The DPDP-RTI Collision: Why the Supreme Court’s Constitution Bench Reference is 2026’s Defining Privacy Battle

The Constitutional Showdown: Article 19(1)(a) vs. Article 21

For the past three years, the Digital Personal Data Protection (DPDP) Act, 2023, has been viewed primarily as a corporate compliance headache. But this year, the Supreme Court has fundamentally shifted the narrative, recognizing the Act for what it truly is: a statutory weapon that is currently rewriting the constitutional balance between the citizen’s right to know and the individual’s right to privacy.

In a watershed moment, the Supreme Court has referred the challenge against Section 44(3) of the DPDP Act to a five-judge Constitution Bench. For practicing lawyers, this isn't just academic constitutional theory; it is a seismic shift in how transparency and privacy intersect in daily practice.

Here is the crux of the problem: Section 44(3) of the DPDP Act quietly amended Section 8(1)(j) of the Right to Information (RTI) Act, 2005. Previously, Section 8(1)(j) protected personal information from disclosure unless a Public Information Officer (PIO) or appellate authority determined that a larger public interest justified the disclosure. It was a statutory embodiment of the proportionality test. The DPDP Act obliterated this carve-out, creating a blanket ban on the disclosure of any personal information under the RTI Act.

By referring the matter to a larger bench and noting that a "careful balance" must be struck, the Supreme Court has acknowledged a glaring legislative overreach. A blanket exemption fundamentally offends the doctrine of proportionality established in K.S. Puttaswamy v. Union of India. You cannot protect Article 21 (Privacy) by completely amputating Article 19(1)(a) (Right to Information).

The Litigation Reality: Operating Without a Stay

While the reference to the Constitution Bench is a welcome step, the Supreme Court’s refusal to grant an interim stay on the amendment is creating havoc on the ground. For litigators handling writ petitions and RTI appeals, the reality is stark: the blanket privacy exemption remains operative.

What does this mean in practice? PIOs across the country are currently weaponizing the DPDP Act. Any RTI request involving government tenders, beneficiary lists, public appointments, or administrative inquiries is being summarily rejected under the guise of "personal data" protection. Until the Constitution Bench rules, lawyers challenging these rejections before the Central Information Commission (CIC) or High Courts under Article 226 will find themselves severely handicapped. Litigators must pivot their arguments—rather than arguing "public interest" (which the statute no longer explicitly allows), you must now meticulously argue that the requested data does not meet the strict definitional threshold of "personal data" under Section 2(t) of the DPDP Act.

The Transactional Myopia: Jumping the Gun on Cross-Border Transfers

While litigators grapple with the RTI fallout, transactional and technology lawyers are dealing with their own DPDP-induced chaos—much of it self-inflicted.

With the DPDP Rules, 2025 notified last November, the regulatory machinery is moving in phases. Consent Manager registrations are slated for mid-November 2026, while substantive obligations for Data Fiduciaries—such as verifiable consent notices, breach reporting, and children’s data protections—are expected to go live around May 13, 2027.

Yet, a disturbing trend has emerged in corporate practice. As highlighted by recent legal-tech analyses, law firms and in-house counsels are aggressively redrafting cross-border Data Processing Agreements (DPAs) as if the DPDP cross-border transfer rules are already live. This is compliance theater at its worst.

The government has not yet fully activated or clarified the negative list for cross-border data transfers under Section 16. Drafting rigid, restrictive clauses now based on speculative interpretations of the DPDP Rules restricts business operations unnecessarily. Corporate lawyers need to advise their clients to prepare for the May 2027 deadline with operational mapping, not by prematurely locking clients into restrictive contractual obligations that the law does not yet demand.

The APAAR Ruling: A Preview of DPDP Enforcement

If you want to know how the Supreme Court will interpret the substantive provisions of the DPDP Act once they are fully enforced, look no further than its late July 2026 order regarding the APAAR (Automated Permanent Academic Account Registry) system.

The Court directed the Centre and CBSE to amend the APAAR consent forms, explicitly mandating that parents and guardians must have the ability to withhold consent, and severely restricting third-party data sharing. More importantly, the Court categorically stated that the collection and processing of student data under APAAR is subject to the DPDP Act, 2023.

This is a massive warning shot for ed-tech platforms and data fiduciaries handling children's data. It signals that courts will enforce Section 9 of the DPDP Act (processing of children's data) with strict, literal interpretation. Consent cannot be a bundled, take-it-or-leave-it proposition. If your client's user interface relies on dark patterns or forced consent, the APAAR ruling indicates that constitutional courts will not hesitate to strike down those mechanisms as invalid under the DPDP regime.

The Path Forward

2026 is the year the DPDP Act transitioned from a theoretical framework to a hard, litigated reality. Whether it is the impending clash between the Consent Manager infrastructure and the RBI's Account Aggregator framework, or the Constitution Bench deciding the fate of the RTI Act, the message for Indian lawyers is clear: data protection law is no longer a niche advisory practice. It is now central to constitutional litigation, administrative law, and mainstream corporate transactions. Prepare accordingly.