The Compliance Trap: Supreme Court Refuses DPDP Stay While Delhi HC Drops an AI ‘Fair Dealing’ Bombshell

For Indian tech and IP lawyers, 2026 has rapidly become a year of jurisprudential whiplash. If you have been advising clients to hit the snooze button on Digital Personal Data Protection (DPDP) Act compliance while waiting for the Supreme Court to sort out the constitutional challenges, it is time to wake up and draft those data-mapping strategies.

In a flurry of recent developments, the Supreme Court has made one thing abundantly clear: there will be no stay on the DPDP Act’s operation, even as fundamental questions about its constitutional validity are referred to a larger bench. Simultaneously, the Delhi High Court has fundamentally altered the Indian copyright landscape regarding Artificial Intelligence.

Here is why these developments matter for your practice, and how you need to pivot your advisory strategies immediately.

The DPDP vs. RTI Showdown: Schrödinger’s Statute

The Supreme Court is currently hearing a batch of writ petitions—spearheaded by The Reporters Collective and the National Campaign for People’s Right to Information—challenging Section 44(3) of the DPDP Act. For the uninitiated, this is the controversial provision that amends Section 8(1)(j) of the Right to Information (RTI) Act, effectively creating a blanket exemption for the disclosure of "personal information" by the state.

The petitioners correctly argue that this eviscerates the RTI Act, shielding bureaucratic machinery from public scrutiny under the guise of privacy. Recognizing the gravity of this transparency-versus-privacy clash, the Supreme Court has referred the matter to a larger bench. However, the Court categorically refused to grant interim relief against the masking or deletion of already-available data.

"The refusal to grant a stay is the most critical takeaway for corporate practitioners. The DPDP Act, operationalized via the November 2025 Rules, is live ammunition."

Practice Note: You can no longer rely on the pendency of constitutional challenges to delay compliance. Your Data Fiduciary clients must proceed as if the Act is set in stone. The boundary between "public data" and "personal data" is now the primary battleground. If your client scrapes or processes publicly available data, you need to urgently audit whether that data was made publicly available by the Data Principal themselves—the only narrow exception under the Act.

The EdTech Reckoning: APAAR and Section 9

If you represent educational institutions or EdTech companies, the Supreme Court’s recent intervention in the APAAR (Automated Permanent Academic Account Registry) Scheme litigation is a massive red flag.

The Court held that the collection, processing, and retention of student data under APAAR squarely attracts the DPDP Act. More importantly, focusing on Section 9 (Processing of personal data of children), the Court mandated that consent forms must include a clear opt-out mechanism for parents and guardians.

Practice Note: The era of "take-it-or-leave-it" bundled consent in India is dead. The Supreme Court is strictly interpreting "meaningful and informed" consent. You must immediately review your clients' Terms of Service and Privacy Policies. If a minor's data is involved, verifiable parental consent mechanisms cannot be passive; they require active, granular opt-in and easily accessible opt-out architectures.

The Enforcement Paradox: Rules Without a Board

While the substantive law is biting hard, the procedural machinery is staggering. The DPDP Rules 2025 were finalized in November, setting the clock ticking for Consent Managers (with Rule 4 obligations expected to bite by November 2026). Yet, mid-2026 commentary highlights a glaring administrative failure: the Data Protection Board (DPB) is still not fully staffed.

This creates a bizarre regulatory vacuum. Businesses are legally bound to report data breaches and manage consent architectures under Section 8(5), but the adjudicatory body meant to penalize non-compliance is effectively a ghost ship. Do not let your clients mistake this administrative delay for a compliance holiday. When the DPB is finally constituted, expect it to bare its teeth early to establish authority. Retrospective scrutiny of 2026 data practices is highly probable.

The IP Earthquake: AI Training as "Fair Dealing"

While privacy lawyers are scrambling, IP practitioners just had their world rocked by the Delhi High Court. In a landmark interim development, the Court held prima facie that OpenAI’s use of ANI’s literary works for training its Large Language Models (LLMs) falls within the ambit of Section 52(1)(a) of the Copyright Act, 1957.

Section 52(1)(a) protects "fair dealing" with any work for the purposes of private or personal use, including research. By extending this to commercial algorithmic training, the Delhi High Court has essentially imported a broad, US-style "fair use" defense for AI into Indian jurisprudence.

Practice Note: This is a paradigm shift. If you represent publishers, news agencies, or content creators, traditional copyright infringement notices against AI scrapers just lost their primary sting. You must now pivot to contract law—enforcing strict anti-scraping clauses in Terms of Use and deploying technological protection measures (TPMs). Conversely, if you represent AI developers, this ruling is your golden shield, though you must carefully frame your data-mining processes as "research" to stay within the Section 52(1)(a) safe harbor.

The Verdict

The intersection of IP and data protection in India has never been more volatile. We are witnessing a paradoxical legal environment where the state aggressively mandates privacy compliance without providing the regulatory infrastructure, while simultaneously adopting a highly liberal approach to AI copyright infringement. For the Indian tech lawyer, the mandate is clear: draft defensively for data protection, but litigate aggressively for IP.