Ironing Out the Creases: Supreme Court Steps into the DPDP-RTI Collision as the Government Doubles Down on IP for AI

The Privacy Shield Cannot Be a Transparency Gag

For the past two years, public law practitioners and transparency activists have been sounding the alarm about a ticking time bomb hidden within the Digital Personal Data Protection (DPDP) Act, 2023. In February 2026, that bomb finally reached the Supreme Court. The apex court has rightly referred the constitutional challenge against the DPDP Act’s amendment of the Right to Information (RTI) Act, 2005 to a larger bench, noting that "some creases need to be ironed out."

To understand why this is the most critical public law development of the year, we must look at the mechanics of the amendment. Section 44(3) of the DPDP Act quietly severed the spine of the RTI Act by amending Section 8(1)(j). Before this amendment, personal information could still be disclosed under the RTI Act if the Public Information Officer (PIO) determined that the larger public interest justified the disclosure. The DPDP Act wiped out this public interest caveat entirely, replacing it with an absolute, blanket exemption for anything classified as "personal information."

"The legislature effectively weaponized a data privacy statute to build an impenetrable wall around bureaucratic transparency. A blanket ban on the disclosure of personal data, devoid of a public interest test, is fundamentally antithetical to a functioning democracy."

Practice Point: Crucially, the Supreme Court did not stay the operation of the DPDP Act. For writ lawyers and those advising public authorities, this means PIOs will continue to reject RTI applications seeking any personal data until the larger bench rules. Prepare for a surge in appellate litigation before Information Commissions testing the absolute boundaries of what constitutes "personal information" versus "public record."

DPDP Rules 2025: Consent is Now Legal Evidence

Coupled with the Supreme Court’s referral, the Centre has finally notified the Digital Personal Data Protection Rules, 2025, operationalizing the administrative machinery of the Act. For corporate commercial lawyers and in-house counsel, the grace period is officially over.

The days of relying on pre-ticked boxes and buried privacy policies are dead. Under the new regime, consent must be free, specific, informed, unconditional, and unambiguous. More importantly, the burden of proof lies squarely on your client—the Data Fiduciary.

If you are advising tech companies, e-commerce platforms, or even traditional businesses collecting user data, you must conduct an immediate UX/UI audit. Consent under the DPDP Act is no longer just a regulatory checkbox; it is a piece of legal evidence that must withstand scrutiny before the Data Protection Board. Unless retained under another specific statutory mandate (like RBI guidelines for banking records), the moment consent is withdrawn, the erasure protocol must be immediate and verifiable.

AI Regulation: The "Wait and Watch" Approach Prevails

In a refreshing departure from the global panic surrounding artificial intelligence, the Ministry of Electronics and IT (MeitY) has confirmed it will not introduce a bespoke AI regulatory framework right now. Instead of drafting a rigid, EU-style AI Act that could stifle homegrown tech at the crib, India will rely on the existing DPDP Act and Intellectual Property frameworks.

This is a major win for regulatory stability. However, it shifts a massive burden onto the shoulders of IP practitioners. If we are relying on existing laws, IP lawyers will have to creatively stretch the Copyright Act, 1957 and the Patents Act, 1970 to deal with AI-generated outputs, deepfakes, and algorithmic training data infringement. Expect heavy reliance on the doctrine of fair dealing and an influx of test cases examining whether an AI can be considered an "author" under Indian copyright jurisprudence.

DPIIT Rescues Virtual Designs: The Designs Act Overhaul

While AI gets a breather, traditional IP law is getting a much-needed 21st-century facelift. The Department for Promotion of Industry and Internal Trade (DPIIT) released its sweeping proposed amendments to the Designs Act, 2000 in January 2026, and they are a game-changer for tech lawyers.

For years, protecting Graphical User Interfaces (GUIs), icons, and AR/VR environments under Indian design law was an uphill battle, plagued by registry objections requiring a "physical article." The proposed amendments finally extend statutory protection to non-physical, virtual designs.

Key takeaways for IP practitioners include:

• Statutory Damages: Courts will now be empowered to award up to ₹50 lakh for wilful infringement. This is a massive shift from the nominal damages previously available, giving cease-and-desist notices real teeth.
• 12-Month Grace Period: The restrictive 6-month exhibition rule is being replaced by a 12-month grace period for online launches, saving startups that inadvertently publish their designs before filing.
• New Term Structure: The rigid 10+5 year term is shifting to a flexible 5+5+5 renewable model, allowing clients to drop protection (and fees) for fast-depreciating tech assets.

The Bottom Line

As we navigate the second half of 2026, the mandate for Indian lawyers is clear. Public law is bracing for a constitutional showdown between privacy (DPDP) and transparency (RTI). Meanwhile, corporate and IP practitioners must pivot from preparing for hypothetical AI laws to aggressively enforcing the newly fortified Designs Act and rigorously auditing DPDP consent architectures. The laws we have are finally being put to the test—make sure your practice is ready.