The DPDP Rules 2025 Arrive: Why the Supreme Court’s Refusal to Stay the RTI Amendment Changes Everything for Data Strategy and Litigation

The End of the Waiting Game

For nearly two years, the Digital Personal Data Protection (DPDP) Act, 2023, has existed in a state of suspended animation—a looming statutory specter without the administrative machinery to give it teeth. That era ended this week. The Centre has officially notified the DPDP Rules, 2025, shifting India’s privacy regime from legislative theory to immediate compliance reality.

But while corporate law teams scramble to decode the operational mechanics of notice, consent, and Data Fiduciary obligations, litigators and constitutional lawyers need to look at the Supreme Court. The Apex Court has referred a batch of petitions challenging the DPDP Act—specifically its devastating amendment to the Right to Information (RTI) Act—to a larger Constitution Bench. Crucially, however, the Court has refused to stay the operation of the law in the interim.

For practicing lawyers across the board—from TMT advisors to civil rights litigators—the landscape has fundamentally shifted. Here is an analytical breakdown of why these developments demand an immediate pivot in your legal strategy.

The RTI Evisceration: A Blanket Shield for the State

The most alarming aspect of the DPDP Act is not what it does to private tech companies, but what it does to transparency. Section 44(3) of the DPDP Act quietly amended Section 8(1)(j) of the Right to Information Act, 2005.

Previously, Section 8(1)(j) exempted personal information from disclosure unless the Central Public Information Officer (CPIO) or the appellate authority was satisfied that the "larger public interest justifies the disclosure." It was a delicate, judicially tested balance between the right to privacy under K.S. Puttaswamy v. Union of India and the right to know. If an investigative journalist or a lawyer filed an RTI seeking records of disproportionate assets of a public servant, the public interest overrode the bureaucrat's privacy.

The DPDP Act obliterates this balance. The amendment completely removes the "larger public interest" carve-out. Now, any information relating to identifiable individuals is categorically exempt from disclosure.

"By refusing to stay the RTI amendment while the larger bench deliberates, the Supreme Court has effectively green-lit a blackout on public accountability. For litigators who rely on the RTI Act to gather preliminary evidence for writ petitions and Public Interest Litigations (PILs), your primary fact-finding tool has been neutralized."

Expect State instrumentalities to weaponize this immediately. Every RTI application asking for beneficiary lists, tender allocations containing names, or disciplinary proceedings against officials will be summarily rejected citing the DPDP Act. Until the 5-judge bench decides the constitutional validity of this amendment, administrative lawyers will have to rely on discovery applications under the CPC or specific statutory demands rather than the formerly robust RTI route.

Corporate Compliance: The Ticking Clock for Data Fiduciaries

On the corporate front, the notification of the DPDP Rules 2025 comes with a stark warning regarding timelines. While initial reports suggested a comfortable 18-month phased implementation runway, the government is already considering compressing the timeline for large Data Fiduciaries.

The Ministry of Electronics and Information Technology (MeitY) is reportedly arguing that major corporations are already compliant with global data norms like the European GDPR, and therefore do not need an extended grace period. This is a dangerous assumption for clients to rely on.

As corporate counsel, you must advise clients that GDPR compliance does not equal DPDP compliance. The Indian law lacks the "legitimate interest" basis for processing data, a massive divergence from European law. If your client is scraping data, processing employee records, or utilizing third-party data processors, they need explicit, clear, and itemized consent under the new Rules. If the timeline is compressed to six or twelve months, the window for conducting data-mapping audits, renegotiating vendor contracts, and overhauling user interfaces is already closing.

AI Governance: The Patchwork Approach

For Intellectual Property and Technology lawyers, perhaps the most consequential revelation this week is the government’s explicit stance on Artificial Intelligence. The MeitY Secretary has confirmed that India will not introduce a standalone AI regulation in the near future. Instead, the government will rely on the DPDP Act and existing Intellectual Property laws to govern AI innovation and enforcement.

This means the "wait and see" approach for advising AI developers is over. If you are counseling an LLM (Large Language Model) startup or an enterprise integrating AI, your regulatory toolkit is already codified:

• Data Scraping & Privacy: The training of AI models using publicly available personal data is heavily restricted. Unlike some jurisdictions, the DPDP Act does not clearly exempt publicly available personal data scraped from the internet from consent requirements. You must navigate the new Rules to find compliance pathways for data ingestion.
• Copyright & Fair Dealing: For non-personal data, the battleground shifts entirely to the Copyright Act, 1957. Does ingesting copyrighted text or images to train an AI model fall under the "fair dealing" exception of Section 52(1)(a)? By pointing to existing IP laws, the government is essentially inviting copyright holders to litigate against AI firms under Section 14 (exclusive rights of the owner).

The Bottom Line

The notification of the DPDP Rules 2025 marks the end of the theoretical phase of Indian privacy law. The Supreme Court's refusal to stay the RTI amendments means the chilling effect on public transparency is already in force. Meanwhile, the government's reliance on existing frameworks for AI means IP and tech lawyers must creatively stretch the Copyright Act and the DPDP Act to fit modern technological realities.

For the Indian legal practitioner, the message is clear: Stop waiting for further clarifications. The regulatory framework for the next decade of India's digital economy is officially live. It is time to litigate, comply, and adapt.