The DPDP Act Hits the Supreme Court: Why the RTI Amendment is a Ticking Time Bomb and Compliance Can't Wait

The Collision of Article 19(1)(a) and Article 21

The honeymoon phase for India’s data privacy regime is officially over. As of February 2026, the Digital Personal Data Protection (DPDP) Act, 2023, operationalized by the newly minted DPDP Rules, 2025, has matured from a theoretical legislative framework into a live, heavily litigated compliance nightmare. On February 16, 2026, the Supreme Court issued notice on a batch of petitions challenging the vires of the DPDP Act and its Rules. Crucially, the apex court refused to stay the operation of the Act, sending a clear, unambiguous message to corporate India: the law is live, and enforcement is imminent.

For practicing lawyers, this Supreme Court development forces a bifurcation in legal strategy. On one hand, constitutional and public interest litigators are fighting to save the transparency regime. On the other, in-house counsel and corporate advisors are racing against compressed timelines to overhaul their clients' entire data architectures.

The RTI Amendment: Weaponizing Privacy Against Transparency?

The most consequential legal battle currently before the Supreme Court is the challenge to Section 44(3) of the DPDP Act. This seemingly innocuous provision wields a sledgehammer against India’s transparency framework by amending Section 8(1)(j) of the Right to Information (RTI) Act, 2005.

Before the DPDP Act, Section 8(1)(j) exempted personal information from disclosure unless the Public Information Officer (PIO) was satisfied that the "larger public interest justifies the disclosure of such information." It was a delicate, albeit frequently tested, balancing act between the right to know and the right to privacy.

The DPDP Act has obliterated this balance. Section 44(3) deletes the public interest caveat entirely. Personal information is now subject to a blanket exemption.

"By removing the 'larger public interest' test, the legislature has effectively weaponized the fundamental right to privacy recognized in Justice K.S. Puttaswamy v. Union of India to dismantle the fundamental right to information under Article 19(1)(a)."

This is why the Supreme Court’s decision to refer this specific friction point to a larger bench is monumental. For civil rights lawyers and journalists, the amendment threatens to draw an opaque curtain over government accountability, masking everything from electoral candidate disclosures to bureaucratic asset declarations. If the larger bench does not read down Section 44(3), the RTI Act risks becoming a paper tiger.

No Stay Granted: The Corporate Compliance Mandate

While the constitutional debate rages, the Supreme Court’s refusal to grant interim relief or stay the DPDP Rules, 2025, requires immediate attention from corporate and technology lawyers. You can no longer advise clients to "wait and see" what the judiciary does.

Since the rules were notified late last year, the compliance window has been rapidly closing. Banks, insurers, and fintechs are inherently data-heavy fiduciaries, and the new rules mandate a complete overhaul of how they process information. The days of bundled, pre-ticked consent forms buried in unreadable Terms of Service are dead.

Under the active DPDP regime, Data Fiduciaries must now ensure:

1. Unbundled, Granular Consent: Notices must be itemized, available in multiple languages, and provide a clear, accessible mechanism for users to withdraw consent.

2. Strict Data Minimization: You can only collect what is strictly necessary for the specified purpose. If a client’s app asks for microphone access when it only needs location data, they are now in direct violation of the Act.

3. Breach Notification SOPs: The Rules require immediate reporting of personal data breaches to both the Data Protection Board (DPB) and the affected Data Principals. If your corporate client does not have an automated breach-response protocol in place, they are exposed to crippling financial penalties (up to INR 250 Crores).

IP, Tech, and the AI Conundrum

For Intellectual Property and Technology lawyers, the operationalization of the DPDP Act in 2026 is fundamentally altering the advisory landscape, particularly concerning Artificial Intelligence and digital platforms.

Generative AI models rely heavily on scraping enormous datasets from the internet. Under the DPDP Act, public availability of data does not automatically extinguish the data principal's privacy rights, unless the data was made publicly available by the principal themselves for a specific purpose. AI companies operating in India are now caught in a severe compliance bind. How do you obtain explicit, itemized consent for a machine learning dataset containing millions of data points?

Furthermore, social media platforms (Significant Data Fiduciaries under the Act) are now burdened with appointing resident Data Protection Officers (DPOs) and conducting periodic Data Protection Impact Assessments (DPIAs). Advising these tech giants now requires a hybrid understanding of algorithmic architecture and statutory privacy obligations.

The Path Forward for Practitioners

The Supreme Court’s examination of the DPDP Act will likely dominate the legal headlines of 2026. However, the lack of a stay order is the real story for the practicing bar. The Data Protection Board is gearing up for enforcement, and the grace period for data fiduciaries is over.

If you represent corporate clients, your immediate deliverables are clear: audit their data flows, rewrite their privacy notices to meet the new statutory threshold, implement verifiable consent management tools, and establish robust breach-reporting mechanisms. The law is live, the stakes are existential, and compliance cannot wait for the Supreme Court's final gavel.