The DPDP Act’s First Real Battle: Press Freedom, Consent, and the State’s Data Power

The DPDP Act Meets the Fourth Estate

The Digital Personal Data Protection Act, 2023, has moved from legislative abstraction to courtroom controversy. On 27 October 2026, the Supreme Court issued notice on a petition by the Digital News Publishers Association (DNPA), representing 21 major Indian news organisations, challenging several provisions of the Act and the Digital Personal Data Protection Rules, 2025. The Court declined an interim stay, but the notice itself signals that the judiciary is willing to scrutinise a law that could fundamentally alter how Indian newsrooms operate.

The DNPA’s core argument is that the DPDP framework threatens source confidentiality and the practical functioning of journalism. Under Section 4 of the Act, personal data can only be processed for a lawful purpose with consent or for certain legitimate uses. But what happens when a journalist processes personal data in the course of an investigation? The Act’s exemptions under Section 17 — for research, archiving, and journalistic purposes — are narrower than many media lawyers expected. The Rules, notified in 2025, have done little to clarify the boundaries.

The DNPA petition is not just about press freedom; it is a test case for how India balances privacy rights against other constitutional values. The Supreme Court’s response will set the tone for DPDP litigation for years to come.

Why This Matters for Practitioners

For lawyers advising media clients, the DNPA challenge is a wake-up call. The DPDP Act’s consent architecture — particularly Section 6 on consent and Section 7 on legitimate uses — was drafted with commercial data processing in mind. Applying it to journalism creates friction. A reporter cannot reasonably obtain consent from every individual mentioned in a story. The “legitimate use” carve-outs under Section 7(b) — for employment purposes, medical emergencies, and state functions — do not neatly cover investigative reporting.

The petition also raises questions about Section 44(3), which empowers the Data Protection Board to impose penalties for non-compliance. Media organisations fear that the Board, once functional, could become a tool for harassment. The Kerala High Court’s 10 October 2026 PIL urging the Board to be made operational within eight weeks underscores the urgency — and the anxiety — around DPDP enforcement.

The Government’s Compliance Clock

While the courts grapple with constitutional questions, the executive is pushing ahead with implementation. A 20 August 2026 letter from the Cabinet Secretary directed Union ministries, state governments, and Union territories to prepare DPDP implementation plans. The directive requires mapping personal-data processing, designating senior officers, reviewing notices, safeguards, third-party arrangements, and grievance mechanisms. This is not optional homework; it is a compliance mandate with a deadline.

The DPDP Removal of Difficulties Order, 2026, notified on 5 October 2026 and effective the next day, attempted to clarify some ambiguities. It replaced the word “audit” with “data audit” in the relevant provision and clarified consent requirements for children and persons with disabilities with lawful guardians. But these are minor fixes. The structural tension between the Act’s consent-centric model and the realities of journalism, research, and public-interest reporting remains unresolved.

The Bigger Picture: Data Protection as State Power

The DPDP Act is often framed as a privacy law, but it is equally a law about state power over data. Section 17(2) exempts the state from many obligations when processing data for sovereignty, security, and public order. The breadth of this exemption has drawn criticism from civil society and, now, from the press. The DNPA petition implicitly challenges the asymmetry: private actors face stringent consent requirements, while the state enjoys wide latitude.

The IT minister’s statement on 29 October 2026 — that the government is “open to suggestions from media” — is a diplomatic holding pattern. It does not commit to amendments, but it acknowledges that the law’s impact on journalism is a live political issue. With the substantive personal-data processing provisions scheduled to commence on 13 May 2027, there is a narrow window for course correction.

What to Watch

The Supreme Court’s next hearing on the DNPA petition will be critical. If the Court grants an interim stay on specific provisions — particularly those affecting journalistic exemptions — it could force the government back to the drafting table. Even without a stay, the litigation will shape how the Data Protection Board interprets its mandate once it becomes operational.

For lawyers, the immediate task is to advise clients on compliance while the legal landscape remains unsettled. Media organisations should review their data-handling practices, document their journalistic processes, and prepare for the possibility that the DPDP framework will be enforced against them. The Act’s penalties — up to ₹250 crore for significant breaches — are too large to ignore.

The DPDP Act was sold as a balance between privacy and innovation. The DNPA challenge suggests that balance is yet to be struck. The courts, the government, and the press will now negotiate it — in public, and under pressure.