Schrödinger’s Privacy Law: Why the Supreme Court Must Cure the Asymmetry Between the DPDP Act and the RTI Act

The Great Indian Privacy Paradox

India’s Digital Personal Data Protection (DPDP) Act, 2023, is currently operating in a bizarre, asymmetrical reality. For the State, the Act is already a robust shield, weaponized to deny information under the Right to Information (RTI) Act. Yet, for citizens seeking to hold corporations accountable, the law remains largely a phantom, with substantive obligations suspended in a phased-rollout limbo.

This stark dichotomy has finally reached the apex court. In a defining moment for 2026, the Supreme Court has referred the constitutional challenges against the DPDP Act’s amendments to the RTI Act to a Constitution Bench. The core issue? A profound clash between the fundamental right to privacy (Article 21) and the fundamental right to know (Article 19(1)(a)). For practicing lawyers—whether you litigate constitutional law or draft commercial contracts—this friction is redefining the landscape of data governance in India.

Section 44(3): The Death of the Public Interest Test

To understand why the Supreme Court’s intervention is critical, we must dissect Section 44(3) of the DPDP Act. This provision quietly but aggressively amputated a vital limb of the RTI Act, 2005.

Prior to this amendment, Section 8(1)(j) of the RTI Act provided a nuanced balancing test. It exempted personal information from disclosure unless the Central Public Information Officer (CPIO) was satisfied that the larger public interest justified the disclosure. Crucially, it carried a powerful proviso: “Provided that the information, which cannot be denied to the Parliament or a State Legislature shall not be denied to any person.”

The DPDP Act obliterates this nuance. Section 44(3) amends Section 8(1)(j) to create a blanket exemption for any information that relates to "personal information." The public interest override is gone. The parliamentary proviso is gone.

"By stripping away the public interest test, the DPDP Act has transformed the RTI Act from a tool of democratic accountability into a fortress of bureaucratic secrecy. The State is effectively using a data protection law to protect itself, not the data principal."

The Supreme Court PIL challenging this exact deletion rightly seeks interim relief against the masking or deletion of available data. While the Court noted the "complex and constitutionally sensitive questions" at play, it crucially did not stay the amendment. This means CPIOs across the country are currently legally empowered to reject RTI queries involving any personal data, no matter the scale of corruption or public interest involved. Until the Constitution Bench rules, transparency practitioners must prepare for a wall of rejections.

Institutional Vacuum: The Kerala High Court Calls Bluff

While the Supreme Court tackles the constitutional theory, the High Courts are grappling with the practical void. The Kerala High Court’s recent handling of privacy issues tied to the Digi Yatra application perfectly illustrates the absurdity of a staggered rollout.

In a March 2026 order regarding passenger data collection via Digi Yatra, the Kerala High Court was forced to ask the Centre a basic, embarrassing question: Has the Data Protection Board (DPB) actually been constituted?

This exposes the crux of the enforcement problem. The government notified certain provisions (including the establishment of the Board) in November 2025, but the substantive obligations—consent architecture, breach notifications, and children’s data protection—are slated for enforcement only around May 2027. Furthermore, the Kerala High Court's indication that Aadhaar should not be mandatory for Digi Yatra if other ID exists shows that the judiciary is not waiting for the DPB. Courts are stepping into the regulatory vacuum, applying overarching principles of necessity and proportionality derived directly from the Puttaswamy judgment.

Corporate Practice: Drafting in the Dark

For transactional lawyers, in-house counsel, and tech advisors, the DPDP Act’s phased rollout is a massive headache. The cross-border transfer obligations under Section 16 and the corresponding Rule 15 are not yet live. The government hasn’t even published the "black-list" of restricted countries.

So, why are law firms and Global Capability Centres (GCCs) preemptively redrafting Data Processing Agreements (DPAs) and privacy notices in 2026?

Because waiting for May 2027 is commercial suicide. The compliance architecture required by the DPDP Act—specifically the verifiable, granular consent workflows and the ability to honor data principal rights (erasure, correction)—cannot be built overnight. Savvy practitioners are taking a defensive stance:

• Consent Workflows: Privacy notices are transitioning from static legal boilerplate to dynamic, auditable compliance documents. If your client uses WhatsApp chatbots or targeted Meta ads, the "opt-in" mechanism must be re-engineered now.
• Contractual Indemnities: Even without Section 16 being live, contracts are being updated to mirror GDPR-style standard contractual clauses (SCCs) to ensure data flows aren't disrupted when the axe finally falls.

The Path Forward

The DPDP Act is currently a paradox. It is potent enough to block RTI applications today, but toothless to penalize a corporate data breach tomorrow.

As the Constitution Bench prepares to hear the Section 44(3) challenge, litigators must watch closely. If the Supreme Court strikes down or reads down the RTI amendment, it will restore the public interest test, fundamentally shifting how the State handles public records. For corporate lawyers, the mandate is clear: do not mistake the absence of the Rules for the absence of risk. The regulatory vacuum is currently being filled by activist High Courts and anticipatory contract drafting. By the time May 2027 arrives, the unprepared will find themselves entirely boxed out of compliance.