."

The Plea also sought a direction for quashing and setting aside Section 44(2)(a) of the Digital Personal Data Protection Act, 2023, insofar as it extinguishes the right of affected persons to seek compensation or civil remedy for unlawful processing of personal data and/or data breach and for setting aside Section 44(3) of the Digital Personal Data Protection Act, 2023 insofar as it dilutes the right to information of the citizens of India.

"Issue an appropriate writ, order or direction, or declaration quashing and setting aside Section 19(3) and Section 24 of the Digital Personal Data Protection Act, 2023 read with Rules 17, 18 and 21 and the Fifth and Sixth Schedules of the Digital Personal Data Protection Rules, 2025, insofar as they relate to the constitution, appointment, service conditions and functioning of the Data Protection Board of India...Issue an appropriate writ, order or direction, or declaration directing the Respondent No. 1 to frame a constitutionally 103 compliant mechanism for appointment, tenure and service conditions of the Data Protection Board of India, ensuring its independence from executive control", it further prayed.

It also sought setting aside Section 36 of the Digital Personal Data Protection Act, 2023 read with Rule 23 and the Serial No. 1 of the Seventh Schedule of the Digital Personal Data Protection Rules, 2025 and sought directions to Union of India to incorporate and notify a specific and proportionate exemption under the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 for processing of personal data for journalistic, editorial, investigative and public interest reporting purposes, including protection of journalistic sources. Alternatively, issue an appropriate writ, order or direction, or declaration quashing and setting aside Section 7 of the Digital Personal Data Protection Act, 2023, insofar as it fails to provide an exemption for processing of personal data for journalistic purposes.

The Court had previously issued notice in the plea seeking the validity of the DPDP Act, 2023, as unconstitutional for being violative of Articles 14, 19 and 21 of the Constitution. The digital news platform The Reporters' Collective and journalist Nitin Sethi approached the Supreme Court of India to challenge key provisions of the Digital Personal Data Protection (DPDP) Act, 2023.

Cause Title: Geeta Seshu and Anr. v. Union of India and Ors. [W.P.(C) No. 275/2026]