Supreme Court Notice in DNPA Challenge Puts DPDP’s Press Problem Front and Centre

The DPDP Act has entered its most important phase: constitutional scrutiny

The most significant development in India’s technology-law landscape is not merely that the Digital Personal Data Protection Act, 2023 is moving toward implementation. It is that the law has now been directly challenged by the Digital News Publishers Association before the Supreme Court, and on 27 October 2026 the Court issued notice. That single procedural step changes the nature of the debate. Until now, the DPDP conversation was dominated by compliance timelines, consent architecture, and the government’s phased rollout. The Court’s intervention forces a more fundamental question: has Parliament designed a data protection statute that can coexist with investigative journalism and source protection?

That question matters because the DPDP Act is no longer an abstract future regime. The Rules were notified on 13 November 2025, the government has begun pushing ministries and States to prepare implementation plans, and the substantive provisions are expected to come fully into force by 13 May 2027. In other words, the Act is moving from drafting-room theory to operational reality. The Supreme Court’s notice in the DNPA petition suggests that the constitutional infirmities, if any, will be tested before the compliance machinery hardens into irreversible practice.

Why the media challenge is legally serious

The DNPA’s objection, as reported by Reuters and Bar and Bench, is that the DPDP framework could impair investigative journalism and compromise source confidentiality. This is not a rhetorical objection. It goes to the heart of how newsrooms function. Journalists collect personal data constantly: identities of sources, whistleblower material, financial records, location data, communications metadata, and documents that may reveal wrongdoing. A statute that treats such processing as ordinary “personal data processing” without a sufficiently robust journalistic exemption creates a structural conflict with press freedom.

The problem is sharper because Indian law already recognises that privacy and press freedom are both constitutionally salient. In Justice K.S. Puttaswamy v. Union of India, the Supreme Court grounded privacy in dignity, autonomy, and informational self-determination. But the Court has also repeatedly protected free expression under Article 19(1)(a), including the freedom of the press. The DPDP Act sits at the intersection of those two commitments. If the law over-protects data in a way that chills reporting, it becomes constitutionally suspect. If it under-protects privacy in the name of journalism, it invites abuse. The Supreme Court will now have to decide where the balance lies.

The government’s response is politically cautious, not legally reassuring

On 28 October 2026, the IT minister reportedly said the government is open to suggestions from the media. That is politically sensible, but it is not a legal answer. “Openness to suggestions” does not cure vagueness in a statute that affects newsgathering, source protection, and editorial independence. If the government wants to avoid a prolonged constitutional battle, it will need to do more than signal flexibility. It will need to clarify whether journalistic processing is exempt, partially exempt, or subject to a higher threshold of safeguards.

That is where the current drafting becomes vulnerable. The DPDP Act and the 2025 Rules were always likely to face pressure from sectors that process personal data in the public interest: journalism, academia, civil society, and even litigation support. The media challenge is simply the first high-profile constitutional test. It will not be the last.

The October clarifications show the government knows the Act has drafting friction

The 5 October 2026 Removal of Difficulties Order is also telling. MeitY used it to resolve ambiguities around consent for persons with disabilities and to clarify that the relevant Significant Data Fiduciary obligation is a “data audit”. On the surface, these are technical corrections. But they reveal something more important: the government is already having to clean up conceptual uncertainty before full enforcement begins.

That is not unusual in a major regulatory statute. Yet it does suggest that the DPDP framework was rolled out faster than the ecosystem could comfortably absorb. When a law requires a Removal of Difficulties Order within the first year of its operational build-up, lawyers should expect interpretive disputes to multiply. The phrase “data audit” may now look settled, but the deeper issue remains: what exactly does the State expect from Significant Data Fiduciaries, and how will compliance be measured in practice?

For practitioners, the real story is the widening scope of DPDP litigation

LiveLaw’s DPDP tracker shows that litigation is already spreading beyond the media challenge. Cases involving APAAR consent forms, Digi Yatra privacy concerns, and the RTI amendment are all part of the same constitutional ecosystem. This is the point many compliance teams miss. The DPDP Act is not just a corporate privacy statute. It is becoming a general-purpose accountability framework for data power in India.

That means lawyers should stop thinking of DPDP as a niche technology law and start treating it as a cross-cutting regulatory discipline. It will affect:

media organisations handling source material and audience data;

educational institutions processing student records;

airports and travel platforms using biometric or identity-linked systems;

government departments building citizen databases;

startups and platforms whose business models depend on behavioural profiling.

What happens next

The Supreme Court’s notice does not mean the DPDP Act is doomed. But it does mean the government can no longer rely on implementation momentum alone. If the Court takes the DNPA petition seriously, the Centre may be forced to defend the statute’s treatment of journalistic processing, the breadth of exemptions, and the adequacy of safeguards against misuse. That could lead to a narrower reading of the Act, a constitutionally guided interpretation, or in a more dramatic outcome, a partial striking down of provisions that fail the Article 19(1)(a) test.

For now, the practical advice is simple. Do not treat DPDP compliance as a box-ticking exercise. Map your data flows, identify whether your organisation is handling personal data in a way that could attract public-interest scrutiny, and watch the Supreme Court proceedings closely. The next phase of Indian data protection law will not be written only by MeitY. It will be written in court.

Bottom line: the DPDP Act has moved from rollout to resistance. The Supreme Court’s notice in the DNPA case is the clearest sign yet that India’s privacy regime will be shaped as much by constitutional litigation as by administrative rulemaking.