The DPDP Act Meets Its First Real Test: Why the DNPA’s Supreme Court Challenge Could Reshape Indian Data Protection

The Press Freedom Problem India’s Data Law Cannot Ignore

On 27 October 2026, the Supreme Court issued notice to the Union Government in a writ petition filed by the Digital News Publishers Association (DNPA) challenging key provisions of the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025. Within two days, the Centre signalled it was “open to suggestions” from the media. That is not a routine response. It is an early acknowledgment that the DPDP framework, as drafted, may have a genuine constitutional vulnerability.

This challenge matters far beyond newsrooms. It is the first serious constitutional test of a law that will govern how every Indian business, platform, and institution handles personal data. How the Supreme Court responds will set the interpretive baseline for the entire DPDP regime.

What the DNPA Is Actually Arguing

The core grievance is structural. The DPDP Act makes no meaningful exemption for journalistic activity. Under the GDPR, Article 85 requires member states to reconcile data protection with freedom of expression, and most EU jurisdictions have carved out broad journalistic exemptions. India’s legislature chose not to.

The consequences are concrete. A journalist investigating a public official’s financial dealings would, under a plain reading of the Act, need that official’s consent before processing their personal data. Section 7 provides limited legitimate-use exceptions — for state functions, legal obligations, medical emergencies — but journalism appears nowhere in that list. The DNPA’s petition, as reported, argues this creates a chilling effect on investigative reporting that is incompatible with Article 19(1)(a) of the Constitution.

The DPDP Act protects privacy. But privacy was recognised as a fundamental right in Puttaswamy precisely because it enables democratic participation — not because it shields the powerful from scrutiny. A data protection law that makes investigative journalism legally precarious has inverted the constitutional logic it claims to serve.

The petitioners reportedly include digital arms of major legacy media groups. That breadth of participation — cutting across ownership structures and editorial lines — suggests the industry views this as an existential compliance problem, not a marginal inconvenience.

The Removal of Difficulties Order: Necessary but Insufficient

On 5 October 2026, MeitY notified the DPDP (Removal of Difficulties) Order, 2026, effective the following day. It addressed two specific issues: refining consent language for children and persons with disabilities under Section 9, and replacing “audit” with “data audit” in Section 10 to align with the independent data auditor framework for Significant Data Fiduciaries.

These are welcome clarifications. The Section 9 fix resolves a drafting ambiguity that had troubled disability rights advocates and ed-tech companies alike. The Section 10 correction eliminates confusion between financial audit obligations and the specialised data audit the Act contemplates.

But neither fix touches the press freedom question. The order demonstrates that the government is willing to use Section 44’s removal-of-difficulties mechanism for technical corrections. Whether that mechanism can — or should — be used to create a journalistic exemption is a harder question. Section 44(2) limits such orders to difficulties in giving effect to the Act’s provisions. A journalistic carve-out is arguably a policy choice, not a drafting difficulty, and stretching Section 44 to accommodate it could invite its own legal challenge.

The Compliance Timeline Is Accelerating

While the constitutional challenge plays out, the implementation machinery is moving. The Cabinet Secretary’s directive of 20 August 2026 instructed all Union ministries, state governments, and Union territories to prepare DPDP implementation plans — mapping personal data processing, drafting privacy notices, establishing safeguards, formalising third-party data processing arrangements, and setting up grievance mechanisms.

This is significant for practitioners advising government bodies. Public sector entities are among India’s largest data fiduciaries — Aadhaar, GSTN, state health databases, municipal records. The directive signals that the government expects its own house to be in order before the substantive provisions come fully into force on 13 May 2027.

For private sector counsel, the phased timeline creates a familiar trap. Consent manager provisions take effect on 13 November 2026. Substantive obligations follow in May 2027. But the DNPA litigation introduces uncertainty: if the Supreme Court stays any provision or signals discomfort with the Act’s scope, compliance roadmaps built on current text may need rapid revision.

What Lawyers Should Be Watching

Three things demand attention in the coming weeks.

First, the Centre’s response. The government’s willingness to engage with media concerns suggests it may propose amendments or clarifications rather than defend the Act as-is. If the Centre files a counter-affidavit conceding the need for a journalistic exemption, the shape of that concession will matter enormously — not just for media companies but for any entity whose data processing involves public interest justifications.

Second, the Data Protection Board. The Kerala High Court’s query about the Board’s status in the Digi Yatra matter highlights a governance gap. The DPB is supposed to be the enforcement backbone of the DPDP regime. If it is not yet operational while implementation deadlines approach, regulated entities face obligations without a functioning adjudicatory mechanism. That is a recipe for arbitrary enforcement or, worse, no enforcement at all.

Third, the RTI tension. Ongoing litigation around the DPDP Act’s impact on the Right to Information Act — particularly the amendment to Section 8(1)(j) of the RTI Act — remains unresolved. The DNPA challenge may force the Court to confront the broader question of how India balances informational privacy against transparency and accountability.

A Law in Need of Its Puttaswamy Moment

The DPDP Act was drafted in the shadow of Justice K.S. Puttaswamy v. Union of India, which established privacy as a fundamental right. But Puttaswamy also established that privacy is not absolute — it must be balanced against other constitutional values, including free expression and the public’s right to know. A data protection law that ignores this balance invites precisely the kind of constitutional challenge the DNPA has now brought.

The Supreme Court’s notice is not a verdict. But it is a signal that the DPDP framework will not be allowed to operate in a constitutional vacuum. For practitioners, the message is clear: advise clients on current compliance obligations, but build flexibility into every data governance framework. The ground beneath this law is still shifting.