No Stay, No Delay: The Supreme Court's DPDP Referral Forces India Inc. to Swallow the Privacy Pill Now

The Constitutional Tightrope: Implementation Without Suspension

The defining technology law development of 2026 has arrived with a sharp judicial mandate: the Digital Personal Data Protection (DPDP) Act, 2023 is here, it is live, and there is no hiding behind pending litigation. The Supreme Court's recent decision to refer challenges against the DPDP Act and the newly minted DPDP Rules, 2025 to a five-judge Constitution Bench—while categorically refusing to stay the law’s operation—has obliterated the "wait and watch" strategy favored by many corporate general counsels.

While the apex court acknowledged that there are "some creases to be ironed out," the refusal to suspend the Act means that India's first comprehensive privacy regime is entirely enforceable right now. For practicing lawyers, this creates a high-stakes regulatory tightrope. You must advise clients to overhaul their data architecture to comply with a law that might be fundamentally rewritten by a Constitution Bench under Article 145(3) of the Constitution.

The RTI Conundrum: A Shield for the State?

The primary catalyst for the Supreme Court's referral is the profound tension between privacy and transparency, manifesting in the DPDP Act's surgical strike on the Right to Information (RTI) Act, 2005. Section 44(3) of the DPDP Act amends Section 8(1)(j) of the RTI Act. Previously, the RTI Act allowed the disclosure of personal information if the Public Information Officer (PIO) determined that the larger public interest justified it. The DPDP Act entirely deletes this public interest override, creating a blanket exemption for anything classified as "personal information."

"By removing the public interest test, the DPDP Act effectively weaponizes privacy against accountability, allowing the state to reject uncomfortable RTI queries under the guise of data protection."

Practice Impact: Litigators should brace for an avalanche of writ petitions challenging PIO rejections. Public authorities are already using the amended Section 8(1)(j) as a blanket shield. Until the Constitution Bench delivers its verdict on whether this amendment satisfies the proportionality test laid down in K.S. Puttaswamy v. Union of India, lawyers representing journalists and civil rights groups will have to get creative, perhaps arguing that anonymized data or statistical aggregates do not trigger the DPDP exemption.

Shrinking Timelines for Data Fiduciaries

If the Supreme Court's refusal to grant a stay wasn't enough pressure, the executive branch is actively turning the screws. The Centre has notified the administrative rules necessary to operationalize the Act, and reports indicate that the Ministry of Electronics and Information Technology (MeitY) is considering compressing the transition period for large companies and Significant Data Fiduciaries (SDFs). The rationale? Large tech firms already adhere to global norms like the GDPR, so they don't need a multi-year runway in India.

Practice Impact: Corporate and tech lawyers must immediately shift from theoretical risk memos to operational drafting. The time to draft clear, itemized consent notices under Section 6 and build verifiable parental consent mechanisms under Section 9 is now. If your client is a consumer-facing tech platform, advising them to delay compliance because the Rules are "new" is professional malpractice. The penalties under the DPDP Act (up to INR 250 Crores) are not stayed.

AI Governance: Shoehorning the Future into Existing Law

Perhaps the most fascinating strategic pivot by the government in 2026 is its definitive stance on Artificial Intelligence. Rather than drafting a bespoke, sprawling "AI Act" akin to the European Union's approach, the Indian government has explicitly stated it will govern AI by relying on the DPDP Act and existing Intellectual Property (IP) laws.

This has massive implications for IP and Technology practitioners. India is adopting a privacy-and-platform governance model. When an AI model scrapes the Indian internet for training data, it isn't violating a hypothetical AI statute; it is potentially violating Section 8 of the DPDP Act (processing personal data without consent or legitimate use) and Section 14 of the Copyright Act, 1957.

Practice Impact: Tech lawyers must stop looking to the horizon for new AI regulations and start weaponizing existing statutes. For IP lawyers, Section 52(1)(a) of the Copyright Act (fair dealing) will become the primary battleground for AI litigation. Can a Large Language Model (LLM) claim "fair dealing" when ingesting copyrighted Indian news articles or literary works? Furthermore, if an AI generates deepfakes or hallucinates personal data, the DPDP Act's obligations regarding data accuracy (Section 8(8)) will be the primary tool for enforcement.

The Verdict for Practitioners

The legal landscape of 2026 demands agility. The Supreme Court has made it clear that while the constitutional validity of the DPDP Act's RTI amendments is up for debate, the compliance obligations for private entities are absolute and immediate. Furthermore, by linking AI governance directly to privacy and IP frameworks, the government has expanded the traditional scope of a data protection lawyer.

You are no longer just advising on "cookies" and "privacy policies." In 2026, DPDP compliance is indistinguishable from AI strategy and corporate risk management. The creases will eventually be ironed out by the Supreme Court, but until then, practitioners must ensure their clients don't get burnt by the iron.