The DPDP Act Grows Teeth in 2026: Why the Collision with RTI and AI is a Litigation Goldmine for Indian Practitioners

After nearly a year of lingering in a state of suspended animation, the Digital Personal Data Protection (DPDP) Act, 2023, has finally been operationalized. With the Ministry of Electronics and Information Technology (MeitY) officially notifying the DPDP Rules in early 2026, the era of theoretical privacy debates in India is over. We are now in the era of enforcement, compliance audits, and, inevitably, intense litigation.

But while corporate law firms are busy billing hours for DPDP compliance, the real action is happening in the constitutional and intellectual property courts. The operationalization of the DPDP Act has triggered a massive collision with two distinct areas of practice: the transparency regime under the Right to Information (RTI) Act, 2005, and the unruly frontier of Artificial Intelligence (AI) governance. For practicing advocates, this intersection is where the most lucrative and complex briefs of the next decade will be found.

The RTI vs. DPDP Deathmatch: Privacy as a Shield for Opacity?

The most consequential—and arguably dangerous—development is the ongoing constitutional challenge before the Supreme Court regarding Section 44(3) of the DPDP Act. This provision quietly but brutally amended Section 8(1)(j) of the RTI Act.

Prior to this amendment, personal information could be disclosed under the RTI Act if the Public Information Officer (PIO) determined that the larger public interest justified the disclosure. Crucially, the old proviso stated that information which cannot be denied to Parliament or a State Legislature cannot be denied to any person. Section 44(3) of the DPDP Act completely obliterated this public interest test, creating a blanket ban on the disclosure of any personal information.

"The legislature has engineered an absolute exemption. We are witnessing the weaponization of data privacy to dismantle the transparency framework that Indian citizens have relied upon for two decades."

The Kerala High Court recently took a rigid statutory interpretation, ruling that there is "no unrestricted Right to Information" merely because the legislature seeks it, effectively blessing the DPDP Act's supremacy over RTI access. However, the Supreme Court and the Delhi High Court are now examining Public Interest Litigations (PILs) challenging this very amendment. The Apex Court has explicitly noted it will examine the jurisprudential distinction between "public data" and "private data."

Why this matters for your practice: If you practice writ jurisdiction or handle administrative law, the days of easily accessing government service records, disciplinary proceedings, or beneficiary lists for your clients via RTI are over. Until the Supreme Court reads down this amendment or reinstates a "public interest" exception, expect PIOs to reject almost every RTI application citing the DPDP Act. Prepare to draft writs challenging these rejections on the grounds of Article 19(1)(a) of the Constitution.

The "No New AI Law" Cop-Out and the Section 8(5) Nightmare

In another critical development, the Government has made its stance on AI regulation clear: there will be no standalone AI Act for now. MeitY Secretary and other officials have indicated they will rely on existing frameworks, specifically the DPDP Act and the Copyright Act, 1957, to govern AI. This "wait-and-watch" approach is a massive headache for in-house counsel and IP litigators.

By forcing AI governance into the DPDP mold, the government has exposed a glaring blindspot regarding Section 8(5) of the DPDP Act. This section mandates that a Data Fiduciary must implement reasonable security safeguards to prevent personal data breaches. But what happens when an employee of your corporate client feeds proprietary company data or sensitive customer personal data into a public Generative AI tool like ChatGPT to summarize a contract or write code?

Under the current interpretation, this constitutes a data breach for which the employer (the Data Fiduciary) is strictly liable, facing penalties of up to ₹250 crores. Without a specific AI law delineating safe harbors or employee liability, companies are exposed to massive regulatory risk. Employment lawyers must urgently draft "Acceptable AI Use" policies, integrating them tightly with DPDP compliance frameworks.

The Stephen Thaler Deadline: Can a Machine be an Author?

Finally, the intellectual property bar is holding its breath as the Delhi High Court has issued a strict 8-week deadline to the Copyright Office to decide on a plea related to the infamous Stephen Thaler case. The core issue: Can AI-generated artwork be granted copyright protection in India?

Under Section 2(d) of the Copyright Act, 1957, an "author" is fundamentally presumed to be a human being (e.g., the person who draws the painting, writes the code, or takes the photograph). The Indian IP regime has long relied on the "sweat of the brow" and the "modicum of creativity" doctrines (as established in Eastern Book Company v. D.B. Modak), both of which inherently require human agency.

If the Copyright Office—under pressure from the Delhi High Court—interprets the law to allow AI ownership, it will upend decades of established IP jurisprudence. If it denies it, AI-generated content falls instantly into the public domain, rendering it commercially unviable for media and tech companies to protect their AI-generated assets.

The Takeaway: The year 2026 is the inflection point. The notification of the DPDP Rules is not just an administrative milestone; it is the catalyst for a fundamental rewriting of Indian technology, IP, and administrative law. Lawyers who still view privacy, IP, and AI as separate silos will quickly find themselves outmaneuvered in the courtroom. It is time to master the intersections.