Introduction
India’s Digital Personal Data Protection (DPDP) Act, 2023, is facing a significant legal challenge over its impact on privacy, press freedom, and access to information.
On 6 October 2026, a group of 21 news publishers reportedly filed a petition in the Supreme Court challenging provisions of the law. The publishers argue that certain requirements could affect investigative journalism, confidential sources, and the publication of news involving personal information.
The case raises important questions about how India should balance data privacy with freedom of expression and the public interest.
For businesses, the issue is also relevant because the DPDP framework introduces responsibilities for organisations that collect, use, store, or otherwise process digital personal data.
In this article, Derecho Consulting explains the DPDP Act challenge, the main concerns raised by the publishers, and the steps businesses can take to prepare for their data protection obligations.
What Is the DPDP Act Challenge?
The DPDP Act challenge concerns the constitutionality and practical impact of certain provisions of India’s data protection framework.
The Digital Personal Data Protection Act was enacted in 2023. The Digital Personal Data Protection Rules were notified in November 2025, with implementation scheduled in phases.
The law aims to protect individuals’ digital personal data and establish responsibilities for organisations that process it.
However, the publishers involved in the current challenge argue that some provisions do not adequately protect journalistic activities carried out in the public interest.
Their concerns include consent requirements, requests to erase personal data, and government powers to seek information from organisations.
The Supreme Court will need to consider the legal questions raised through the proceedings. Until a final decision is delivered, the petitioners’ arguments should not be treated as settled law.
Why Are News Publishers Challenging the DPDP Act?
The Digital News Publishers Association (DNPA) represents publishers that have raised concerns about how the law may affect journalism.
According to reports, the group includes major Indian media organisations and has challenged provisions that it believes could restrict investigative reporting.
The main concerns relate to three areas.
1. Consent Requirements and Investigative Journalism
The DPDP framework establishes rules for processing digital personal data, including requirements relating to consent where applicable.
Publishers argue that requiring journalists to seek consent from individuals who are the subjects of investigations could create practical difficulties.
For example, a journalist investigating alleged fraud might need to examine documents containing personal information. Notifying the subject in advance could, the publishers argue, allow evidence to be destroyed or witnesses to be intimidated.
The legal question is how data protection requirements should apply when personal information is processed for reporting in the public interest.
2. Data Erasure and Published News Reports
The DPDP framework provides individuals with rights relating to their personal data, including erasure in circumstances prescribed by the law.
The publishers argue that these provisions could create difficulties for news organisations if individuals request the removal of personal information contained in published reports.
For example, a person mentioned in a report about alleged corporate misconduct might seek the deletion of information associated with them.
The publishers are concerned that such requests could lead to factual reports being removed or substantially edited.
However, the actual legal outcome will depend on the provisions involved, their interpretation, and any applicable exemptions or safeguards.
3. Government Access to Information
Another concern relates to government powers to request information from organisations that process personal data.
The publishers argue that these powers could expose confidential journalistic sources or discourage whistleblowers from sharing information.
Confidential sources can play an important role in reporting corruption, corporate misconduct, and other matters of public interest.
The challenge raises questions about the safeguards needed when government information requests intersect with journalistic confidentiality.
How Could the DPDP Act Challenge Affect Businesses?
Although the case has attracted attention because of its potential impact on journalism, businesses should also monitor developments in India’s data protection framework.
The legal challenge does not automatically suspend the DPDP Act or remove existing compliance responsibilities.
Businesses should continue preparing for the provisions that apply to their operations.
Key areas to review include:
- Personal data collection: Identify the digital personal data your organisation collects and why it is needed.
- Consent and notices: Review how your business informs individuals about data processing and obtains consent where required.
- Data security: Implement reasonable safeguards to protect personal data against unauthorised access and breaches.
- Data retention: Establish appropriate retention and deletion procedures based on legal requirements and business needs.
- Individual rights: Prepare processes for handling applicable requests to access, correct, update, or erase personal data.
- Third-party services: Review how vendors and service providers handle personal data on your organisation’s behalf.
These steps can help businesses establish stronger data governance practices while the legal position continues to develop.
DPDP Act Compliance Checklist for Indian Businesses
Businesses should adopt a practical approach to data protection rather than waiting for every legal question to be resolved.
Use the following checklist to review your organisation’s readiness.
Step 1: Identify the Personal Data You Handle
List the personal data collected through websites, mobile applications, customer forms, employee records, and other digital systems.
Record why each category of data is required and who can access it.
Step 2: Review Privacy Notices
Check whether your privacy notices clearly explain the purpose of data collection and the relevant rights and choices available to individuals.
Update them where necessary to reflect applicable legal requirements.
Step 3: Review Consent Processes
Identify where consent is required and check that the process meets the applicable legal standards.
Avoid collecting more personal data than your organisation needs.
Step 4: Strengthen Data Security
Review access controls, authentication, backups, incident response procedures, and other security measures.
Make sure employees understand their responsibilities when handling personal information.
Step 5: Establish Retention and Deletion Procedures
Define how long different categories of personal data should be retained.
Create procedures for responding to applicable deletion requests while considering any legal retention obligations.
Step 6: Review Vendor Arrangements
Check contracts and data-handling practices involving cloud providers, marketing platforms, payroll services, and other vendors that process personal data.
Clarify responsibilities for security, incident reporting, and compliance.
Step 7: Monitor Legal Developments
Follow official notifications, regulatory guidance, and developments in the Supreme Court proceedings.
Review your compliance programme when a legal change affects your organisation’s obligations.
What Should Businesses Watch for Next?
Businesses should follow the outcome of the Supreme Court proceedings and any further regulatory clarification.
Several issues may be important as the case progresses.
The balance between privacy and public interest: The proceedings may clarify how competing legal interests should be considered in the context of the challenged provisions.
Journalistic protections: The case may examine whether additional safeguards are necessary for investigative reporting and confidential sources.
The scope of government powers: The proceedings may address questions concerning information requests and the safeguards applicable to them.
The implementation of data protection rules: Businesses should continue monitoring the phased implementation schedule and any official guidance affecting their obligations.
The final legal position will depend on the court’s decisions and any subsequent legislative or regulatory action.
How Derecho Consulting Can Help
Data protection requirements can affect several parts of a business, including marketing, customer service, human resources, technology, and vendor management.
Derecho Consulting provides insights into Indian legal developments, regulatory compliance, and business risk management.
Businesses reviewing their data protection practices should consider assessing the personal data they handle, updating relevant policies, reviewing vendor arrangements, and documenting their compliance processes.
A structured approach can help organisations identify gaps and respond more effectively to changes in the regulatory environment.
Businesses should seek appropriate professional advice when interpreting the law or applying it to specific circumstances.
Conclusion
The DPDP Act challenge has brought important questions about data privacy, press freedom, and public-interest reporting into focus.
The publishers argue that certain provisions could affect investigative journalism, data erasure requests, and the protection of confidential sources. These arguments remain subject to judicial consideration, and the final outcome may influence how the relevant provisions are interpreted.
For businesses, the challenge is a reason to monitor legal developments without assuming that current compliance obligations have been suspended.
Organisations should continue reviewing their data collection practices, consent processes, security safeguards, retention policies, and procedures for handling individual rights.
By staying informed and preparing early, businesses can strengthen their data governance practices and respond more effectively to India’s evolving regulatory framework.
Follow Derecho Consulting for practical updates on data protection, Indian law, and business compliance.
Disclaimer: This article is intended for general informational purposes only and does not constitute legal advice. The legal challenge and its outcome should be assessed using current court records and official notifications. Businesses should seek professional advice based on their specific circumstances.