The DPDP Act is Now India’s De Facto AI Law: What the 2026 Shift Means for IP and Privacy Practices

For Indian tech and intellectual property lawyers, the regulatory landscape has just experienced a seismic shift. As of July 2026, the Centre has finally notified the administrative rules for the Digital Personal Data Protection (DPDP) Act, 2023. But mere compliance is no longer the headline. The real story for practitioners is how the DPDP Act is rapidly mutating to fill India’s legislative vacuums—becoming our default artificial intelligence regulator while simultaneously triggering a constitutional crisis over government transparency.

Here is why the latest developments matter for your practice, whether you are litigating constitutional writs or drafting AI vendor agreements.

The RTI Clash: A Statutory Bulldozer Goes to a Larger Bench

The Supreme Court has recently refused to stay the DPDP Act, but in a critical move, it referred pleas challenging the Act’s amendment of the Right to Information (RTI) Act, 2005 to a larger bench. The Apex Court rightly noted that "some creases need to be ironed out."

At the heart of the dispute is Section 44(3) of the DPDP Act, which amends Section 8(1)(j) of the RTI Act. Previously, Section 8(1)(j) protected personal information from RTI disclosure unless a larger public interest justified it. The DPDP Act’s amendment brutally severs this "public interest" carve-out, imposing an almost blanket ban on the disclosure of personal information.

The erasure of the public interest exemption elevates data privacy to an absolute right, fundamentally crippling investigative journalism and citizen-led accountability. This is a direct friction point with Article 19(1)(a) (freedom of speech and expression) and Article 21 (right to life).

Practice Note: For litigators handling public interest litigations (PILs) or advising media houses, this larger bench reference is the most crucial constitutional battle of 2026. Until the bench rules, government departments will aggressively use the amended Section 8(1)(j) to reject RTI queries. You must aggressively plead the unconstitutionality of this blanket ban in your writ petitions, relying on the doctrine of proportionality established in Puttaswamy.

No New AI Law: The Burden Shifts to IP Counsel

In June 2026, the Ministry of Electronics and IT (MeitY) Secretary made a definitive policy statement: the government will avoid drafting a bespoke AI law unless absolutely necessary. Instead, AI governance will be outsourced to existing frameworks—namely, the DPDP Act and the Copyright Act, 1957.

This "wait and see" approach forces a massive regulatory convergence. Tech lawyers hoping for a clean, European-style AI Act must now creatively stretch existing statutes to govern complex neural networks.

Practice Note: If your client's data is scraped to train a Large Language Model (LLM), you cannot sue under an "AI law." Instead, you must plead a Section 51 Copyright infringement (for unauthorized reproduction of literary/artistic works) coupled with a DPDP consent violation. IP teams must immediately audit their clients' software licenses and Terms of Service to explicitly prohibit automated scraping and AI-training usage.

Section 12 and the Nightmare of "Machine Unlearning"

The intersection of privacy and AI gets technically brutal when we look at Section 12 of the DPDP Act—the Right to Erasure. If a data principal invokes Section 12(3) and withdraws consent, data fiduciaries are legally bound to erase that personal data.

But how do you erase data that has already been baked into the weights and biases of an AI model? The tech industry's answer is "machine unlearning"—a process of retraining models to forget specific data points at the sample level.

This creates a fascinating, albeit chaotic, new sub-field for IP lawyers. If an AI model is forced to undergo machine unlearning to comply with a Section 12 DPDP notice, is the resulting retrained model a new derivative work? Do prior IP licenses granted for the original model remain valid?

Practice Note: Transactional lawyers drafting SaaS, cloud, or AI-vendor agreements can no longer rely on standard boilerplate indemnity clauses. You must draft specific "Machine Unlearning and Section 12 Compliance" clauses. Vendors must explicitly indemnify your clients against the costs of model retraining if a data principal successfully forces an erasure request.

Jurisdictional Tug-of-War: DPDP vs. US CLOUD Act

Finally, as the DPDP Act operationalizes, corporate counsel must navigate the clash between Indian data sovereignty and American extraterritoriality.

While Section 16 of the DPDP Act permits voluntary cross-border data transfers via a "negative list" approach, it remains terrifyingly silent on how Indian tech companies should handle involuntary extraterritorial demands. If a US law enforcement agency uses the US CLOUD Act to subpoena data held by an American cloud provider's servers in Bengaluru, the provider is caught in a legal crossfire. Complying with the US subpoena likely violates the DPDP Act’s consent architecture; refusing it invites US federal sanctions.

The Verdict: The DPDP Act is no longer a theoretical compliance checklist. In 2026, it is the bedrock of Indian technology law. Whether you are fighting for transparency under the RTI Act, defending copyright against AI scraping, or negotiating cloud agreements, mastering the DPDP Act is no longer optional—it is the baseline of modern legal practice.