Supreme Court Refuses DPDP Act Stay, Issues Notice on Challenge

• The Supreme Court refused to stay provisions of the Digital Personal Data Protection Act, 2023, and its 2025 Rules.
• This decision means the India data protection law will proceed without immediate judicial halt.
• The court issued notice on a petition filed by the Digital News Publishers Association.
• The association argued that the Act's provisions could negatively impact investigative journalism.
• All entities handling personal data in India must now prepare for compliance with the new regulations.

Lawyers and compliance officers must advise clients that the Digital Personal Data Protection Act, 2023, and its 2025 Rules are proceeding without a stay, necessitating immediate review of data handling practices to ensure compliance with the new regulations.

The Supreme Court of India recently declined to issue a stay on the contested clauses within the Digital Personal Data Protection Act, 2023, along with its associated 2025 Rules. This decision means that the comprehensive India data protection law will proceed without immediate judicial intervention to halt its implementation. The apex court did, however, acknowledge the gravity of the concerns raised by formally issuing a notice regarding the challenge.

This development stems from a petition brought forward by the Digital News Publishers Association. The organization initiated legal proceedings to contest specific aspects of the new legislation, arguing that certain provisions within the Digital Personal Data Protection Act, 2023, pose a significant threat to the practice of investigative journalism. The court's refusal to grant an interim stay indicates a cautious approach, allowing the legislative framework to advance while the legal merits of the challenge are considered.

The core of the legal challenge mounted by the Digital News Publishers Association centers on the potential for the Digital Personal Data Protection Act, 2023, to impede the vital function of investigative reporting. The association contends that particular provisions, which remain unspecified in the initial report but are the subject of their petition, could create an environment where journalists face undue restrictions or legal risks when gathering and disseminating information in the public interest. This argument highlights a tension between data privacy regulations and the constitutional guarantee of freedom of the press.

By issuing a notice, the Supreme Court has signaled that it will hear the arguments presented by the Digital News Publishers Association regarding the DPDP Act 2025 Rules challenge. This procedural step ensures that the concerns about the impact on investigative journalism will be thoroughly examined. However, the absence of a stay means that, for now, all entities, including news organizations, must prepare for compliance with the new data protection regime as it stands. The matter has been listed for further hearing on November 17, 2026.

The Supreme Court's decision not to stay the Digital Personal Data Protection Act, 2023, carries substantial weight for all organizations operating within India that handle personal data. This includes a vast array of businesses, technology companies, and media outlets. The immediate consequence is that the Digital Personal Data Protection Act 2023 and its 2025 Rules are proceeding without a stay, necessitating immediate review of data handling practices to ensure compliance with the new regulations. This means that the legal framework for data protection in India is moving forward, and entities must proactively adapt to its requirements.

Lawyers and compliance officers must advise clients that the Digital Personal Data Protection Act, 2023, and its 2025 Rules are proceeding without a stay, necessitating immediate review of data handling practices to ensure compliance with the new regulations. The refusal to grant an interim injunction underscores the judiciary's stance that the law should take effect while its constitutionality or specific provisions are debated. This creates an urgent imperative for all data fiduciaries to understand their obligations under this new India data protection law and to implement necessary changes to their data processing, storage, and consent mechanisms to avoid potential penalties once the Act is fully enforced.

Lawyers and compliance officers must advise clients that the Digital Personal Data Protection Act, 2023, and its 2025 Rules are proceeding without a stay, necessitating immediate review of data handling practices to ensure compliance with the new regulations.

Source: Original reporting via Law & Justice This Week