No Stay, But High Stakes: The DPDP Act Faces a Constitutional Showdown Over the Gutting of the RTI Act

The DPDP Act is Live, and the Litigation Floodgates Have Opened

For technology and privacy lawyers, the "wait and see" era is officially over. In February 2026, the Supreme Court issued notice on a batch of petitions challenging the constitutional validity of the Digital Personal Data Protection (DPDP) Act, 2023 and the newly notified DPDP Rules, 2025. But the apex court delivered a crucial caveat that should be ringing in the ears of every general counsel in India: there will be no stay on the operation of the law.

By referring the matter to a larger bench, the Supreme Court has acknowledged that India’s data protection framework rests on a precarious constitutional fault line. The central friction isn't just about corporate compliance; it is about the collision between the fundamental right to privacy recognized in K.S. Puttaswamy v. Union of India and the fundamental right to information.

The Elephant in the Room: Section 44(3) and the Death of the Public Interest Test

The most devastating critique of the DPDP Act—and the focal point of the current Supreme Court challenge—is Section 44(3). For practitioners dealing with administrative law and transparency, this section is a glaring red flag.

Section 44(3) amends Section 8(1)(j) of the Right to Information (RTI) Act, 2005. Under the old regime, personal information was exempt from RTI disclosure unless the Central Public Information Officer (CPIO) or the appellate authority was satisfied that the "larger public interest justifies the disclosure of such information." It was a delicate, necessary balancing act.

The DPDP Act takes a sledgehammer to this balance. It amends the RTI Act to create a blanket exemption for any information that relates to personal data, entirely deleting the public interest caveat.

"By removing the public interest override, the DPDP Act effectively weaponizes privacy to shield bureaucratic accountability. It transforms a shield for the citizen into a fortress for the State."

This is why, in April 2026, a separate Public Interest Litigation (PIL) sought urgent interim relief against the masking and deletion of data that was already available on public portals. The government’s knee-jerk reaction to DPDP compliance has been to scrub public databases clean, severely crippling journalistic and legal scrutiny of state actions. The Supreme Court is now tasked with defining the boundary between public data and private data—a distinction the DPDP Act dangerously ignores.

The State as a Data Fiduciary: The APAAR Scheme Ruling

If the government thought it could use the DPDP Act solely to regulate private tech giants while giving itself a free pass, the Supreme Court’s late July/August 2026 ruling on the APAAR Scheme (Automated Permanent Academic Account Registry) serves as a sharp wake-up call.

The Court categorically held that the collection, processing, storage, and sharing of student data under the APAAR Scheme are strictly subject to the DPDP Act. The state cannot casually disclose student information to private EdTech entities or third parties under the vague guise of "educational advancement."

This is a massive development for lawyers advising the EdTech sector and government contractors. The ruling confirms that the State and its instrumentalities are Data Fiduciaries under the Act, subject to the same rigorous consent and purpose-limitation frameworks as a private corporation. You cannot bypass the rights of the Data Principal (the citizen/student) without explicit legal sanction.

The Delhi High Court Broadside and "Regulatory Blind Spots"

While the Supreme Court grapples with the RTI clash, the Delhi High Court has issued notice to the Centre on a separate PIL challenging the sheer unchecked power granted to the executive under the DPDP Act.

The Delhi HC petition targets a massive chunk of the Act, including Sections 17 to 21, 23, 29, 33 to 37, and 44, alongside Rules 17–23. These provisions govern everything from the sweeping exemptions granted to state instrumentalities (Section 17) to the controversial appointment mechanism and powers of the Data Protection Board (DPB). Legal commentators have rightly pointed out a massive "regulatory blind spot" in India’s framework: the DPB lacks the structural independence required to effectively police the government, which happens to be the largest data fiduciary in the country.

What This Means for Practicing Lawyers

The Supreme Court's refusal to grant a stay dictates your immediate advisory strategy. You cannot tell your corporate clients to delay their compliance rollouts pending the outcome of the larger bench reference.

1. Compliance is Non-Negotiable Today: The DPB is constituted, the Rules are live, and the penalty provisions (up to ₹250 crores) are active. Data Fiduciaries must ensure their consent managers and notice mechanisms are fully operational. The pendency of constitutional challenges is not a valid defense against a DPB penalty.

2. Rethinking RTI Litigation: If you practice before the Central Information Commission (CIC) or High Courts on RTI matters, be prepared for CPIOs to routinely reject applications by citing Section 44(3) of the DPDP Act. Until the Supreme Court reads down this amendment or reinstates the public interest test, lawyers will have to craft ingenious arguments—likely relying on the assertion that the requested data does not meet the strict definitional threshold of "personal data" under Section 2(t) of the DPDP Act.

3. Audit Government Contracts: Following the APAAR ruling, any private entity receiving data from the government must audit the data-sharing agreement. If the government collected the data without verifiable consent for that specific downstream sharing, the private entity processing it is equally in the crosshairs.

The DPDP Act is currently the law of the land, but its soul is up for debate. For lawyers, navigating 2026 means building strict compliance architectures for clients while simultaneously preparing for a judicial rewrite of the law's most controversial provisions.