Privacy as a Shield for State Secrecy: The Supreme Court’s DPDP-RTI Conundrum and India’s Phantom Data Board

The Collision of Privacy and Transparency

In the high-stakes arena of Indian technology and constitutional law, 2026 is shaping up to be the year we finally test the structural integrity of the Digital Personal Data Protection (DPDP) Act, 2023. The Supreme Court is currently seized of multiple petitions—spearheaded by The Reporters’ Collective and journalist Nitin Sethi—challenging the constitutional validity of the Act. But while the apex court has referred the matter to a larger bench and issued notices, it delivered a crucial blow to transparency advocates on February 16, 2026: it flatly refused to stay the operation of the DPDP Act.

For practicing lawyers, this isn't just an abstract constitutional debate. It is an immediate, practical nightmare. We are currently navigating a statutory regime that fundamentally alters the Right to Information (RTI) Act, 2005, overseen by a regulatory body that, as of mid-2026, practically does not exist.

Section 44(3): The Assassination of the Public Interest Test

The crux of the Supreme Court litigation lies in Section 44(3) of the DPDP Act. To understand why this matters, we must look at the mechanics of the amendment. Prior to the DPDP Act, Section 8(1)(j) of the RTI Act exempted personal information from disclosure unless the Central Public Information Officer (CPIO) was satisfied that the larger public interest justified the disclosure. It was a delicate, statutory balancing act between the right to know and the right to privacy, echoing the proportionality test laid down in K.S. Puttaswamy v. Union of India.

Section 44(3) takes a sledgehammer to this balance. It amends Section 8(1)(j) to create a blanket exemption for all personal information. The "public interest" override has been entirely deleted.

"By removing the public interest caveat, the State has effectively weaponized data privacy to shield itself from democratic accountability. What was designed to protect the citizen from the corporation is now protecting the State from the citizen."

During the March 12 and April 13 hearings, the Supreme Court indicated it would deeply examine this newly blurred boundary between "public data" and "private data." Petitioners have correctly pointed out that government departments are already retroactively masking and deleting publicly available data under the guise of DPDP compliance. For litigators handling RTI appeals, the landscape has radically shifted. You can no longer rely on the Girish Ramchandra Deshpande line of reasoning to argue that larger public interest mandates disclosure of a public servant's details. The statutory hook for that argument is simply gone.

Schrödinger’s Regulator: The Data Protection Board of India

While the Supreme Court wrestles with the constitutional fallout, corporate and tech lawyers are dealing with a farcical compliance reality. The Digital Personal Data Protection Rules, 2025, notified on November 13, 2025, brought the Data Protection Board of India (DPBI) framework into effect. Yet, as of mid-2026, the DPBI remains a phantom institution.

Despite ongoing nomination steps in May and June 2026, the Board has no appointed Chairperson and no Members. Let that sink in. We have a fully operational penal statute capable of levying fines up to ₹250 crore for data breaches, but the adjudicatory body responsible for overseeing breach intimation and non-compliance inquiries is completely unstaffed.

What This Means for Your Practice

The dissonance between the law on paper and the reality on the ground requires a highly strategic approach from legal practitioners:

1. Advising Data Fiduciaries in a Vacuum: Corporate lawyers must advise clients to act as if the DPBI is fully operational. Data breach intimation protocols must be strictly drafted and followed. If a breach occurs today, the lack of a seated Board is not a defense against statutory liability. Document every compliance measure diligently; when the Board is finally constituted, their first order of business will likely be a retrospective audit of high-profile breaches that occurred during this interim period.

2. The Consent Manager Bottleneck: The registration window for Consent Managers is expected to open in November 2026. Tech lawyers advising fintech, health-tech, and data aggregators need to prepare registration dossiers now. The technical architecture for verifiable consent must be built out before the window opens, as the backlog for approvals will be massive once the Board actually sits.

3. Litigating "Masked" Data: For media and public-interest litigators, the April 13 PIL seeking interim relief against the masking of already-available public data is the space to watch. If you are representing journalists or NGOs whose RTI requests are being summarily rejected under the amended Section 8(1)(j), your immediate remedy lies in writ jurisdiction under Article 226, challenging the specific rejection as an arbitrary application of the DPDP Act pending the Supreme Court's larger bench decision.

The Bottom Line

The Supreme Court's refusal to stay the DPDP Act means we are living in a legally schizophrenic moment. The State is aggressively enforcing the provisions that benefit its own secrecy (via the RTI amendments) while dragging its feet on the institutional machinery (the DPBI) required to protect citizens from corporate data exploitation.

Until the larger bench of the Supreme Court lays down the law on whether Section 44(3) survives the Puttaswamy proportionality test, lawyers must navigate a minefield where privacy is the ultimate trump card for the State, and compliance is a shot in the dark for the private sector. Prepare your clients for retroactive regulatory scrutiny, and don't expect the RTI machinery to yield useful corporate or governmental intelligence anytime soon.