The DPDP Paradox: Supreme Court Tackles the RTI Collision While the Data Protection Board Remains a Ghost

The Illusion of Readiness in India's Privacy Regime

The Digital Personal Data Protection (DPDP) Act, 2023 is currently India’s Schrödinger’s legislation—simultaneously wreaking havoc on existing statutory frameworks while lacking the basic institutional machinery to enforce itself. For practicing lawyers and in-house counsel, the current landscape is a minefield of contradictory compliance mandates, judicial activism, and regulatory vacuums.

Recent developments underscore a systemic dysfunction: the Supreme Court is grappling with the DPDP Act’s chilling effect on transparency, the Kerala High Court is issuing ultimatums to operationalize a non-existent Data Protection Board (DPB), and the fintech sector is actively pleading for regulatory forbearance. If you are advising Data Fiduciaries in India right now, waiting for the May 2027 operational deadline is a fool's errand. The jurisprudence is being written in the constitutional courts today.

The RTI Collision: Article 19 vs. Article 21

The most consequential development for litigators is the Supreme Court’s decision to refer challenges against Section 44(3) of the DPDP Act to a larger Constitution Bench. For those who practice in the writ courts, this provision is an absolute nightmare.

Section 44(3) of the DPDP Act amended Section 8(1)(j) of the Right to Information (RTI) Act, 2005. Previously, Section 8(1)(j) provided a nuanced balancing test: personal information could be exempted from disclosure unless a Public Information Officer (PIO) determined that the larger public interest justified it. The proviso explicitly stated that information which cannot be denied to the Parliament or a State Legislature shall not be denied to any person.

The DPDP Act bulldozed this nuance, replacing it with a blanket exemption for any information that relates to personal data. There is no longer a public interest override.

"By severing the public interest caveat, the legislature has effectively weaponized privacy against accountability, creating an impenetrable shield for bureaucratic opacity."

The Supreme Court rightly noted that "some creases" need to be ironed out, but crucially, the amendment remains operative while the constitutional challenge is pending. For lawyers representing journalists, whistleblowers, or civil society, this means RTI applications seeking even tangentially personal data—such as the educational qualifications of public servants or beneficiary lists for state schemes—will face immediate rejection. The looming Constitution Bench will have to perform a delicate tightrope walk between the fundamental right to information under Article 19(1)(a) and the right to privacy under Article 21, as cemented in Justice K.S. Puttaswamy (Retd.) v. Union of India.

Judicial Activism Filling the Regulatory Vacuum

While the state aggressively pushes Digital Public Infrastructure (DPI), the regulatory watchdog meant to govern it is missing in action. More than eight months post-notification of the rules, the Data Protection Board of India has neither a Chairperson nor members. This institutional inertia has forced constitutional courts to step in as de facto data regulators.

In a landmark privacy dispute involving the Automated Permanent Academic Account Registry (APAAR), the Supreme Court didn't wait for the DPB. It directly ordered the Centre and the CBSE to amend their consent forms, mandating the inclusion of an explicit opt-out/refuse option and strictly restricting third-party data sharing.

Similarly, the Kerala High Court has taken up the mantle in a PIL concerning privacy issues around Digi Yatra. Taking a prima facie view that Aadhaar cannot be made mandatory for Digi Yatra registration if alternative ID proofs are available, the Court issued a mandamus-style directive demanding the Data Protection Board be made functional within 8 weeks.

Practice Pointer: Do not wait for the DPB to issue consent templates. The Supreme Court's APAAR directive sets a binding precedent on what constitutes "free and informed consent" under Section 6 of the DPDP Act. If your client's consent architecture uses pre-ticked boxes or lacks a clear, granular opt-out mechanism for third-party sharing, they are already violating constitutional standards, regardless of the May 2027 DPDP operational timeline.

Industry Panic: Fintech and the Consent Manager Paradox

The corporate reality is equally chaotic. The Economic Times reports that digital payment companies and the National Payments Corporation of India (NPCI) are seeking a pause on the DPDP consent clause. Why?

The fintech sector relies heavily on frictionless data flows. Under the DPDP framework, Consent Managers are supposed to act as intermediaries, allowing Data Principals to give, manage, and withdraw consent through an interoperable platform. However, the timeline dictates that Consent Manager registration might only begin around mid-November 2026, while the heavier operational provisions for Data Fiduciaries are slated for May 13, 2027.

The NPCI and digital payment apps are realizing that re-architecting their entire UX to capture verifiable, purpose-specific consent without a functional Consent Manager ecosystem will choke transaction speeds. For corporate lawyers, the advice here is risk mitigation: map your data flows now. Identify every node where personal data is shared with payment gateways or third-party APIs, and begin drafting "just-in-time" consent notices. The pushback from NPCI indicates that the government may grant sector-specific exemptions or extended timelines, but relying on regulatory grace periods is bad legal strategy.

The Verdict

India’s data protection regime is currently suffering from a severe case of legislative cart-before-the-horse. The state has enacted a sweeping law that fundamentally alters the RTI Act and imposes massive compliance burdens on tech and fintech companies, yet it drags its feet on appointing the very Board meant to oversee this transition. Until the Supreme Court resolves the RTI constitutional challenge and the DPB is actively staffed, practicing lawyers must look to interim judicial orders—like the APAAR and Digi Yatra rulings—as the true operational guidelines for data privacy in India.