Privacy Shield or State Cloak? The Supreme Court’s DPDP-RTI Showdown and the ₹50 Lakh Design Act Reboot

The Constitutional Collision: DPDP Act vs. RTI Transparency

As we navigate the legal landscape in July 2026, the honeymoon phase for India’s Digital Personal Data Protection (DPDP) Act, 2023, is officially over. While the Centre has finally notified the much-delayed administrative rules, the real battle is raging in the Supreme Court. The highest court’s recent decision to refer challenges against the DPDP-RTI amendment to a larger bench is the most consequential development for public law and privacy practitioners this year.

For context, we must look at Section 44(3) of the DPDP Act, which stealthily amended Section 8(1)(j) of the Right to Information (RTI) Act, 2005. Under the pre-DPDP regime, personal information could still be disclosed under the RTI Act if the Public Information Officer (PIO) determined that the larger public interest justified the disclosure. The DPDP Act obliterated this public interest carve-out, imposing an absolute, blanket ban on the disclosure of any personal information.

"We are witnessing a dangerous legislative overreach where a statute designed to restrict corporate surveillance is being weaponized to enforce bureaucratic opacity."

The Supreme Court rightly recognized the gravity of this constitutional bottleneck in February 2026, referring it to a larger bench. However, the refusal to grant an interim stay means practitioners representing journalists, whistleblowers, and civil rights groups are currently hitting a brick wall. Every PIO in the country is now reflexively citing the DPDP Act to reject RTI applications. If you are litigating a writ of mandamus for information disclosure, your immediate strategy must pivot to challenging the classification of the requested data as "personal data" under Section 2(t) of the DPDP Act, rather than arguing public interest.

The DPDP Rules 2025: Consent is Now UI/UX Law

With the notification of the Digital Personal Data Protection Rules, 2025, the operational mechanics of the DPDP Act are finally in place. For corporate and tech lawyers, the days of drafting endless, legalese-heavy privacy policies and hiding them behind a pre-checked box are dead.

The new rules strictly enforce Section 6 of the DPDP Act (Consent). The mandate is clear: consent withdrawal mechanisms must be as operationally feasible as giving consent. If your client allows a user to consent to data processing with a single click, withdrawing that consent cannot require a phone call to customer support or a five-page email.

Practice Note: Lawyers advising Data Fiduciaries must stop merely auditing legal text and start auditing UI/UX flows. If your client’s user interface employs "dark patterns" to discourage consent withdrawal, they are in direct violation of the DPDP Rules. You must work directly with product teams to map the data lifecycle and ensure the notice requirements are visibly and plainly met in all 22 Eighth Schedule languages, if mandated.

AI Regulation by Apathy?

In a move that will frustrate tech practitioners looking for regulatory certainty, the Ministry of Electronics and IT (MeitY) has indicated it will not introduce new AI-specific legislation. Instead, the government intends to govern Artificial Intelligence through the existing DPDP Act and Intellectual Property frameworks.

While MeitY frames this as an "innovation-friendly" approach, it is practically a cop-out that kicks the jurisprudential can down the road. How exactly does the Copyright Act, 1957, govern generative AI? Section 2(d)(vi) of the Copyright Act attributes authorship of computer-generated works to the person who causes the work to be created. But when an AI model hallucinates a new piece of code or art based on billions of scraped parameters, who is the author? The prompter? The platform? The original creators of the training data?

By refusing to legislate a sui generis framework for AI, the government is forcing IP lawyers to rely on patchy, analog-era jurisprudence. Expect a massive uptick in copyright infringement suits testing the boundaries of "fair dealing" under Section 52 regarding AI training data.

The Designs Act Overhaul: ₹50 Lakh Statutory Damages and GUI Protection

While AI regulation stagnates, traditional IP is getting a massive, much-needed upgrade. The Department for Promotion of Industry and Internal Trade (DPIIT) proposed sweeping amendments to the Designs Act, 2000 in January 2026, dragging the archaic statute into the digital age.

For IP litigators and portfolio managers, three proposed changes fundamentally alter the practice:

1. Virtual Designs are Valid: Graphical User Interfaces (GUIs), icons, animations, and AR/VR interfaces will finally receive explicit statutory protection. Software companies will no longer have to shoehorn UI protection into copyright law.
2. The 5+5+5 Term: The old system of a 10-year term extendable by 5 years is being replaced by three renewable 5-year blocks. This aligns better with the fast-paced obsolescence of tech designs.
3. The Litigation Game-Changer: The proposal introduces statutory damages of up to ₹50 lakh for wilful infringement.

This last point cannot be overstated. Under Section 22 of the current Designs Act, statutory damages are capped at a paltry ₹25,000 per infringement (maximum ₹50,000). This made design infringement litigation commercially unviable for many MSMEs, as legal fees vastly outweighed potential recovery. A ₹50 lakh statutory damage provision gives the Designs Act real teeth. If enacted, IP practices should prepare for an explosion in design infringement notices, as the threat of litigation will suddenly carry massive financial leverage.

In summary, 2026 is shaping up to be a year of aggressive realignment. Data privacy is clashing with public transparency, AI is being left to the mercy of courts, and design law is finally becoming a lucrative litigation practice. Lawyers who adapt their advisory practices to the operational reality of tech—rather than just the text of the law—will dominate the market.