The DPDP Act Is Eating Indian Technology Law — And the Constitution Bench Won't Save You

The Privacy Pivot: Why IP Lawyers Need to Pay Attention

If you're an IP or technology lawyer still waiting for the next big patent ruling or trademark dispute to define 2026, you're looking in the wrong direction. The most consequential legal development for India's technology sector this year isn't coming from the Delhi High Court's IP Division—it's emerging from the constitutional collision between the Digital Personal Data Protection Act, 2023 and the Right to Information Act, 2005.

The Supreme Court's decision to refer the RTI-DPDP challenge to a five-judge Constitution Bench—while refusing to stay the contested amendment—signals that data governance has officially overtaken traditional intellectual property as the regulatory battleground for Indian tech. And frankly, it's about time the profession caught up.

Section 44(3): The Amendment That Swallowed Transparency

At the heart of the constitutional challenge lies Section 44(3) of the DPDP Act, which amended Section 8(1)(j) of the RTI Act to create what petitioners argue is an overbroad exemption for "personal information." The practical effect? Government departments can now refuse disclosure of information that was previously accessible if it relates to personal data—a category the DPDP Act defines expansively.

The Court's refusal to grant interim relief means this new regime is operative law right now. For practitioners, this creates immediate complications:

Due diligence just got harder. Corporate investigations, litigation discovery against government bodies, and transparency audits now face a statutory roadblock that didn't exist eighteen months ago. If your client needs information from a public authority that touches on personal data—which, in 2026, is most government-held information—expect resistance.

The Constitution Bench will eventually determine whether Parliament can use a data protection statute to dilute a transparency law. But until then, Section 44(3) is the law of the land, and it's already reshaping how lawyers approach information gathering in technology disputes.

The Enforcement Vacuum: A Board That Doesn't Exist

Here's where the story turns from constitutional theory to practical crisis. The Kerala High Court recently directed the Central Government to make the Data Protection Board of India functional within eight weeks—a PIL-driven intervention necessitated by privacy concerns around Digi Yatra and passenger data handling.

Read that again: the court had to order the government to create the enforcement body that Parliament mandated in 2023.

This isn't bureaucratic delay; it's an enforcement vacuum with teeth. The DPDP Rules, 2025 were notified on 13 November 2025, with a staggered implementation timeline:

• Administrative provisions: Already in force
• Consent Manager registration: Expected around 13 November 2026
• Substantive obligations for data fiduciaries: Full enforcement by 13 May 2027

But without a functioning Data Protection Board, who exactly is supposed to enforce these provisions? The Kerala High Court's intervention suggests the judiciary has lost patience with the executive's foot-dragging. For technology companies, this creates a perverse incentive structure: compliance deadlines are approaching, but the cop isn't on the beat yet.

Sectoral Shockwaves: From EdTech to FinTech

The DPDP Act's tentacles are already reaching into sectors that traditionally viewed data protection as someone else's problem. Consider the APAAR Scheme litigation, where courts clarified that student data collection, processing, storage, and sharing fall squarely within DPDP's ambit. Student information cannot be disclosed to private entities except in accordance with law.

This isn't just about education policy. It's a warning shot for:

• EdTech platforms building student profiles
• Identity verification systems handling biometric data
• FinTech companies navigating the Account Aggregator-Consent Manager paradox
• HealthTech providers managing sensitive personal data

The Consent Manager regime—expected to go live in November 2026—is already driving contractual redrafting across the technology sector. Cross-border data transfer provisions are forcing Global Capability Centres (GCCs) to reconcile Indian law with overlapping GDPR and other international privacy regimes. If your practice touches technology transactions, you're now a privacy lawyer whether you like it or not.

The IP Law Connection: Why This Matters for Traditional Practice

You might ask: what does data protection have to do with my patent prosecution or trademark enforcement practice? Everything.

Trade secrets and confidential information—the bread and butter of IP litigation—now intersect with DPDP's data localization and transfer restrictions. Employee data in IP-heavy industries triggers consent requirements. R&D databases containing personal information of researchers or trial participants create dual compliance obligations. Even IP enforcement investigations that involve personal data of infringers must now navigate DPDP's notice and consent architecture.

The traditional boundaries between IP, technology, and privacy law are collapsing. The lawyer who understands how Section 8(1)(j) of the RTI Act interacts with Section 44(3) of DPDP, and how both affect evidence gathering in IP disputes, will have a decisive advantage over the specialist who doesn't.

What Comes Next: The Constitution Bench and Beyond

The five-judge bench will eventually determine whether Parliament can use data protection as a Trojan horse to restrict transparency. But regardless of the constitutional outcome, the DPDP Act's implementation timeline is locked in. The Data Protection Board will become functional—if only because the Kerala High Court has ordered it. The Consent Manager regime will launch. The substantive obligations will become enforceable.

For Indian lawyers, the question isn't whether to engage with data protection law. It's whether you'll do so proactively or reactively. The Constitution Bench might restore some RTI transparency. But it won't stop the DPDP juggernaut.

The most significant technology law development of 2026 isn't about who owns intellectual property. It's about who controls personal data—and the answer is increasingly "the state, unless the Constitution Bench says otherwise."