DPDP in 2026: From Paper to Practice — And the Supreme Court Now Holds the Pen

India's Digital Personal Data Protection Act, 2023 is finally shedding its reputation as a statute that exists mostly on paper. With consent managers going live on 13 November 2026, government departments scrambling to meet compliance deadlines, and the Supreme Court issuing notice in the DNPA challenge, the DPDP regime has entered its most consequential phase yet. For practitioners advising clients across media, fintech, and technology sectors, the time for wait-and-watch is over.

The Removal of Difficulties Order: Filling Gaps, Creating Questions

The MeitY's Removal of Difficulties Order, 2026, issued on 5 October, addresses two critical ambiguities that had been troubling practitioners since the DPDP Rules were notified in November 2025. First, it clarifies consent mechanisms for persons with disabilities — a constituency the original Act had conspicuously failed to address adequately. Second, and perhaps more significantly for corporate compliance teams, it defines certain GDPR-style audit obligations as "data audits" under the DPDP framework.

This second clarification matters more than it might appear. The DPDP Act's original text was notably thinner than the GDPR on accountability mechanisms. By importing audit concepts through subordinate legislation, MeitY is effectively acknowledging that the Act's self-regulatory model needed teeth. The question now is whether these "data audits" will resemble the rigorous Data Protection Impact Assessments familiar to those who have worked with European clients, or whether they will become yet another checkbox compliance exercise.

Consent Managers Go Live — But Where Is the Board?

The operationalisation of consent managers on 13 November 2026 marks a genuine inflection point. The consent manager framework, borrowed conceptually from the Account Aggregator model that has transformed financial data sharing, is India's distinctive contribution to global data protection architecture. Unlike the GDPR's reliance on cookie banners and privacy policies that nobody reads, consent managers promise a technological infrastructure for granular, revocable consent.

Yet the Economic Times report flags a troubling detail: the portal has gone live without Data Protection Board of India members. This is not a minor administrative lag. The DPBI is the enforcement backbone of the entire regime. Without it, consent managers are collecting grievances that have nowhere to go. Data fiduciaries are making investments in compliance infrastructure without clarity on how the regulator will interpret their obligations. The situation recalls the early days of the Competition Commission of India, which operated for years without a full complement of members — and saw its enforcement credibility suffer accordingly.

The DNPA Challenge: Press Freedom Meets Data Protection

The Digital News Publishers Association's challenge to the DPDP Act and Rules, now before the Supreme Court, strikes at the regime's most vulnerable flank. The Court's decision on 27 October to issue notice while declining an interim stay is characteristically Delphic — it signals that the challenge is not frivolous while avoiding any prejudgment of the merits.

The core tension is real. The DPDP Act's consent requirements sit uneasily with investigative journalism, which often involves processing personal data without the subject's knowledge, let alone consent. The Act's exemptions under Section 17 for "journalistic purposes" are narrower than many in the media had hoped. When the Information and Broadcasting Minister says the government is "open to suggestions from the media," it suggests the Centre recognises the political cost of being seen to muzzle the press — but whether this translates into legislative amendment remains to be seen.

For media lawyers, the 17 November hearing will be critical. The Court's approach to interim relief will indicate how seriously it takes the chilling effect argument. Watch for whether the bench engages with the Puttaswamy framework — the nine-judge bench decision that established privacy as a fundamental right also recognised that privacy cannot become a shield against accountability journalism.

Government Compliance: The State as Data Fiduciary

The Cabinet Secretary's letter of 20 August 2026, requiring Union ministries and state governments to prepare implementation plans, deserves more attention than it has received. For too long, data protection discourse in India has focused on private sector compliance while treating government data processing as somehow exempt from scrutiny. The DPDP Act, to its credit, does not create a blanket state exemption — Section 17(2) exemptions are conditional and purpose-specific.

The directive to map personal data processing, designate senior officers, and review third-party arrangements suggests the Centre understands that government departments are among India's largest data fiduciaries. Aadhaar, GSTN, the National Health Stack — these systems process personal data at a scale that dwarfs most private companies. If the compliance timetable holds, we may finally see some accountability architecture around state data processing.

What Practitioners Should Watch

Three developments demand immediate attention. First, the DPBI's constitution — until the Board is operational, enforcement risk remains theoretical, but this will change rapidly once members are appointed. Second, the Supreme Court's approach in the DNPA matter will shape how courts interpret the journalistic exemption and, by extension, other purpose-based exemptions. Third, the phased implementation culminating in May 2027 means that compliance programmes built now will determine exposure later.

The DPDP regime is no longer a future concern. It is here, it is incomplete, and it is being litigated. That combination — operational rules, missing institutions, and constitutional challenge — makes this the most dynamic moment in Indian data protection law since Puttaswamy itself.