The DPDP Act Hits the Constitutional Wall: Why the Supreme Court's Scrutiny of the RTI Amendment Changes the Game for Practitioners

For the past three years, corporate law firms have built a cottage industry around compliance with the Digital Personal Data Protection (DPDP) Act, 2023. Boardrooms have been terrified by the prospect of Rs. 250 crore penalties, and the notification of the DPDP Rules in early 2025 only accelerated the panic. But as of June 2026, the foundational bedrock of this sweeping legislation is facing an existential crisis in the constitutional courts.

The Supreme Court and the Delhi High Court have both issued notices challenging the vires of the DPDP Act and its Rules. For practicing lawyers, this isn't just an academic constitutional law debate—it is a live landmine for every data fiduciary you advise, and a fundamental shift in how Intellectual Property (IP) and data privacy intersect in the age of AI.

Weaponizing Privacy to Dilute Transparency: The RTI Clash

The most consequential challenge currently before the Supreme Court targets Section 44(3) of the DPDP Act. This is the Trojan Horse provision that quietly amended Section 8(1)(j) of the Right to Information (RTI) Act, 2005.

Before this amendment, personal information of public officials could be disclosed under the RTI Act if the Central Public Information Officer (CPIO) was satisfied that the larger public interest justified the disclosure. It was a vital tool for investigative journalists and litigators pursuing anti-corruption cases. The DPDP Act obliterated this nuance. Section 44(3) imposes a near-total blanket ban on disclosing personal information, completely deleting the "public interest" carve-out.

"The Supreme Court's observation that it must examine the distinction between 'public data' and 'private data' cuts to the heart of the matter. We are witnessing the weaponization of data privacy to shield public servants from accountability."

Practice Implication: For writ practitioners and litigators, if the Supreme Court strikes down or reads down Section 44(3), the floodgates for RTI queries will reopen. Until then, expect public authorities to summarily reject any RTI application that tangentially touches upon the "personal data" of a public servant, citing the DPDP Act. Advise your clients to frame their RTI requests focusing strictly on administrative processes and financial outlays to bypass the Section 8(1)(j) blockade.

The Delhi High Court PIL: A Broadside on the Rules

Simultaneously, the Delhi High Court is hearing a sweeping PIL challenging over a dozen sections of the Act (including Sections 17-21, 33, 44) and Rules 17-23. The petitioner rightly points out the excessive delegation of powers to the executive and the lack of independent oversight in the Data Protection Board.

For corporate counsels, this creates a severe compliance headache. Do you advise clients to spend millions overhauling their IT infrastructure to comply with Rules 17-23, knowing the Delhi High Court might stay them?

The pragmatic answer is yes. The Rs. 250 crore penalty provision remains a sword of Damocles. Unless the courts explicitly stay the operation of the Rules, strict compliance is the only shield. However, lawyers drafting data processing agreements (DPAs) should immediately insert severability and "change of law" clauses that anticipate a judicial reading-down of the DPDP Rules.

The IP Pivot: Designs Act Enters the 21st Century

While data privacy dominates the headlines, a silent revolution has occurred in IP practice. In January 2026, the Department for Promotion of Industry and Internal Trade (DPIIT) finally addressed a massive lacuna in Indian IP law: the protection of Graphical User Interfaces (GUIs) and virtual designs.

Historically, under the Designs Act, 2000, a design had to be applied to a "tangible article." IP litigators had to engage in legal gymnastics to protect software interfaces, either shoehorning them under the Copyright Act (which protects the underlying code better than the visual output) or facing immediate rejections at the Patent Office.

The DPIIT's proposed amendments explicitly extend protection to GUIs, icons, animations, AR/VR interfaces, and typefaces—decoupling them from physical hardware.

Practice Implication: If you represent tech startups or software developers, your IP strategy needs an immediate overhaul. Do not rely solely on copyright for UI/UX protection anymore. Begin preparing design applications for virtual interfaces. This alignment with digital-first innovation makes the Indian IP regime highly lucrative for tech-focused law firms, providing a stronger, strictly liable statutory right against interface cloning.

The AI Blindspot: A Regulatory Cop-Out

The government's stance on Artificial Intelligence, articulated this month by MEITY, is a classic regulatory punt. The Centre insists it will rely on the existing DPDP Act and IP laws to govern AI, rather than drafting bespoke AI legislation.

This is intellectually lazy and practically dangerous. Relying on Section 8(5) of the DPDP Act to handle AI data breaches is insufficient. What happens when an employee inputs proprietary company code or a client's personal data into an enterprise AI tool? The DPDP Act regulates the "Data Fiduciary," but the boundaries of liability blur when third-party LLMs ingest this data for training.

Furthermore, under the Copyright Act, 1957, authorship requires a human creator (as established in cases analogous to Rupendra Kashyap v. Jiwan Publishing House). If the government relies purely on existing IP laws, AI-generated output remains in a legal vacuum, incapable of being copyrighted, yet fully capable of infringing existing copyrights.

The Bottom Line: 2026 is the year India's digital laws collide. The Supreme Court must decide if privacy overrides public transparency, while IP practitioners must navigate a new virtual design landscape. For lawyers, the days of operating in silos—being "just" an IP lawyer or "just" a privacy lawyer—are over. The successful practitioner must now seamlessly weave the DPDP Act, the RTI Act, and the Designs Act into a unified digital strategy for their clients.