Supreme Court Hears Press Freedom Challenge to DPDP Act

What happened

On October 26, 2026, 21 news outlets petitioned the Supreme Court of India challenging provisions of the Digital Personal Data Protection Act, 2023. The digital media industry argues the privacy law restricts news gathering and affects reporting on matters of public interest. The New Indian Express reported on October 31 that the Government of India responded to these concerns. On October 29, the government stated the Act does not curtail press freedom. They also indicated a willingness to amend the legislation if necessary.

Does the DPDP Act apply here?

Section 3 states the DPDP Act applies to digital personal data processed within the territory of India. The statute provides narrow exemptions. Section 3(c)(ii) excludes personal data made publicly available by the Data Principal or by someone under a legal obligation to do so. Journalists frequently process data that is not yet public. They also gather information on individuals who have not consented. For a General Counsel at an e-commerce enterprise, this legal challenge clarifies the limits of the public data exemption. Scraping digital information for marketing or user profiling does not automatically fall outside the Act unless the exact conditions of Section 3 are met.

Legal implications under DPDP

The Act lacks a specific exemption for journalistic purposes. Section 4 establishes that consent is the primary basis for processing, except where Section 7 legitimate uses apply. Newsrooms operating on tight deadlines find standard consent mechanisms unworkable. Under the DPDP Rules, 2025, obtaining valid consent requires an itemised notice. Rule 3 mandates translating these notices into up to 22 regional languages. If the government amends the law to introduce a media safe harbour, legal teams must track how these exemptions alter the baseline compliance standard. General Counsels will need to re-evaluate their limitation of liability clauses if the statutory requirements shift.

Could this happen to you

A newsroom fighting a data processing lawsuit mirrors a D2C brand facing regulatory scrutiny over bundled marketing and shipping consent. E-commerce platforms often assume publicly scraped data is safe to process. If a consumer files a complaint, the Data Protection Board of India will demand verifiable consent logs within 72 hours. Your outside counsel spend will escalate rapidly if you lack a structured evidence trail. Defensibility requires proving that your consent unbundling and multilingual notices comply fully with the notified rules. Failure exposes the enterprise to maximum penalties of Rs 250 crore.

What companies should do in the next 30 days

1. Legal heads must audit all public data collection practices against Section 3(c)(ii) exemptions.

2. Engineering teams need to implement a consent unbundler to separate shipping data requirements from marketing data processing.

3. Initiate privileged review of your current privacy notices to ensure they support Rule 3 translations across all operational languages.

4. Review vendor contracts for limitation of liability and indemnity clauses regarding data handling and breach response.

What to watch

Track the Supreme Court proceedings and any formal government drafts proposing amendments to the DPDP Act. Monitor regulator engagement patterns for early enforcement signals regarding consent validity and public data usage. Exactly 192 days remain until the DPDP hard compliance deadline of 13 May 2027. Legal teams can evaluate their readiness through the self-assessment tool at https://www.complydp.com/audit-preview.