The DPDP Act in Purgatory: A Ghost Board, a Constitutional Showdown, and the Looming 2027 Deadline

The Illusion of Regulatory Certainty

For technology and privacy lawyers advising corporate India, 2026 is shaping up to be a year of regulatory whiplash. Since the Digital Personal Data Protection (DPDP) Rules were notified on November 14, 2025, in-house counsels and law firms have been scrambling to build compliance frameworks. We now have a hard operational deadline: May 13, 2027, for data fiduciaries and processors to fall in line, with consent-manager registrations kicking off in mid-November 2026.

But there is a glaring, almost comical problem: Who exactly is going to enforce this?

As of late 2026, the Data Protection Board of India (DPBI)—the cornerstone regulatory body mandated under Section 18 of the DPDP Act—remains unappointed and essentially a ghost town. While the government drags its feet on constituting the Board, the Supreme Court of India is stepping into the vacuum, actively shaping India’s data jurisprudence and signaling that a lack of an administrative regulator will not excuse statutory breaches.

The Constitutional Showdown: RTI vs. Privacy

The most consequential development for public law and transparency practitioners is the Supreme Court’s recent decision to refer the DPDP-linked Right to Information (RTI) amendment to a five-judge Constitution Bench. On February 16, 2026, a bench led by Chief Justice Surya Kant issued notice on the challenge but crucially declined to stay the amendment.

Why does this matter for your practice?

Section 44(3) of the DPDP Act amended Section 8(1)(j) of the RTI Act, 2005. Previously, Section 8(1)(j) exempted personal information from disclosure unless the Central Public Information Officer (CPIO) was satisfied that the larger public interest justified the disclosure. The DPDP Act surgically removed this public interest caveat, creating a blanket exemption for all "personal information."

"The weaponization of privacy to defeat transparency is no longer a theoretical debate; it is the current statutory reality."

For litigators representing journalists, activists, or even corporate whistleblowers, this is a massive hurdle. Until the Constitution Bench decides whether this blanket ban violates Article 19(1)(a) (Right to Information) read with the Puttaswamy proportionality test, state agencies will continue to reject RTI applications citing the DPDP Act. Be prepared to advise clients that extracting any data containing personal identifiers from the State is virtually impossible right now without a direct writ petition.

The APAAR Ruling: A Warning Shot to Ed-Tech

While the Constitution Bench wrestles with public data, the Supreme Court has already laid down the law on private data sharing. In a critical ruling on the APAAR (Automated Permanent Academic Account Registry) student-data ecosystem, the Court clarified that all collection, processing, retention, and sharing of student data is strictly governed by the DPDP Act.

The Court categorically held that student information cannot be disclosed to private entities or third parties "except according to law." For corporate lawyers, this is a red flashing light.

If you represent Ed-Tech platforms, educational institutions, or data aggregators, you must immediately audit their data pipelines. Section 9 of the DPDP Act strictly regulates the processing of children's data, prohibiting tracking, behavioral monitoring, or targeted advertising directed at children. The APAAR ruling signals that courts will interpret "lawful processing" (Section 4) and "purpose limitation" with zero tolerance for ambiguity. Relying on vague, bundled consent clauses in Terms of Service agreements will no longer survive judicial scrutiny.

Navigating the Vacuum: Practice Pointers for 2026-2027

So, how do you advise a Data Fiduciary when the statutory Board doesn't exist, but the Supreme Court is actively enforcing privacy principles?

You advise them to act as if the regulator is already knocking on the door. The May 13, 2027 deadline for operational obligations is not a suggestion. Here is what technology and corporate lawyers need to execute immediately:

• Contract Repapering: Do not wait for the DPBI. Enterprise clients are already redrafting Data Processing Agreements (DPAs). You must ensure your contracts clearly delineate Data Fiduciaries from Data Processors, explicitly passing down statutory obligations and indemnities for data breaches.
• AI and Workplace Privacy: With the rise of AI tools in the workplace, employee data processing is a minefield. Scraping internal employee data to train local LLMs (Large Language Models) without explicit, granular consent is a DPDP violation waiting to happen. Update your corporate clients' HR policies to include specific AI-use and data-processing consent forms.
• Cross-Border Transfer Controls: While the full operational regime for cross-border transfers is pending, multinational corporations (GCCs) cannot wait. Start mapping data flows now. Ensure that data transferred out of India complies with the baseline "adequate protection" standards expected under the Act.

The Bottom Line

The government's failure to constitute the Data Protection Board is a dereliction of administrative duty, but it is not a get-out-of-jail-free card for corporate India. The Supreme Court's intervention in both the RTI amendment and the APAAR data sharing scheme proves that the judiciary is willing to enforce privacy rights directly under Article 21 and the DPDP statute.

Lawyers who advise their clients to delay compliance until the Board is formed are committing malpractice. The regulatory clock is ticking loudly toward May 2027. Draft the notices, map the data, and register the consent managers. By the time the Board finally takes its seats, the cost of non-compliance will already be too high.