The DPDP Act’s Constitutional Collision: Why the Supreme Court’s RTI Showdown Won’t Stop Your May 2027 Compliance Clock

The Illusion of a Judicial Reprieve

For corporate lawyers and tech counsel hoping the Supreme Court might pump the brakes on India’s privacy regime, the message from the apex court is unequivocally clear: the compliance clock is ticking, and a judicial stay is not coming to save you. As reported by LiveLaw, while the Supreme Court has referred the constitutional challenges against the Digital Personal Data Protection (DPDP) Act, 2023 to a larger bench, it has explicitly refused to stay the operation of the Act or the DPDP Rules, 2025.

This leaves practicing lawyers in a schizophrenic position. On one hand, litigators are gearing up for a generational constitutional battle over the right to information versus the right to privacy. On the other hand, transactional and tech lawyers must urgently overhaul their clients' data architectures before the substantive enforcement deadline of 13 May 2027. If you are advising tech platforms, waiting for the Supreme Court to resolve the constitutional friction is legal malpractice. The Data Protection Board of India (DPBI) has been operational since 13 November 2025, and it will not entertain "pending litigation" as a defense for non-compliance.

Weaponizing Privacy: The Section 8(1)(j) Flashpoint

The crux of the Supreme Court challenge—spearheaded by the Internet Freedom Foundation (SFLC), The Reporters’ Collective, and transparency activists—centers on Section 44(3) of the DPDP Act. This seemingly innocuous schedule amendment surgically alters Section 8(1)(j) of the Right to Information (RTI) Act, 2005.

Before the DPDP Act, Section 8(1)(j) exempted personal information from RTI disclosure unless the Public Information Officer (PIO) was satisfied that the larger public interest justified the disclosure. It contained a vital proviso: information which cannot be denied to the Parliament or a State Legislature shall not be denied to any person. It was a delicate, functional balance between privacy and accountability.

The DPDP Act detonated that balance. It amended Section 8(1)(j) to create an absolute, blanket exemption for any information relating to personal data. No public interest test. No proportionality.

"By removing the public interest override, the DPDP Act effectively weaponizes the fundamental right to privacy, transforming it into a bureaucratic shield against transparency. It is a statutory subversion of the RTI Act under the guise of data protection."

For litigators, this means your strategy in writ courts must shift. Mandamus petitions seeking public records will now routinely hit the DPDP wall. PIOs are already using the amended Section 8(1)(j) to reject requests regarding electoral rolls, bureaucratic appointments, and public tender beneficiaries. Until the larger bench decides whether this blanket exemption violates Article 19(1)(a) of the Constitution, lawyers must get creative, perhaps by arguing that public functionaries acting in their official capacity do not generate "personal data" in the first place.

The Jurisprudential Black Hole: Public vs. Personal Data

During the March 2026 hearings, the Supreme Court correctly identified the core jurisprudential quagmire: where is the boundary between "public data" and "personal data"?

Section 3(c)(ii) of the DPDP Act states that the law does not apply to personal data made publicly available by the Data Principal themselves or under a legal obligation. But in an era of massive data scraping by AI entities and tech platforms, this distinction is dangerously porous. If a citizen tweets their location, is that a permanent waiver of privacy for all commercial exploitation? Can an ed-tech platform scrape publicly available school board results to target minors?

The Supreme Court’s upcoming examination of this boundary will be the most significant privacy jurisprudence since Justice K.S. Puttaswamy v. Union of India. If the Court interprets "publicly available" broadly, it creates a massive loophole for data brokers. If interpreted narrowly, it threatens the operational model of open-source intelligence and AI training in India.

The Corporate Reality: Consent is Broken, and You Must Fix It

While the constitutional drama unfolds, tech counsel must face the music of the DPDP Rules 2025. The era of pre-ticked boxes and buried privacy policies is legally dead.

Under the new regime, consent must be free, specific, informed, unconditional, and unambiguous. More crucially, withdrawing consent must be as easy as giving it. As highlighted in recent SCC Online analyses, consent handling is becoming the primary compliance nightmare for tech platforms. If your client’s app requires users to navigate three different sub-menus to revoke data access, they are in direct violation of the Act.

Here is the practical roadmap lawyers must enforce for their corporate clients:

• Audit Data Flows Now: You cannot wait until 2027. Identify exactly what data is collected and map it to a specific, legitimate use. The days of "data hoarding for future monetization" are over.
• Redraft Consent Notices: The notice must be in English and all 22 languages in the Eighth Schedule of the Constitution. It must explicitly state what data is collected and why, with a clear option to decline.
• Prepare for Consent Managers: With registration for Consent Managers opening on 13 November 2026, tech platforms must build APIs to interface with these new intermediaries. This is not just a legal task; it requires deep collaboration with your client's engineering teams.

The Bottom Line

The DPDP Act is a flawed, heavily centralized piece of legislation that compromises the RTI Act and grants the Central Government excessive exemptive powers. But it is also the law of the land, backed by an active Data Protection Board and looming multi-crore penalties.

Litigators must prepare for a grueling fight before the larger bench to salvage the RTI Act. But for corporate practitioners, the Supreme Court’s refusal to grant a stay means the debate is over. Stop debating the law’s constitutional validity in boardrooms, and start drafting the compliance architecture. May 2027 is closer than it appears.