The DPDP Act Hits a Constitutional Wall: Supreme Court Scrutinizes the Death of RTI, While DPIIT Finally Modernizes Design Law

The Constitutional Collision: Privacy vs. Transparency

For practitioners navigating India's evolving tech-legal landscape, July 2026 marks a watershed moment. The Digital Personal Data Protection (DPDP) Act, 2023, is facing its first existential crisis at the Supreme Court, and the stakes could not be higher. In April, the apex court issued notice to the Central Government, escalating a challenge against the DPDP Act and the 2025 Rules to a Constitution Bench. The core issue? The quiet, backdoor assassination of the Right to Information (RTI) Act, 2005.

Practicing lawyers know that Section 8(1)(j) of the RTI Act was always a delicate balancing act. It exempted personal information from disclosure unless the Central Public Information Officer (CPIO) was satisfied that the larger public interest justified the disclosure. It also contained a powerful proviso: information that cannot be denied to Parliament cannot be denied to a citizen.

Enter Section 44(3) of the DPDP Act. In a sweeping legislative stroke, it amended the RTI Act to create a blanket ban on the disclosure of any personal information, completely deleting the "public interest" override.

"The DPDP Act's amendment to the RTI Act essentially weaponizes privacy to enable bureaucratic stonewalling. By removing the public interest caveat, the State has insulated itself from accountability under the guise of data protection."

This is not just a theoretical debate; it fundamentally alters administrative law practice. Lawyers filing RTIs to uncover corruption, scrutinize public appointments, or investigate tender allocations will now face standard, unappealable rejections citing "personal data." The Supreme Court's decision to treat this as a "serious and substantial" constitutional matter pitting the right to privacy (Justice K.S. Puttaswamy v. Union of India) against the fundamental right to free speech and information (Article 19(1)(a)) will dictate the future of transparency in India.

Operational Chaos and the TDSAT Problem

While the Supreme Court tackles the RTI conflict, the Delhi High Court is hearing a comprehensive Public Interest Litigation (PIL) challenging nearly every operational pillar of the DPDP Act (Sections 17 through 21, 33, 34, and 36). The petitioner correctly points out the creeping unconstitutionality of delegating excessive rule-making powers to the executive.

For corporate lawyers and in-house counsel, the phased enforcement slated for completion by May 2027 is already causing heartburn. We are seeing major banks like Yes Bank restructuring entirely to create dedicated Data Privacy Offices. However, the regulatory architecture is flawed. Recent commentary rightly points out that designating the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) as the appellate authority for data protection disputes is a jurisdictional mismatch. Asking a tribunal historically steeped in spectrum allocation and telecom tariffs to suddenly develop nuanced jurisprudence on algorithmic bias, data breaches, and consent artifacts is a recipe for poorly reasoned orders and endless Supreme Court appeals.

IP Modernization: The Designs Act Finally Enters the Digital Age

While data protection faces judicial pushback, Intellectual Property law is getting a desperately needed upgrade. The Department for Promotion of Industry and Internal Trade (DPIIT)'s January 2026 concept note for amending the Designs Act, 2000 is arguably the most significant IP development in a decade.

For IP prosecution and litigation teams, the current regime has been agonizing. Protecting Graphical User Interfaces (GUIs) required intellectual gymnastics, often forcing lawyers to rely on the ambiguous precedent set in Amazon Technologies or attempting to shoehorn UI elements into copyright law. The proposed amendments finally decouple eligible designs from a "tangible carrier," expressly extending statutory protection to virtual designs, GUIs, icons, AR/VR interfaces, and typefaces.

More importantly, the DPIIT is proposing two massive changes to enforcement and prosecution practice:

1. The 12-Month Grace Period: Previously, a startup demonstrating their prototype to investors or launching a beta version online effectively killed their own novelty, barring them from design registration under the strict 6-month exhibition rule. The proposed 12-month full grace period aligns India with global standards and protects innovators from their own early marketing.

2. Statutory Damages of ₹50 Lakh: Proving actual damages in design infringement is notoriously difficult. Introducing statutory damages up to ₹50 lakh for wilful infringement fundamentally shifts the leverage in cease-and-desist negotiations. Infringers can no longer hide behind the plaintiff's inability to quantify exact monetary loss.

The AI Blindspot: Government Defers to Existing Law

Despite these advancements, a glaring blindspot remains. The Ministry of Electronics and IT (MEITY) recently confirmed it will not draft specific Artificial Intelligence legislation, preferring to rely on existing frameworks. This approach creates immediate risks under Section 8(5) of the DPDP Act.

If an employee uses a generative AI tool to process client data, the Data Fiduciary remains strictly liable for the resulting data breach or IP leakage. By refusing to legislate on AI specifically, the government is forcing IP and tech lawyers to litigate 21st-century algorithmic disputes using 20th-century copyright concepts and a freshly embattled Data Protection Act.

The Takeaway for Practitioners: 2026 is the year of enforcement and constitutional reckoning. IP litigators should prepare clients for the incoming virtual design registrations and statutory damage claims, while tech lawyers must aggressively audit their clients' AI usage policies before the DPDP Act's enforcement guillotine drops in 2027.