The DPDP Act Is About to Be Stress-Tested — By the Supreme Court, the Cabinet Secretariat, and Every General Counsel in India

Three Fronts, One Statute

The Digital Personal Data Protection Act, 2023 has moved from legislative abstraction to operational reality — and the transition is proving uncomfortable for everyone involved. In the span of roughly ten weeks, three distinct pressure points have emerged: the Cabinet Secretariat has issued a top-down compliance directive to every Union ministry and state government, MeitY has quietly clarified contentious provisions through a Removal of Difficulties Order, and the Supreme Court has begun entertaining constitutional challenges that could reshape the Act before it fully takes effect.

For practitioners advising clients on data governance, this is no longer a "wait and watch" moment. The compliance clock is running, the litigation pipeline is filling, and the regulatory scaffolding — incomplete as it remains — is already creating enforceable expectations.

The Cabinet Secretary's Letter: State Accountability Gets a Deadline

The 20 August 2026 letter from the Cabinet Secretary to all Union ministries, state governments, and Union Territories is arguably the most consequential development — and the least discussed outside specialist circles. As reported by SCC Times, the letter directs governments to prepare time-bound implementation plans, map all personal-data processing activities, and tighten privacy notices, safeguards, third-party arrangements, and grievance redressal systems.

This matters enormously for two reasons. First, the State is by far India's largest data fiduciary. Every Aadhaar-linked welfare scheme, every digitised land record, every public health database involves processing of personal data at a scale no private entity can match. Second, the DPDP Act's treatment of state processing — particularly under Sections 7 and 17, which permit processing without consent for specified state functions and grant broad exemptions — has been the statute's most criticised feature since the Bill stage.

The Cabinet Secretary's directive implicitly acknowledges what privacy scholars have argued for years: the exemptions do not eliminate obligations. Even where consent is not required, the state remains bound by the Act's general principles — purpose limitation, data minimisation, reasonable security safeguards, and grievance mechanisms. The letter operationalises this reading. Lawyers advising government departments or PSUs should treat it as a de facto compliance framework, even before the Data Protection Board issues its own guidance.

The Removal of Difficulties Order: Clarifying Consent, Renaming Audits

MeitY's Removal of Difficulties Order, notified on 5 October and effective 6 October 2026, addresses two specific friction points that had generated considerable commentary since the DPDP Rules were first published.

Children and persons with disabilities: Section 9 of the Act requires verifiable parental or guardian consent before processing the personal data of children (defined as individuals below 18) and persons with disabilities who cannot act independently. The original drafting left significant ambiguity about what "verifiable" consent entails in practice — a question with enormous implications for ed-tech platforms, gaming companies, health-tech providers, and any service likely to be accessed by minors. The Order clarifies the consent architecture for these categories, though practitioners should examine whether the clarification adequately addresses the practical impossibility of age-gating at scale without intrusive identity verification — a tension the Act has never satisfactorily resolved.

"Audit" becomes "data audit": The substitution of "audit" with "data audit" for Significant Data Fiduciaries under Section 10 may appear cosmetic, but it is not. The original language created confusion about whether the obligation required a full financial-style audit or a data-specific assessment. The clarification narrows the scope to data protection audits, aligning the Indian requirement more closely with the GDPR's Data Protection Impact Assessment framework under Article 35. For SDFs — which will include major social media platforms, e-commerce companies, and financial institutions — this reduces ambiguity but does not reduce the compliance burden. The obligation remains annual and consequential.

The Supreme Court Enters the Fray

The most significant long-term development is the Supreme Court's decision to engage with the constitutional challenges to the DPDP Act. On 27 October 2026, LiveLaw reported that a fresh Article 32 petition filed by digital media groups challenges multiple provisions and rules as unconstitutional. Two days later, the Economic Times reported that the Court has sought the Centre's response to petitions alleging the Act infringes fundamental rights.

The media petition deserves particular attention. Digital news organisations are caught in a genuine bind: the DPDP Act's consent requirements, data minimisation obligations, and restrictions on processing could cripple investigative journalism, which by its nature involves processing personal data without the subject's consent. The Act does contain a journalistic exemption under Section 17(2), but its contours are vague, and the accompanying Rules have not resolved whether the exemption covers digital-native media or only traditional journalistic entities.

The constitutional question is not merely whether the DPDP Act violates privacy — it is whether the Act's architecture, which grants the executive sweeping exemption powers and establishes a Data Protection Board whose independence is questionable, satisfies the proportionality test laid down in Puttaswamy.

The K.S. Puttaswamy v. Union of India (2017) judgment established that any state action infringing privacy must satisfy a three-fold test: legality, legitimate aim, and proportionality. Critics argue that the DPDP Act's broad state exemptions, the absence of an independent regulator (the Data Protection Board is effectively a government-appointed body), and the lack of a meaningful right to data portability or erasure in certain contexts fail this test. The Supreme Court's willingness to hear these challenges suggests it takes the proportionality argument seriously — or at least recognises that the Act's design choices warrant judicial scrutiny before full implementation locks in.

What Practitioners Should Do Now

The timeline is unforgiving. Consent Manager registration is expected to open in November 2026 — weeks away. The broader substantive obligations become fully enforceable on 13 May 2027. And the Supreme Court's proceedings, while unlikely to produce a stay on implementation, could result in interim directions that alter compliance expectations mid-stream.

For in-house counsel: If your organisation processes personal data at scale, begin the data-mapping exercise now. The Cabinet Secretary's letter to government entities signals the standard the DPB will expect from private fiduciaries as well. Do not wait for the Board to issue sector-specific guidance — it does not yet have a full complement of members, and its capacity to provide timely direction is uncertain.

For litigators: The Article 32 petitions are the thin edge of the wedge. Expect a wave of constitutional challenges — from media organisations, civil liberties groups, and eventually from data fiduciaries challenging specific penalty provisions. The DPDP Act's penalty structure (up to ₹250 crore per instance of significant breach) creates standing for virtually every major data processor in the country.

For policy lawyers: The Removal of Difficulties Order mechanism under Section 38 is proving to be the government's preferred instrument for course correction. Track these orders closely — they are being issued without parliamentary debate and can substantively alter compliance obligations overnight.

The Uncomfortable Truth

India has built a data protection framework that is simultaneously too permissive (in its treatment of state processing) and too demanding (in its compliance expectations for private entities operating without clear regulatory guidance). The Supreme Court's intervention is not a threat to the Act — it is the Act's best chance of being refined into something constitutionally durable and practically workable.

The next six months will determine whether the DPDP regime becomes a credible data governance framework or collapses under the weight of its own contradictions. Either way, lawyers who understand its architecture now will be the ones their clients call when the enforcement actions begin.