Supreme Court Issues Notice on DPDP Act as Government Details Three-Phase Rules Timeline

What Happened

On October 27, the Supreme Court issued a notice to the Union government regarding an application by 21 news publishers. The petitioners seek a stay on specific provisions of the Digital Personal Data Protection Act, 2023. Deccan Herald reported that the government concurrently outlined a three-phase implementation timeline for the DPDP Rules, 2025.

Phase I takes effect on November 13, 2025. Phase II begins in November 2026. Phase III activates in May 2027. This final phase operationalises compliance mechanics for data principal rights, privacy notices, and security mandates. Public sources indicate the government has not yet appointed the chairperson and members of the Data Protection Board of India to execute the law.

Does The DPDP Act Apply Here?

Section 3(a) of the Act applies to the processing of digital personal data within India. Media publishers process personal data for journalism, advertising, and subscriber management. Section 3(c)(ii) exempts personal data made publicly available by the Data Principal or under a legal obligation.

The current litigation tests whether standard journalistic research triggers strict fiduciary duties. Enterprises cannot claim a blanket exemption for public data. Defensibility requires proving the Data Principal actively chose to make the data public. General Counsel tracking this case face similar applicability questions for their own external data collection.

Legal Implications Under DPDP

Consent is the primary basis for processing, except where Section 7 legitimate uses apply. Under Phase III of the 2025 Rules, precise obligations for itemised notices and verifiable consent will take force. If news publishers are classified as standard Data Fiduciaries, they carry full liability for consent gathering and breach reporting.

A failure to secure valid legal grounds risks regulatory penalties. Legal teams structuring data vendor agreements face immediate pressure to allocate liability for these upcoming Phase III mechanics. Outside counsel spend will increase as enterprises audit their supply chain for compliance gaps.

Could This Happen To You

Large enterprises face similar regulatory exposure if they process scraped or third-party data without verified exemptions. If your organisation relies on externally sourced personal data, the Data Protection Board of India will demand evidence of your processing grounds.

Defensibility requires auditable logs showing data provenance. An adverse ruling against the publishers signals strict interpretations of applicability. You need to review your limitation of liability clauses and vendor indemnities to ensure your data supply chain covers DPDP penalty exposure.

What Companies Should Do In The Next 30 Days

1. Direct outside counsel to map existing data processing against the Section 3(c)(ii) public data exemption.

2. Review vendor contracts to update indemnity clauses for Phase I and Phase III rule implementations.

3. Draft a compliance budget targeting the deployment of consent management and verifiable notice mechanisms.

4. Evaluate automated compliance platforms that log consent trails to reduce manual review burdens.

What To Watch

The Supreme Court proceedings will define the boundaries of the public data exemption for all sectors. Watch for official appointments to the Data Protection Board of India, which transition the environment from planning to active enforcement. Companies should track the specific operational mechanics detailed in the upcoming phases of the DPDP Rules, 2025.

193 days remain until the 13 May 2027 hard deadline. General Counsel can assess their current readiness and contract defensibility using the free scan available at https://www.complydp.com/audit-preview.