The DPDP Paradox: Constitutional Chaos Meets the November 2026 Consent Manager Clock

The DPDP Act is Under Fire, But the Compliance Train Has Left the Station

For Indian tech lawyers and corporate counsels, 2026 is shaping up to be a year of profound cognitive dissonance. On one hand, the foundational pillars of the Digital Personal Data Protection Act, 2023 (DPDP Act) are facing heavy constitutional fire in both the Supreme Court and the Delhi High Court. On the other hand, the compliance clock is ticking mercilessly toward the November 13, 2026 deadline for Consent Manager registration under Rule 4 of the DPDP Rules, 2025.

The Supreme Court’s recent refusal to stay the operation of the DPDP Act—even as it referred the highly controversial RTI amendments to a larger bench—sends a glaringly clear message to the Bar: Do not advise your clients to wait for constitutional clarity. The regulatory regime is live.

The RTI Amendment: Shielding Bureaucrats Under the Guise of Privacy?

The most consequential litigation currently before the Supreme Court concerns Section 44(3) of the DPDP Act, which severely amputates Section 8(1)(j) of the Right to Information Act, 2005. Previously, the RTI Act protected personal information unless a larger public interest justified its disclosure. The DPDP Act replaces this nuanced balancing test with a blanket exemption, prohibiting the disclosure of any personal data under the RTI Act.

By referring this to a larger bench, the Supreme Court has acknowledged the gravity of the issue. The amendment effectively weaponizes privacy to enforce state opacity. If an activist files an RTI to uncover corrupt beneficiaries of a government scheme, the State can now simply cite the DPDP Act and reject the application.

"The friction between the fundamental right to information (Article 19(1)(a)) and the fundamental right to privacy (Article 21) has reached a boiling point. But until the larger bench strikes it down, Section 44(3) remains the law of the land."

During these hearings, the Apex Court also touched upon the interpretive landmine of distinguishing "public data" from "personal data." For practitioners advising data scrapers, AI developers, and aggregators, this is the ballgame. Section 3(c)(ii) of the DPDP Act exempts personal data made publicly available by the Data Principal. But what constitutes "making it available"? The Court's eventual ruling here will dictate the future of LLM training data in India.

The November 2026 Milestone: Rule 4 and Consent Managers

While the constitutional debates rage, MeitY’s phased rollout of the DPDP Rules, 2025 (notified last November) is forcing the hands of Data Fiduciaries. The immediate operational crisis for tech lawyers is Rule 4, which governs the registration and technical obligations of Consent Managers, set to take effect on November 13, 2026.

A Consent Manager under the DPDP Act isn't just a pop-up banner; it is an interoperable platform registered with the Data Protection Board (DPBI) that allows Data Principals to give, manage, review, and withdraw consent through an accessible, transparent interface.

Practice Note: If your corporate clients are still relying on monolithic, pre-checked "Terms and Conditions" checkboxes, they are staring down the barrel of massive penalties. Enterprise compliance systems, WhatsApp chatbots, and employee AI-use policies must be re-architected now to integrate with these new Consent Manager APIs. Full enforceability hits on May 13, 2027, but the infrastructure must be in place by this November.

The Institutional Vacuum: A Regulator in Name Only

Here is where the government's approach warrants sharp criticism. As of mid-2026, the Data Protection Board of India (DPBI) exists primarily as a legal fiction. While the statutory body has been "established" in law, MeitY is still processing nominations for the Chairperson and Members.

It is regulatory malpractice to demand that a trillion-dollar digital economy overhaul its data architecture by November 2026 when the very Board supposed to register the Consent Managers, issue technical guidelines, and adjudicate disputes lacks its core leadership. Lawyers are currently advising clients in the dark, guessing at the technical standards the DPBI might eventually adopt.

Abhishek Baxi v. Union of India: The Courts Will Enforce Privacy

If you need proof that the judiciary won't wait for the DPBI to protect data rights, look no further than the Supreme Court’s recent decision in Abhishek Baxi v. Union of India. Dealing with the government's Automated Permanent Academic Account Registry (APAAR) for students, the Court came down heavily on the State's data collection practices.

The Court mandated that the amended APAAR consent form must include a clear opt-out clause for parents and guardians. More importantly, the Court explicitly tethered the entire lifecycle of APAAR student data to the DPDP Act framework, reinforcing Section 9 (obligations regarding children's data).

This ruling is a massive precedent for EdTech companies and private institutions. The Supreme Court established that student information cannot be shared with private entities outside the strict confines of the DPDP Act. The days of schools monetizing student data directories or sharing them with third-party coaching centers are over. Abhishek Baxi proves that even if the regulatory apparatus (DPBI) is lagging, constitutional courts will directly enforce DPDP principles to curtail surveillance and unauthorized data sharing.

The Bottom Line for Practitioners

Litigators can enjoy the constitutional theater of the DPDP/RTI clash in the Supreme Court, but transactional and in-house lawyers do not have that luxury. The refusal of the Supreme Court to stay the Act means the phased enforceability timeline remains absolute.

Audit your clients' data flows. Draft granular, multilingual privacy notices. Prepare for the Consent Manager integration by November 2026. The law may be imperfect, and the regulator may be absent, but the liability is very, very real.