The DPDP Act Meets the Fourth Estate: Why the Supreme Court’s Notice to DNPA Changes Everything for Data Practitioners

The Constitutional Challenge That Could Redefine India’s Data Privacy Architecture

The Supreme Court’s decision on 27 October 2026 to issue notice in the Digital News Publishers Association v. Union of India marks a critical inflection point in the lifecycle of the Digital Personal Data Protection Act, 2023. While the Court declined an interim stay—allowing the phased implementation schedule to proceed—the mere issuance of notice signals that the constitutional infirmities alleged by the DNPA are not frivolous. For data protection practitioners, this development transforms the DPDP Act from a compliance checklist into a live constitutional battleground.

The timing is significant. The institutional provisions of the DPDP Act came into force on 13 November 2025, with the substantive obligations scheduled for 13 May 2027. Between these bookends, the Centre has been aggressively operationalising the framework: the Cabinet Secretary’s directive of 20 August 2026 to all Union Ministries and State Governments, and MeitY’s “Removal of Difficulties” Order of 5 October 2026 (effective 6 October), which clarified that Significant Data Fiduciaries must conduct “data audits” rather than generic compliance audits. Against this backdrop of administrative acceleration, the DNPA’s challenge introduces a judicial brake that could recalibrate the Act’s most contentious provisions.

The DNPA’s Core Grievance: Journalism as “Processing” and the Chilling Effect

The DNPA’s petition, while not yet fully reported, appears to target the DPDP Act’s failure to carve out a robust exemption for journalistic processing of personal data. Unlike the GDPR’s Article 85, which mandates member states to reconcile data protection with freedom of expression, the DPDP Act offers only a narrow exemption under Section 17(2) for “journalistic purposes” that is both undefined and subject to the Central Government’s rule-making power. The DNPA argues that this creates an unconstitutional chilling effect on investigative journalism, particularly regarding source protection and newsgathering.

This is not merely a media law concern. For in-house counsel advising technology companies, the DNPA challenge raises a fundamental question: if journalistic processing requires heightened protection, what does that imply for other forms of “legitimate use” under Section 7? The Act’s architecture relies heavily on the concept of “legitimate uses” that bypass consent, including processing for “purposes of the State” and “employment purposes.” If the Supreme Court reads down the journalistic exemption or mandates a stricter proportionality test, the ripple effects will be felt across every sector that relies on non-consensual processing.

The “Removal of Difficulties” Order: A Double-Edged Sword

MeitY’s 5 October Order, issued under Section 44 of the DPDP Act, was ostensibly a technical clarification. By specifying that the periodic audits required of Significant Data Fiduciaries under Section 10(2)(c) are “data audits,” the Order has inadvertently raised the compliance bar. A “data audit” implies a forensic examination of data flows, consent artefacts, and processing purposes—not merely a review of security controls. For practitioners, this means that the audit obligation is no longer a tick-box exercise but a substantive accountability mechanism that could expose fiduciary entities to enforcement action by the Data Protection Board.

The Order’s clarification on consent language for persons with disabilities is equally significant. By mandating that consent requests be accessible, MeitY has imported the principles of the Rights of Persons with Disabilities Act, 2016 into the DPDP framework. This creates a new compliance vector: consent notices must now be tested for accessibility, and failure to comply could constitute a ground for complaint before the Data Protection Board. Practitioners should note that this is the first instance of the DPDP Act intersecting with disability rights legislation, and it is unlikely to be the last.

The Cabinet Secretary’s Directive: The State as Data Fiduciary

The 20 August 2026 directive from the Cabinet Secretary is perhaps the most underreported development. By requiring all government bodies to designate senior officers, map personal data processing, and review third-party arrangements, the Centre has effectively admitted that the State is the largest data fiduciary in the country. This has profound implications for the “purposes of the State” exemption under Section 7(b). If government departments are now required to comply with the same rigour as private fiduciaries, the blanket exemption begins to look less like a carve-out and more like a compliance obligation.

For lawyers advising public sector undertakings or vendors to government, the directive creates a new due diligence requirement. Any contract involving personal data processing by or on behalf of a government entity must now be reviewed against the DPDP framework, regardless of the Section 7(b) exemption. The directive’s emphasis on “grievance mechanisms” also suggests that the Data Protection Board will soon see complaints against State instrumentalities—a development that could test the limits of sovereign immunity in data protection enforcement.

What Lies Ahead: The May 2027 Cliff Edge

The substantive provisions of the DPDP Act come into force on 13 May 2027. Between now and then, the Supreme Court’s hearing in the DNPA matter will be the single most important variable. If the Court stays the operation of the journalistic exemption or reads in a proportionality requirement, the entire compliance architecture built by MeitY could require recalibration. Conversely, if the Court upholds the Act in its entirety, the DNPA’s challenge will have served only to delay the inevitable—and to highlight the Act’s democratic deficits.

For practitioners, the immediate task is clear: treat the period between now and May 2027 as a window of opportunity to influence the Rules and to build compliance frameworks that are resilient to constitutional challenge. The DPDP Act is no longer a distant regulatory horizon; it is a live, contested, and rapidly evolving legal reality. The Supreme Court’s notice to DNPA is not the end of the story—it is the beginning of the Act’s constitutional reckoning.

Practical Takeaway: The DNPA challenge is a reminder that data protection in India is not merely a compliance function but a constitutional discipline. Practitioners should monitor the Supreme Court proceedings closely and advise clients that the DPDP Act’s exemptions—particularly for journalistic and State processing—are subject to judicial review and potential reinterpretation.