The DPDP Rules Are Finally Here, But The Supreme Court Will Decide Their Fate: What The RTI Clash Means For Your Practice

After a nearly three-year wait since the passing of the Digital Personal Data Protection (DPDP) Act, 2023, the Centre has finally notified the administrative Rules, making India’s highly anticipated data protection regime operational. But for Indian practitioners, the notification of these Rules is not the end of the uncertainty—it is the beginning of a massive constitutional and compliance battle.

As corporate counsel scramble to understand the phased 12-to-18-month transition timeline, litigators are focusing strictly on the Supreme Court. Petitions challenging the constitutionality of the DPDP Act and the new Rules have reached the apex court, prompting a referral to a larger constitutional bench. Crucially, the Supreme Court has refused to stay the Act or the Rules in the interim.

Make no mistake: waiting for the Supreme Court to resolve this litigation before advising your clients to comply is professional negligence. The compliance clock is ticking, and the Centre is already floating the idea of compressing the 18-month timeline for large tech companies.

The Article 19 vs. Article 21 Tightrope

The crux of the Supreme Court challenge lies in the DPDP Act’s controversial amendment to the Right to Information (RTI) Act, 2005. By virtue of Section 44(3) of the DPDP Act, Section 8(1)(j) of the RTI Act was amended to completely exempt "personal information" from disclosure.

Previously, Section 8(1)(j) contained a crucial public interest override: personal information could be disclosed if the Central Public Information Officer (CPIO) was satisfied that the larger public interest justified it, or if the information could not be denied to the Parliament or a State Legislature. The DPDP Act wiped this override off the statute books.

"By removing the public interest test, the DPDP Act effectively weaponizes privacy against transparency. It creates an absolute embargo on personal information disclosure, severely crippling public audits, electoral accountability, and anti-corruption investigations."

The Supreme Court is now tasked with balancing the fundamental right to privacy under Article 21 (as cemented in K.S. Puttaswamy v. Union of India) against the fundamental right to information inherent in Article 19(1)(a). The larger bench's examination of where "public data" ends and "private data" begins will heavily dictate how Data Fiduciaries handle data requests. If the Court reads down the amendment, companies may find themselves caught between DPDP confidentiality obligations and RTI disclosures when dealing with state instrumentalities.

AI Regulation by Proxy: The MeitY Strategy

While the privacy debate rages, technology lawyers waiting for a bespoke Artificial Intelligence regulation can stop holding their breath. The Ministry of Electronics and IT (MeitY) has made its stance clear: India will rely on existing statutes, primarily the DPDP Act and the Copyright Act, to regulate AI.

This is a defining shift in regulatory strategy. Rather than passing an "AI Act," the government is forcing AI developers into the compliance matrix of data protection and intellectual property frameworks. For AI companies operating in India, the DPDP Rules raise the compliance bar to punishing heights.

Under the DPDP Act, the definition of "processing" (Section 2(t)) is broad enough to cover the scraping, ingestion, and training of data used in Large Language Models (LLMs). Because the Act requires clear, affirmative consent for processing personal data, AI companies can no longer rely on the defense that personal data scraped from the internet was "publicly available," unless that data was made publicly available by the Data Principal themselves for that specific purpose.

For IP practitioners, MeitY’s policy statement signals that copyright infringement cases against generative AI platforms will be fought strictly within the bounds of Section 52 of the Copyright Act, 1957. The defense of "fair dealing" for AI training is about to be heavily litigated, as the government has shown no appetite to introduce a statutory safe harbor for AI developers.

Practice Pointers for the Modern Lawyer

So, what changes for your practice today?

1. Do Not Rely on the Litigation Shield: The Supreme Court’s refusal to grant a stay means the DPDP Rules are live. If you represent large Data Fiduciaries (Significant Data Fiduciaries under the Act), you must operate under the assumption that the government will shorten the 18-month transition window. Begin data mapping and drafting DPDP-compliant notice and consent frameworks immediately.

2. Audit AI Data Pipelines: If you represent tech startups or AI developers, audit their data ingestion pipelines. If their models are trained on datasets containing Indian citizens' personal data without explicit consent or a legitimate use exception, they are in violation of the DPDP Act. The fines (up to ₹250 crores per breach) are company-killers.

3. Prepare for RTI Rejections: For litigators and civil rights advocates using the RTI Act for discovery or public interest litigation, expect a wall of rejections from CPIOs citing the new Section 8(1)(j). You must be prepared to argue before Information Commissions that the information sought does not constitute "personal data" under the DPDP Act's definitions, rather than relying on the now-deleted public interest override.

India’s tech law landscape has finally moved from theoretical debates to hard statutory compliance. The Supreme Court will eventually draw the constitutional boundaries, but until then, the DPDP Act is the law of the land, and it is strictly business.