DPDP at the Crossroads: SC’s Larger Bench Reference and the Vanishing Transparency Regime

The Constitutional Collision

The Supreme Court’s decision to refer challenges to Section 44(3) of the Digital Personal Data Protection Act, 2023 to a larger bench represents the most significant constitutional moment for India’s data protection regime since the Puttaswamy judgment. By characterising the issue as raising “complex and constitutionally sensitive questions,” the Court has signalled that the amendment to the Right to Information Act, 2005—effected through the DPDP Act—strikes at the heart of the privacy-transparency equilibrium that underpins our democratic framework.

The provision in question has effectively rewritten Section 8(1)(j) of the RTI Act, expanding the exemption for “personal information” to such an extent that it now operates as a near-absolute bar to disclosure. Where the original RTI framework permitted disclosure of personal information if public interest outweighed privacy concerns—a balancing test established in Girish Ramchandra Deshpande v. Central Information Commissioner (2013)—the DPDP amendment tilts the scales decisively toward opacity.

The Court’s refusal to stay the amendment, while admitting the petitions, creates a dangerous interregnum where the transparency regime stands diminished without constitutional validation. This is not merely procedural caution; it is a substantive erosion of the public’s right to know.

Why the Larger Bench Reference Matters

The reference to a larger bench is not routine. It suggests that a coordinate bench of the Supreme Court views the existing jurisprudence on privacy—particularly the Puttaswamy proportionality test—as potentially inadequate to address the specific conflict between statutory data protection and constitutional transparency. Practitioners should note that this opens the door for a re-examination of how Article 19(1)(a) rights to information interact with Article 21 privacy guarantees in the digital age.

The stakes extend far beyond academic interest. For litigators handling service matters, corruption investigations, or public procurement disputes, the RTI route has been the primary tool for obtaining documentary evidence of official misconduct. Section 44(3) now threatens to seal these records behind the “personal information” veil, potentially immunising errant officials from scrutiny under the guise of data protection.

The Enforcement Vacuum

While the constitutional validity of the RTI amendment hangs in balance, the executive machinery for data protection remains conspicuously absent. The Kerala High Court’s directive to operationalise the Data Protection Board of India within eight weeks—in the context of Digi Yatra biometric data litigation—highlights a troubling governance gap. The Board, envisaged as the primary enforcement authority under the DPDP Act, remains without a Chairperson or Members months after the DPDP Rules, 2025 were notified.

This vacancy is not merely administrative lag; it is a structural failure that leaves data principals without recourse and data fiduciaries without regulatory clarity. The Kerala HC’s intervention in the Digi Yatra matter—concerning the processing of passenger biometric data at airports—demonstrates that courts are increasingly unwilling to wait for the executive to constitute the Board before enforcing DPDP compliance. This judicial impatience should serve as a warning to entities relying on the “phased implementation” defence.

Education Data and the APAAR Precedent

The judicial assertion of DPDP supremacy is not limited to aviation. In a significant ruling on the Automated Permanent Academic Account Registry (APAAR) Scheme, courts have held that student personal data—encompassing collection, processing, storage, retention, and sharing—remains subject to the DPDP Act’s constraints. The explicit prohibition on disclosure to private entities except “according to law” establishes that even flagship government digitisation initiatives cannot circumvent the consent and purpose limitation principles embedded in the Act.

This has immediate implications for ed-tech companies and public-private partnerships in the education sector. The days of treating student data as a freely accessible resource for algorithmic training or commercial profiling are numbered. The APAAR judgment effectively extends the Puttaswamy privacy framework to the educational ecosystem, requiring data fiduciaries to demonstrate strict necessity and proportionality for any third-party data sharing.

The Compliance Timeline Illusion

Industry commentary suggests that the DPDP Rules, 2025 are being implemented in stages, with Consent Manager functionality expected by mid-November 2026 and the fuller substantive regime operational by May 2027. However, this timeline is creating a false sense of security among data fiduciaries. The Kerala High Court’s insistence on immediate DPDP compliance in Digi Yatra, and the Supreme Court’s refusal to stay Section 44(3), indicate that judicial enforcement is running ahead of the executive’s notified schedule.

Particularly problematic is the uncertainty surrounding cross-border data transfers. While Rule 15 purports to impose restrictions, Bar and Bench reports confirm these provisions are not yet live. Yet, law firms report that contracts are being redrafted as if the restrictions are already operative. This premature compliance is creating contractual rigidity without legal necessity, potentially hampering India’s $1 trillion digital economy ambitions.

Strategic Implications for Practice

For litigators, the immediate battleground is the RTI-DPDP interface. Until the larger bench pronounces on Section 44(3), expect increased litigation over what constitutes “personal information” in public records. The absence of the Data Protection Board means that constitutional courts will continue to exercise de facto appellate jurisdiction over data protection disputes, particularly in writ petitions challenging state data processing activities.

For corporate counsel, the Kerala HC’s eight-week deadline for Board constitution should be treated as a hard stop for compliance readiness. The Court’s scrutiny of Digi Yatra suggests that biometric data processing—whether in airports, educational institutions, or financial services—will face immediate judicial review if the Board remains non-functional. The “wait and watch” approach is no longer viable.

Finally, the fintech sector must reconcile the Account Aggregator-Consent Manager paradox highlighted in recent SCC Online commentary. With the RBI’s Account Aggregator framework already operational, the delayed DPDP Consent Manager requirements create conflicting compliance obligations. Entities should prepare for the possibility that the Supreme Court may read down Section 44(3) while simultaneously upholding stringent consent requirements for private data processing.

The larger bench reference is not merely a procedural detour; it is an opportunity for the Court to articulate a coherent constitutional theory of data protection that reconciles privacy with accountability. Until then, practitioners operate in a twilight zone where the transparency regime is diminished, the enforcement machinery is absent, and the only certainty is judicial intervention.