Privacy as a Shield or a Fortress? The Supreme Court's 5-Judge Bench Tackles the DPDP Act as Corporate India Scrambles for May 2026

The intersection of privacy and transparency has always been a tightrope walk in Indian constitutional jurisprudence. But with the latest developments surrounding the Digital Personal Data Protection (DPDP) Act, 2023, that tightrope has effectively snapped. As the Supreme Court elevates challenges against the Act to a five-judge Constitution Bench, and the Ministry of Electronics and IT (MeitY) compresses the corporate compliance deadline to May 2026, Indian legal practitioners across the spectrum—from constitutional litigators to corporate advisory counsels—are staring at a seismic shift in practice.

Weaponizing Privacy: The Decimation of Section 8(1)(j)

The foremost constitutional crisis stemming from the DPDP Act isn't about how Big Tech harvests our data; it is about how the State is insulating itself from scrutiny. The Supreme Court has rightly taken notice of the public interest litigation (PIL) filed by the Mazdoor Kisan Shakti Sangathan (MKSS) and prominent transparency activists. At the heart of this challenge lies Section 44(3) of the DPDP Act.

For litigators and activists who have relied on the Right to Information (RTI) Act, 2005, Section 44(3) is nothing short of a statutory wrecking ball. It amends Section 8(1)(j) of the RTI Act, fundamentally altering the right to know. Previously, Section 8(1)(j) exempted personal information from disclosure unless the Public Information Officer (PIO) was satisfied that the larger public interest justified the disclosure. It incorporated a crucial constitutional proviso: information which cannot be denied to the Parliament or a State Legislature shall not be denied to any person.

The DPDP Act obliterates this nuance. It replaces the conditional exemption with a blanket ban on disclosing "personal information."

"By removing the public interest override, the DPDP Act weaponizes the fundamental Right to Privacy against the fundamental Right to Information. It gives public authorities an absolute veto to reject any RTI application that contains so much as a name or a designation."

Practice Implication: If you are standing counsel for a government department or public sector undertaking, your job just became significantly easier. You can now cite the amended Section 8(1)(j) to summarily dismiss RTI requests regarding bureaucratic appointments, beneficiary lists, or government tenders if they contain any "personal" identifiers. Conversely, if you represent whistleblowers, journalists, or civil rights groups, your primary evidentiary tool has been severely blunted. You will now have to frame your information requests with surgical precision to strip away any semblance of "personal data" to bypass this exemption.

The Constitution Bench and the Ghost of Puttaswamy

Recognizing the gravity of this clash between Article 19(1)(a) (Right to Information, as read into freedom of speech) and Article 21 (Right to Privacy), the Supreme Court has referred the batch of petitions to a five-judge Constitution Bench. However, the Court’s refusal to grant an interim stay on the contested provisions means the law is live, and the damage to transparency portals—like Rajasthan’s Jan Soochna Portal—is actively compounding.

When the Constitution Bench convenes, the primary metric of adjudication must be the proportionality test laid down in K.S. Puttaswamy v. Union of India. A blanket exemption on personal data disclosure without a "larger public interest" caveat clearly fails the necessity and proportionality prongs. As a legal community, we must critically ask: Did the legislature overreach by using a data protection statute to covertly amend a transparency law?

The Corporate Squeeze: The May 2026 Compliance Cliff

While constitutional lawyers duke it out in the apex court, corporate, tech, and IP practitioners are facing a chaotic reality on the ground. The DPDP Rules, notified on November 13, 2025, have triggered a compressed 14-month compliance countdown, ending squarely on May 13, 2026. MeitY’s decision to shave off the originally anticipated 18-month timeline to 12-14 months has sent shockwaves through boardrooms.

The ground reality is grim. Despite the ticking clock, most Global Capability Centres (GCCs) operating in India are floundering in the early stages of compliance.

What changes for corporate practitioners?

• HR Data is the Immediate Fire: GCCs and large corporations are realizing that their biggest liability isn't consumer data, but employee data. Employment contracts, HR policies, and intra-group data transfer agreements must be rewritten immediately to secure explicit, itemized consent under Section 6 of the DPDP Act.
• End of Boilerplate Clauses: Data protection can no longer be a standard two-line indemnity clause in commercial contracts. We are looking at comprehensive Data Processing Agreements (DPAs) detailing the obligations of Data Fiduciaries and Data Processors, breach notification protocols, and verifiable data deletion mechanisms.
• Sector-Specific Phasing: While the healthcare and insurance sectors—dealing inherently with sensitive health data—are reportedly eyeing a May 2027 full-implementation horizon, they are already being forced to embed "privacy-by-design" into their operational architecture today. Legal teams advising hospitals and insurers must aggressively audit data verification costs, which clients are already flagging as a major financial challenge.

The Bottom Line

The DPDP Act is currently operating as a paradox. For the State, it acts as an impenetrable shield against citizen accountability. For the private sector, it is a looming regulatory sword demanding rapid, expensive, and systemic operational overhauls. Whether the five-judge Constitution Bench will strike down Section 44(3) and restore the RTI Act's public interest override remains the most consequential legal question of the year. Until then, Indian lawyers have their work cut out for them—advising bewildered corporate clients on a compressed timeline, while navigating a deeply compromised transparency regime.