The DPDP Rules 2025 Are Here: Why India’s “De Facto” AI Law and the RTI Clash Mean Crunch Time for Tech Lawyers

The waiting game is officially over. After a grueling two-year limbo following the passage of the Digital Personal Data Protection (DPDP) Act, 2023, the Centre has finally notified the DPDP Rules, 2025. If you are advising tech clients, startups, or AI developers, your implementation runway just got dangerously short.

While the notification itself is monumental, the ensuing legal fallout is what practitioners need to watch. The Supreme Court has referred constitutional challenges against the Act and Rules to a five-judge Constitution Bench, critically choosing not to stay the enforcement of the law in the interim. Concurrently, the government has signaled that it will not draft a bespoke Artificial Intelligence law, opting instead to shoehorn AI regulation into the existing Intellectual Property (IP) framework and the newly minted DPDP Act.

Here is an analytical breakdown of why these developments fundamentally alter tech and privacy practice in India, and what you need to tell your clients today.

The AI Compliance Squeeze: DPDP as India’s “De Facto” AI Law

Perhaps the most significant revelation from the Ministry of Electronics and Information Technology (MeitY) is its reluctance to introduce separate AI legislation. Government officials are betting that the intersection of the DPDP Act and the existing IP regime (primarily the Copyright Act, 1957) is sufficient to police the wild west of generative AI.

This is a convenient regulatory shortcut for the State, but a compliance nightmare for your clients. By treating the DPDP Rules as the default AI governance framework, the burden on AI firms collecting, scraping, and processing training data has exponentially increased.

When an AI company scrapes the internet for training data, they aren't just hitting potential copyright infringement under Section 14 of the Copyright Act; they are now unequivocally processing personal data without valid consent under Section 6 of the DPDP Act.

Lawyers can no longer build silos between their privacy and IP desks. If you are advising an AI startup, you must reconcile the "fair dealing" exceptions under Section 52 of the Copyright Act with the stringent notice and consent obligations under Sections 5 and 6 of the DPDP Act. Furthermore, the Rules mandate rigorous security protocols under Section 8. For AI pipelines—where data ingestion, model weighting, and output generation are highly opaque—proving compliance, data minimization, and purpose limitation will require massive architectural overhauls.

Compressing the Transition Timeline: No Reprieve for Big Tech

While the Rules suggest a phased implementation over 12 to 18 months, backend chatter indicates the Centre is actively considering compressing this timeline for large tech platforms—presumably those that will be classified as Significant Data Fiduciaries (SDFs) under Section 10.

The government's rationale is that large multinationals already adhere to global standards like the GDPR, and therefore do not need a generous grace period. This is a flawed assumption that ignores the unique architectural demands of the Indian law, such as verifiable parental consent for minors (Section 9) and the specific intricacies of the Consent Manager framework.

Practical Takeaway: Stop advising clients to wait for the final transition schedule. If your client is a large data fiduciary, you must initiate data mapping, vendor contract renegotiation, and grievance redressal structuring immediately. The penalties for non-compliance under the DPDP Act are monstrous—up to ₹250 crores per breach—and the grace period may vanish before your compliance audit is complete.

The Constitution Bench and the Muzzling of the RTI Act

On the litigation front, the Supreme Court's decision to refer the DPDP Act challenges to a five-judge Constitution Bench is a massive development. However, the Court’s refusal to grant an interim stay means the law is highly active. You must advise clients to comply as if the law is permanently settled, even as its constitutional validity hangs in the balance.

The crux of the constitutional challenge—and a deeply concerning issue for administrative lawyers—is the DPDP Act’s amendment to the Right to Information (RTI) Act, 2005. Section 44(3) of the DPDP Act amends Section 8(1)(j) of the RTI Act, completely removing the "public interest" exception for the disclosure of personal information.

Previously, a Public Information Officer (PIO) could disclose personal information if the larger public interest justified it (a standard heavily litigated post-Girish Ramchandra Deshpande v. CIC). Now, the DPDP Act imposes an absolute, blanket ban on the disclosure of any personal information under the RTI Act.

This is a dangerous weaponization of privacy. Under the guise of data protection, the State has effectively shielded public servants, procurement details, and government beneficiaries from public scrutiny. Civil society is rightly alarmed, and litigators relying on the RTI Act to build writ petitions challenging arbitrary state action will find their primary investigative tool severely blunted.

The Bottom Line

The notification of the DPDP Rules 2025 marks the end of theoretical debates and the beginning of hardcore compliance. The government’s strategy is clear: use massive financial penalties to force data fiduciaries into line, utilize the DPDP and IP laws as a makeshift net to catch AI abuses, and tighten the state's grip on information flow via the RTI amendment.

For Indian lawyers, the mandate is twofold: First, accelerate your clients' compliance architectures immediately, assuming the shortest possible transition timeline. Second, prepare for a wave of complex, multi-disciplinary litigation where data privacy, intellectual property, and constitutional transparency violently collide.