The DPDP Act is Bulletproof (For Now): SC Refuses Stay While Delhi HC Drops an AI Copyright Bombshell

The "Wait and Watch" Era is Officially Over

If your clients were banking on constitutional courts to hit the pause button on the Digital Personal Data Protection (DPDP) Act, 2023, it is time to wake them up. In a decisive move this week, the Supreme Court referred multiple challenges against the DPDP Act and the accompanying DPDP Rules, 2025 to a larger bench—but crucially, refused to grant any interim stay on the law's operation.

For practicing tech and privacy lawyers, the message from the apex court is unequivocal: the compliance clock is ticking, and the law is entirely in force while the jurisprudence gets hammered out in real-time. Compounding this regulatory whiplash, the Delhi High Court has simultaneously delivered a massive prima facie ruling on AI and copyright that threatens to upend how IP lawyers advise content creators in the age of Large Language Models (LLMs).

Section 44(3) and the Death of the RTI "Public Interest" Override

The most heavily contested battleground in the Supreme Court right now is Section 44(3) of the DPDP Act. This provision is not merely a privacy rule; it fundamentally alters the Right to Information (RTI) Act, 2005. By amending Section 8(1)(j) of the RTI Act, Section 44(3) effectively removes the "public interest" exception that previously allowed for the disclosure of personal information if the larger public interest justified it.

Petitioners correctly argue that this creates an impenetrable shield for public officials, masking data that was previously accessible. The Court's current focus on the demarcation between "public data" and "personal data" is critical. If publicly available data (like asset declarations of officials or publicly accessible registries) is treated with the exact same friction as private consumer data, the RTI Act loses its teeth.

The refusal to grant interim relief against the masking or deletion of already available data means that government departments are legally empowered—and arguably required—to scrub personal data from public domains immediately. For transparency activists and investigative journalists, this is a severe blow. For lawyers advising data fiduciaries, it reinforces the absolute supremacy of data masking protocols.

Implementation Realities: A Toothless Board and the 2026 Consent Manager Deadline

While the Supreme Court debates constitutional validity, the operational reality on the ground is a mess of phased timelines. The final DPDP Rules, 2025 (notified last November) have set a hard deadline for Rule 4 regarding Consent Manager registration for November 13, 2026. Yet, the Data Protection Board (DPB) of India, while technically constituted, remains a ghost town lacking an appointed Chairperson and Members.

This creates a dangerous paradox for corporate counsels. How do you advise a fintech or health-tech client on complex consent architecture when the regulatory body meant to oversee it is practically non-existent? The answer, as derived from the Supreme Court's recent ruling on the APAAR Scheme, is strict, conservative compliance. The Court held that the collection of student data under APAAR is squarely subject to the DPDP Act, signaling that state entities will not get a free pass under Section 17 exemptions unless explicitly notified. Private sector fiduciaries must act under the assumption that the DPB, once fully staffed, will enforce the law retrospectively.

The AI Curveball: Delhi HC Stretches "Fair Dealing" to its Limits

While privacy lawyers are scrambling, IP practitioners have their own crisis. In a landmark, albeit preliminary, ruling, the Delhi High Court has held that OpenAI's use of Asian News International's (ANI) copyrighted works for training its AI models prima facie falls under the "fair dealing" exception of Section 52(1)(a) of the Copyright Act, 1957.

This is a seismic development. Section 52(1)(a) permits fair dealing for "private or personal use, including research." To categorize the ingestion of millions of copyrighted articles by a multi-billion-dollar commercial entity to train a for-profit LLM as "research" stretches the statutory language to its absolute breaking point.

If this prima facie view holds in a final judgment, it will effectively neuter Indian copyright holders against global AI tech giants. Unlike the US, where the "fair use" doctrine is open-ended and currently being fiercely litigated in cases like New York Times v. OpenAI, India's "fair dealing" is an exhaustive, closed list. By shoehorning commercial AI training into the "research" exception, the Delhi High Court is making a profound policy choice that arguably belongs to the legislature.

The Takeaway for Practitioners

We are witnessing the rapid, messy collision of legacy statutes with frontier technology. Here is how you need to pivot your practice today:

• Stop waiting for regulatory clarity on DPDP: With no Supreme Court stay, you must audit your clients' data collection flows immediately. If they are scraping "public data," warn them that the public/personal distinction is currently a legal minefield.
• Prepare for Consent Managers: The November 2026 deadline for Rule 4 is approaching fast. Fintechs and account aggregators need to rebuild their UX to accommodate verifiable, revocable consent mechanisms now.
• Reassess IP Licensing Strategies: If you represent publishers, news agencies, or content creators, relying on traditional infringement suits against AI companies just got infinitely harder in India. You must immediately shift focus to technological counter-measures (like robust paywalls and anti-scraping `robots.txt` enforcement) and explore direct licensing agreements, because relying on Section 14 of the Copyright Act to protect against AI training is currently a losing bet in the Delhi High Court.

The tech law landscape in India isn't just shifting; it is undergoing tectonic deformation. Lawyers who wait for the dust to settle will find their clients buried underneath it.