Supreme Court's Refusal to Stay DPDP Act Signals Immediate Compliance Reality for Indian Media and Tech

The Unstoppable Force Meets the Immovable Object

The Supreme Court's decision on 27 October 2026 to issue notice in the Digital News Publishers Association v. Union of India without granting an interim stay marks a watershed moment for India's data protection regime. A Bench comprising Chief Justice Surya Kant and Justices Joymalya Bagchi and V. Mohana has effectively told the media industry: prepare for compliance, not for reprieve. By declining to halt the operation of the Digital Personal Data Protection Act, 2023 (DPDP Act) and the accompanying DPDP Rules, 2025, the Court has signalled that the constitutional challenge to this legislation will proceed on a timeline that may not accommodate the industry's operational anxieties.

This development, coupled with MeitY's notification of the DPDP (Removal of Difficulties) Order, 2026 on 5 October, creates a pincer movement that leaves data fiduciaries—particularly digital news platforms—with little room to manoeuvre. The government is simultaneously tightening the compliance architecture while the judiciary refuses to pause the machinery. For practitioners advising technology companies and media houses, the message is unambiguous: the DPDP regime is here, it is operational, and the courts will not rescue you from its immediate obligations.

Decoding the Removal of Difficulties Order

The MeitY Order, effective 6 October 2026, addresses two critical ambiguities that had plagued compliance officers since the Rules were notified. First, it clarifies that the consent requirements under Section 9 extend to children and persons with disabilities through lawful guardians, resolving the interpretive vacuum that had left platforms uncertain about age-gating and guardian-consent mechanisms. Second—and more significantly for corporate governance—it substitutes the term "audit" with "data audit" in Section 10(2)(c)(ii), thereby distinguishing statutory financial audits from the specialised data protection audits required for Significant Data Fiduciaries (SDFs).

This distinction matters immensely. By creating a separate category of "data audits," the government has effectively created a new compliance vertical. Law firms and consulting practices must now advise clients that their existing statutory auditors may not suffice for DPDP compliance. The Order implicitly demands a specialised audit mechanism examining data processing activities, consent architectures, and security safeguards—distinct from the financial scrutiny under the Companies Act, 2013. For technology companies handling large volumes of personal data, this means engaging with a new breed of "data auditors" who understand both the technical architecture of data flows and the legal requirements of Sections 8 (security safeguards) and 10 (additional obligations of SDFs).

The Press Freedom Conundrum

The DNPA's challenge strikes at the heart of democratic accountability. The petition reportedly contends that the DPDP Act's provisions regarding personal data processing—particularly the amendments to the Right to Information Act, 2005—create a chilling effect on investigative journalism. The concern is not merely theoretical. Section 44(3) of the DPDP Act amends Section 8(1)(j) of the RTI Act to exempt personal information from disclosure, potentially shielding public officials from scrutiny even when the public interest in disclosure outweighs privacy concerns.

By refusing to stay these provisions, the Supreme Court has allowed a structural conflict to fester. On one hand, the Puttaswamy judgment (2017) established privacy as a fundamental right; on the other, the RTI Act institutionalises transparency as a cornerstone of governance. The DPDP Act, in its current form, appears to tilt the balance decisively toward privacy, potentially at the cost of the "sunlight" that disinfects public administration. For media lawyers, this creates an urgent imperative: develop alternative legal strategies for accessing information, including leveraging the "public interest" override that may still exist within the DPDP framework, or risk seeing investigative journalism wither under compliance burdens.

The Compliance Timeline: No Grace Period

The Cabinet Secretary's letter of 20 August 2026, directing all Union Ministries, State Governments, and Union Territories to prepare implementation plans, indicates that the government is operating on a war footing. With substantive provisions reportedly coming into force on 13 May 2027, the window for building compliant systems is narrowing rapidly. The phased rollout offers cold comfort—consent mechanisms, data audits, and grievance redressal workflows require architectural changes that cannot be implemented overnight.

For technology companies, the immediate priorities are clear:

First, map all personal data processing activities to identify whether you qualify as a Significant Data Fiduciary under Section 10, given the government's power to notify classes of data fiduciaries based on volume and sensitivity of data.

Second, redesign consent architecture to meet the granular requirements of Sections 6 and 9, particularly for children's data, where the "verifiable consent" standard now explicitly includes guardian consent mechanisms.

Third, establish independent data audit protocols that satisfy the amended Section 10(2)(c)(ii), ensuring these are distinct from financial audits and capable of assessing technical safeguards.

The Road Ahead

The Supreme Court's decision to hear the Union Government before granting any interim relief suggests a cautious approach—one that respects legislative supremacy in economic regulation while keeping constitutional questions open. However, for practitioners, the absence of a stay means that the DPDP Act's penalties—ranging up to ₹250 crore for significant breaches—are now live risks.

The DNPA petition will likely be heard in the coming months, but the 13 May 2027 deadline looms large. Media houses must now make difficult choices: invest heavily in compliance infrastructure that may later be invalidated, or risk enforcement action while hoping for judicial relief. The prudent course lies in building flexible systems that can adapt to either outcome—systems that respect data principals' rights while preserving the press's ability to function as the fourth estate.

As we await the Court's final word on the constitutional validity of these provisions, one thing is certain: the era of data protection as a mere policy aspiration is over. The DPDP Act has teeth, and the judiciary, for now, is declining to muzzle it.