The DPDP Paradox: RTI Dilution at the Supreme Court While Corporate Lawyers Scramble for 2027 Compliance

The Ticking Clock Meets the Constitution Bench

For corporate lawyers and litigators alike, the Digital Personal Data Protection (DPDP) Act, 2023, has become a dual-front war. With the rules finally notified in November 2025, the government has set a hard deadline for full enforcement: May 13, 2027. But while corporate India scrambles to meet an accelerated compliance timeline, the Supreme Court is grappling with the constitutional validity of the Act itself.

Recent developments at the Supreme Court have created a fascinating, albeit stressful, paradox for legal practitioners. While the apex court has referred broader challenges against the DPDP Act to a five-judge Constitution Bench, it has explicitly refused to grant an interim stay. The message to the bar is clear: the presumption of constitutionality holds, and practitioners cannot advise clients to "wait and watch." If your clients aren't ripping up their boilerplate contracts right now, they are already behind.

Section 44(3): Shielding Bureaucrats Behind the Veil of Privacy

The most consequential litigation currently surrounding the DPDP Act isn't about corporate compliance—it is about democratic accountability. The Supreme Court recently issued notices to the Centre on a PIL filed by the Mazdoor Kisan Shakti Sangathan challenging Section 44(3) of the DPDP Act.

For practitioners advising on public law or filing writ petitions, the implications of Section 44(3) are massive. This section quietly amends Section 8(1)(j) of the Right to Information (RTI) Act, 2005. Previously, personal information of public officials could be disclosed under the RTI Act if a Public Information Officer (PIO) determined that the larger public interest justified the disclosure. The DPDP Act obliterates this public interest exemption, creating a blanket ban on the disclosure of any personal information under the RTI Act.

"The amendment to Section 8(1)(j) is a classic legislative sleight of hand. Under the guise of operationalizing the Puttaswamy right to privacy, the state has effectively shielded corrupt public officials from citizen scrutiny, fundamentally diluting Article 19(1)(a)."

The petitioners rightly argue that this violates Articles 14, 19(1)(a), and 21 of the Constitution. By impleading the state of Rajasthan—a hotbed for RTI activism—the Supreme Court has signaled that it recognizes the gravity of this clash between the fundamental right to privacy and the fundamental right to know. However, the refusal to stay the Act means PIOs across the country are already rejecting RTI applications citing the DPDP amendment.

The Death of Boilerplate: What Changes for Corporate Practitioners

While the constitutional litigators battle it out, transactional lawyers and in-house counsel are facing an operational nightmare. The initial 18-month compliance runway has been aggressively shortened to 12 months for intermediate milestones, with feedback on further acceleration due by March 2026. Here is what this means for your daily practice:

1. The End of "Click-Wrap" Consent: Under Rule 3 of the new DPDP Rules, standalone privacy notices are now mandatory. The days of burying data processing clauses in a 50-page Terms of Service agreement are over. Consent must be verifiable and itemized. If you are drafting commercial contracts for 2026, shrink-wrap and checkbox consent mechanisms will render your clients liable to severe penalties.

2. Renegotiating Vendor Contracts: Global Capability Centres (GCCs), Healthcare, and Insurance sectors are currently in the crosshairs. With only 10-15% of larger GCCs in structured implementation, corporate lawyers must aggressively audit their clients' Data Processing Agreements (DPAs). Data Fiduciaries carry the ultimate liability under the DPDP Act. Your 2026 commercial contracts must include stringent, DPDP-specific indemnity clauses, back-to-back liability pass-throughs for Data Processors, and explicit data transfer restrictions.

The Unexpected Enforcement Actor: NHRC Steps In

Perhaps the most surprising development in the DPDP landscape is the entry of the National Human Rights Commission (NHRC). The NHRC recently issued notices to AI, social media, and edtech platforms for alleged DPDP violations, framing data breaches as human rights violations.

This is a critical jurisprudential shift. It indicates that enforcement won't just come from the Data Protection Board (once fully functional). Litigators must now be prepared to defend tech clients against statutory notices from human rights bodies, expanding the forum-shopping opportunities for data principals whose rights have been infringed.

The Bottom Line for Lawyers

The DPDP Act is no longer a theoretical exercise; it is a live wire. The Supreme Court's referral to a Constitution Bench ensures that the jurisprudence around data protection and RTI will remain fluid for the next few years. However, the lack of a judicial stay combined with the May 2027 enforcement deadline means corporate lawyers must act defensively now.

Whether you are drafting a data-sharing agreement for a hospital, advising a startup on user onboarding, or arguing an RTI appeal before the Central Information Commission, the DPDP Act is your new reality. Stop relying on GDPR precedents; the Indian data protection regime has mutated into a distinct, unforgiving beast, and the time to adapt is today.