The DPDP Act Heads to a Constitution Bench, But Corporate India’s Ticking Clock Won't Wait

The Constitutional Clash: Weaponizing Privacy Against Transparency

In a development that fundamentally pits the right to privacy against the right to know, the Supreme Court has referred the challenges against the Digital Personal Data Protection (DPDP) Act, 2023, and its 2025 Rules to a five-judge Constitution Bench. But for the practicing lawyer, the real headline isn't the reference itself—it is the Court's outright refusal to grant an interim stay on the legislation.

The core of the Public Interest Litigation (PIL) spearheaded by the Mazdoor Kisan Shakti Sangathan attacks Section 44(3) of the DPDP Act. For the uninitiated, this seemingly innocuous schedule entry carries a lethal payload for India's transparency regime. It amends Section 8(1)(j) of the Right to Information (RTI) Act, 2005. Previously, Section 8(1)(j) exempted personal information from disclosure unless the Public Information Officer (PIO) was satisfied that the larger public interest justified it. Crucially, it contained a proviso: information which cannot be denied to the Parliament or a State Legislature shall not be denied to any person.

The DPDP Act wipes this nuance off the statute books. By amending Section 8(1)(j) to blanketly exempt all "personal information," the legislature has effectively handed public officials an impenetrable shield.

"We are witnessing the weaponization of privacy. The amendment allows every bureaucrat to reject RTI requests regarding public resource allocation, MGNREGA muster rolls, or beneficiary lists by merely citing 'personal data'. It stands in direct contrast to the spirit of Article 19(1)(a)."

The petitioners are demanding retrospective restoration of the original Section 8(1)(j) and the protection of proactive disclosure mandates like Rajasthan’s Jan Soochna Portal. Under Articles 14, 19(1)(a), and 21, the Constitution Bench led by Chief Justice Surya Kant must now reconcile whether the state's obligation to protect data privacy under K.S. Puttaswamy can be legally engineered to extinguish statutory accountability.

No Interim Stay Means No Excuses for India Inc.

While constitutional scholars debate the RTI amendment, the Supreme Court’s refusal to stay the DPDP Act is a massive wake-up call for commercial and tech lawyers. The grace period is evaporating.

With the DPDP Rules notified in November 2025, the Ministry of Electronics and Information Technology (MeitY) has activated a truncated 12-month compliance window for major provisions. This creates a hard deadline of May 13, 2026. If you are advising Global Capability Centres (GCCs), hospitals, or insurance companies, the “wait and see” strategy is now tantamount to professional negligence.

Industry reports already indicate that most Indian GCCs and tech firms are scrambling in the early stages of compliance. The friction points are severe:

• Verifiable Consent: Consent under the DPDP Act is no longer a passive clickwrap checkbox. The Act treats it as a "continuing legal relationship." If your client relies on legacy databases built on bundled consent, that data becomes legally toxic after May 2026.
• Cost of Verification: Firms are flagging exorbitant costs in verifying data accuracy and managing the mechanics of consent withdrawal.
• Sectoral Conflicts: Healthcare and FinTech lawyers are struggling to reconcile the DPDP Act's data minimization principles with mandatory retention rules under RBI and National Medical Commission (NMC) guidelines.

Redrafting the Boilerplate: Practice Changes Today

What does this Supreme Court development mean for your daily practice? Immediate contract remediation. Commercial contracts drafted in 2025 will not survive the 2026 regulatory cliff.

If you are drafting a Master Service Agreement (MSA) or a Data Processing Agreement (DPA), standard GDPR-lite boilerplate is insufficient. You must now integrate DPDP-specific clauses dictating the roles of Data Fiduciaries and Data Processors. Your indemnities must explicitly cover breaches of the DPDP Act, and your breach notification mechanics must align with the forthcoming Data Protection Board (DPB) timelines, not just CERT-In's 6-hour rule.

Furthermore, cross-border data transfers are presently permitted conditionally, pending negative-list restrictions from the Central Government. Practitioners must build fallback clauses into their international tech agreements ensuring data localization pivots if the government suddenly blacklists a jurisdiction.

The NHRC Wildcard: A New Forum for Privacy Torts?

An equally critical, yet underreported, development is the National Human Rights Commission (NHRC) issuing notices over alleged DPDP violations by AI, social media, and edtech platforms.

This is a fascinating tactical shift. While the Data Protection Board (DPB) is still finding its feet, activists and aggrieved parties are weaponizing human rights forums. By framing data breaches and algorithmic biases as violations of the right to life and dignity under Article 21, litigants are bypassing statutory delays. Defense counsel for tech platforms must now prepare for multi-forum litigation—defending against the DPB for statutory non-compliance, and the NHRC for constitutional rights violations.

The Verdict for the Legal Fraternity

The Supreme Court’s reference to a Constitution Bench ensures that the jurisprudential battle over the DPDP Act will drag on for years. However, the refusal to grant a stay means the compliance battle must be fought today.

The amendment to the RTI Act is a genuine threat to democratic accountability, effectively legalizing opacity under the guise of privacy. We must watch the impending Constitution Bench hearings closely, as they will define the boundaries of Puttaswamy in the context of state transparency. But in the boardroom, the time for debate is over. The May 2026 deadline is real, and the legal profession must pivot from constitutional speculation to rigorous, operational compliance.