The DPDP Reckoning: As Government Scrambles to Comply, the Press Knocks on the Supreme Court's Door

October 2026 may well be remembered as the month the Digital Personal Data Protection Act, 2023 stopped being an abstract compliance horizon and became a live constitutional battleground. Within the span of four weeks, MeitY issued a course-correcting executive order, the Cabinet Secretary put the entire machinery of government on a compliance clock, and the Supreme Court issued notice in what promises to be the defining challenge to the Act — brought not by big tech, but by India's own digital press.

The Publishers' Petition: Journalism Meets the Consent Architecture

On 27 October 2026, the Supreme Court issued notice in the Digital News Publishers Association's (DNPA) challenge to provisions of the DPDP Act and the DPDP Rules, 2025. The petition's logic is not hard to grasp. The Act's consent-first architecture under Sections 4–6 — requiring notice and free, specific, informed consent before processing personal data — sits uneasily with investigative journalism, where sources are protected, subjects of investigation are rarely asked for permission, and public-interest reporting often involves processing personal data of precisely those who would refuse consent.

The DNPA's reported warning that "newsrooms will shut down digital wings" is dramatic, but the underlying anxiety is legitimate. The DPDP Act, unlike the GDPR, contains no journalistic exemption. The GDPR's Article 85 explicitly requires member states to reconcile data protection with freedom of expression, including journalistic processing. The Srikrishna Committee's 2018 draft bill had proposed a similar carve-out. Its absence from the final 2023 Act was a deliberate legislative choice — and one that now faces constitutional scrutiny against Article 19(1)(a).

The IT Minister's statement on 29 October that he is "open to suggestions from the media" is politically soothing but legally hollow. Once the Supreme Court has issued notice, the question is no longer what the executive will concede — it is what the Constitution demands.

The Removal of Difficulties Order: Telling, If Modest

The DPDP (Removal of Difficulties) Order, 2026, notified on 5 October, is a small instrument with outsized significance. Two clarifications matter for practitioners. First, it addresses consent mechanics for persons with disabilities — an area where Section 9's guardianship provisions had created genuine confusion about who consents, and how. Second, it substitutes "audit" with "data audit" in the Significant Data Fiduciary (SDF) framework under Section 10, aligning the text with the existing requirement to appoint an independent data auditor.

That MeitY had to resort to a Section 44 Removal of Difficulties Order — a provision meant for transitional hiccups, not substantive repair — within months of the Rules being notified tells us something uncomfortable: the DPDP framework was drafted for speed, not precision. Expect more such orders. Each one is also a litigation risk, since removal-of-difficulties orders cannot amend the parent Act's substance, and any clarification that reads like an amendment is vulnerable to challenge.

The State as Data Fiduciary: The Compliance Clock Ticks

The 20 August Cabinet Secretary letter — reported in October — directing Union ministries, State governments and Union Territories to map personal data processing, designate senior officers, and review notices, safeguards, third-party arrangements and grievance mechanisms, is arguably the most consequential development of all. The Indian state is the country's largest data fiduciary. Aadhaar, GSTN, DigiLocker, Ayushman Bharat, APAAR student IDs — every one of these is a processing operation of staggering scale.

The Supreme Court's parallel engagement with APAAR consent forms — including a direction to consider an opt-out option in student consent — shows how the abstract architecture of Section 6 collides with ground reality. Can consent ever be "free" when the counterparty is the state, and refusal means exclusion from education or welfare? The Puttaswamy majority warned precisely about this: consent extracted under the shadow of entitlement denial is no consent at all.

What This Means for Practice

Three concrete takeaways. First, with substantive obligations on Data Fiduciaries and Data Processors taking effect on 13 May 2027, the notice-and-consent infrastructure you build for clients now must anticipate the possibility that the Supreme Court reads in a journalistic or public-interest carve-out — build modular consent flows, not monolithic ones. Second, media and content clients need interim risk-mitigation strategies: document legitimate-use analyses under Section 7 meticulously, because that residual provision is where the press will live until the Court rules. Third, government-facing vendors should treat the Cabinet Secretary directive as a procurement signal — data mapping, audit readiness and grievance-mechanism capability will shortly become tender prerequisites.

The deeper point is this: the DPDP Act was sold as a simple, business-friendly statute. Simplicity, however, has a constitutional price. The coming months will determine whether India's data protection regime can accommodate the press, restrain the state, and still function — or whether the Supreme Court will have to do the drafting Parliament declined to.