The Supreme Court's DPDP Notice: Press Freedom's First Real Test Against India's Data Regime

The Constitutional Collision We've Been Waiting For

On 27 October 2026, the Supreme Court did something that should make every media lawyer and data protection practitioner sit up: it issued notice on the Digital News Publishers Association's challenge to the Digital Personal Data Protection Act, 2023 and the accompanying DPDP Rules, 2025. This isn't just another writ petition—it's the first substantive constitutional test of whether India's data protection framework can coexist with Article 19(1)(a) press freedoms.

The petition, backed by 21 digital news publishers including groups linked to the Adani and Ambani conglomerates, argues that the DPDP Act's consent architecture and data fiduciary obligations could fundamentally cripple investigative journalism. The Bench, while declining an interim stay without hearing the government, has set the stage for what promises to be the most significant media-law confrontation since Romesh Thappar v. State of Madras.

Why This Matters for Your Practice

If you're advising media clients, technology platforms, or any entity handling personal data, this litigation will define the operational boundaries of the DPDP Act for years. Here's what's at stake:

The Consent Conundrum: Section 4 of the DPDP Act requires consent for processing personal data, with limited exceptions. Journalists argue that investigative reporting—particularly sting operations or exposés based on leaked documents—cannot function if every data subject must consent to their information being processed. The Act's "legitimate uses" under Section 7 are narrow and don't explicitly carve out journalistic exemptions comparable to the EU's GDPR Article 85 derogations.

The Section 44 Problem: The petition specifically challenges provisions that could mandate masking or deletion of publicly available data. For news archives, court reporting, and public interest journalism, this is potentially existential. If the Data Protection Board of India can order removal of "personal data" from news databases without adequate press freedom safeguards, we're looking at retrospective censorship dressed up as privacy protection.

The government's response—that the DPDP Act doesn't impinge on press freedom—is politically convenient but legally untested. The IT Minister's willingness to consider "media suggestions" suggests the Centre knows the current drafting is vulnerable to constitutional challenge.

The Removal of Difficulties Order: A Telling Clarification

Days before the Supreme Court notice, MeitY issued the Digital Personal Data Protection (Removal of Difficulties) Order, 2026 on 6 October, clarifying that Section 10's reference to compliance obligations means a "data audit." This might seem like administrative housekeeping, but it reveals the government's recognition that the Act's drafting lacks precision—a weakness the DNPA petition will undoubtedly exploit.

The Order also addresses consent requirements for persons with disabilities, but conspicuously silent on journalistic exemptions. If the government genuinely believed the Act didn't affect press freedom, why not issue a clarification explicitly carving out journalism? The omission is telling.

The Compliance Clock Is Ticking

While the litigation unfolds, the compliance timeline hasn't stopped. Some DPDP provisions came into force on 13 November 2025, and the substantive obligations kick in from 13 May 2027. The Cabinet Secretary's 20 August 2026 letter directing ministries, states, and UTs to begin implementation planning means the bureaucratic machinery is already moving.

For practitioners, this creates a dangerous limbo: do you advise clients to restructure their data processing operations now, or wait to see if the Supreme Court carves out broader exemptions? My view: prepare for compliance but document every instance where DPDP obligations conflict with journalistic or public interest functions. If the Court does grant relief, you'll need evidence of actual or likely harm.

What Happens Next

The Centre's response will be crucial. If it files an affidavit claiming the Act doesn't affect journalism, expect the petitioners to counter with specific examples of how consent requirements, data minimisation principles (Section 8), and the Data Protection Board's powers (Section 27) would have blocked stories like the Panama Papers or the Pegasus investigation.

The Court will likely examine whether the DPDP Act's restrictions satisfy the proportionality test from Puttaswamy and Anuradha Bhasin. The government will argue that privacy is a fundamental right and the Act provides adequate safeguards. The petitioners will counter that press freedom is equally fundamental and the Act's chilling effect is impermissible.

My prediction: The Supreme Court won't strike down the DPDP Act wholesale, but it will read in a journalistic exemption or direct the government to frame rules protecting bona fide journalism. Anything less would be a betrayal of the Court's own free speech jurisprudence.

For now, if you're advising media clients, start mapping their data processing activities against DPDP requirements. Identify where consent is impossible, where data retention is essential for public interest, and where the Act's obligations are simply unworkable. That analysis will be your roadmap—whether for compliance or for joining the constitutional challenge.

The DPDP Act was always going to face this test. It's just arrived sooner than expected.