The DPDP Rules Are Live, But the Supreme Court’s RTI Showdown Will Define India's Privacy Law

For Indian technology, privacy, and media lawyers, the waiting game is finally over. The Centre has notified the long-awaited administrative rules for the Digital Personal Data Protection (DPDP) Act, shifting India’s privacy regime from theoretical boardroom discussions into hard, actionable compliance. But while corporate counsel are scrambling to decode the phased 12-to-18-month rollout, the real jurisprudential battlefield has shifted to the Supreme Court.

The Supreme Court is currently hearing heavy-hitting constitutional challenges against the DPDP Act’s amendments to the Right to Information (RTI) Act. Crucially, the Court has referred the matter to a larger Constitution Bench while refusing to stay the operation of the law. For practicing lawyers, this creates an immediate, volatile dual-reality: advising tech clients on stringent new data mandates while watching the very definition of "public versus personal data" get litigated at the highest court.

The RTI Act Defanged: A Dangerous Overcorrection

To understand why the Supreme Court litigation matters to your practice, you must look at Section 44(3) of the DPDP Act, which stealthily guts Section 8(1)(j) of the RTI Act, 2005.

Historically, Section 8(1)(j) exempted "personal information" from RTI disclosure unless the Central Public Information Officer (CPIO) was satisfied that the larger public interest justified its release. It also contained a powerful proviso: "information which cannot be denied to the Parliament or a State Legislature shall not be denied to any person."

The DPDP Act obliterates this nuance. It amends Section 8(1)(j) to create a blanket exemption for any information that relates to "personal data," completely removing the public interest override and the legislative proviso.

This is not merely a statutory tweak; it is a fundamental re-writing of the balance between Article 19(1)(a) (the right to know) and Article 21 (the right to privacy as read in Puttaswamy).

In practice, this means CPIOs—who are already notoriously risk-averse—now have a statutory shield to reject virtually any RTI application that contains a sliver of personal information, whether it involves corrupt public officials, electoral beneficiaries, or government tenders. Civil society’s pushback is entirely justified. The Supreme Court’s refusal to stay the amendment pending the five-judge bench hearing means that, as of today, investigative journalism and public-interest litigation (PIL) practices will face massive evidentiary roadblocks. If your practice relies on RTI responses to build writ petitions, expect a wave of summary rejections citing the DPDP Act.

Corporate Compliance: Shrinking Timelines and the AI Nightmare

On the corporate side, the notification of the DPDP rules brings a sharp reality check. The government has indicated a phased rollout over the next 12 to 18 months, but alarmingly for major tech players, the Centre is already mulling compressing this timeline for large "Data Fiduciaries."

The compliance bar is about to skyrocket, particularly for companies building or deploying Artificial Intelligence. The DPDP Act is heavily predicated on a strict "notice and consent" architecture (Sections 5 and 6). For AI companies relying on Large Language Models (LLMs), the foundational practice of scraping the internet for training data is now in direct conflict with Indian law. How does an AI firm obtain affirmative, granular consent from millions of Indian Data Principals whose personal data is swept up in a web-scraping dragnet?

The short answer: they can't. The rules will force AI developers to either heavily anonymize training datasets (a technically monumental task) or face crippling penalties under the Act. Lawyers advising startups must immediately move clients away from the "scrape first, ask questions later" mentality. Data mapping and establishing clear legal bases for processing are no longer optional audits; they are survival mandates.

The Government's "Existing Law" Fallacy for AI

Complicating matters is the Ministry of Electronics and Information Technology's (MeitY) stated position that it prefers to govern AI through existing frameworks—like the DPDP Act and the Copyright Act—rather than drafting bespoke AI legislation.

This is a lazy regulatory approach that will inevitably lead to a litigation explosion. The DPDP Act was drafted to regulate corporate data silos, not generative AI neural networks. Attempting to shoehorn AI regulation into a privacy statute and traditional IP laws will force the courts to do the heavy lifting. We are already seeing the friction: when an AI hallucinates personal data, is it a data breach under the DPDP Act or a defamation tort? When it trains on copyrighted material containing personal data, does it violate the DPDP Act, the Copyright Act, or both?

What This Means for Your Practice

We are entering a period of intense regulatory enforcement and constitutional friction. Here is what practitioners need to do right now:

• For Corporate Counsel: Do not wait for the 18-month window. If the government compresses the timeline, your clients will be caught off guard. Initiate comprehensive data mapping immediately, focusing on how legacy data was collected and whether fresh Section 6 consent is required.
• For Litigators: Prepare for a surge in writ petitions challenging CPIO rejections under the amended RTI Act. You will need to creatively argue that certain "personal" data is inherently public by nature of the official's public duties, bypassing the DPDP blanket ban until the Supreme Court rules.
• For IP/Tech Lawyers: Advise AI clients that India is not a regulatory sandbox. The lack of a specific AI law does not mean a lack of regulation; it means they are governed by the strictest interpretations of the newly live DPDP rules.

The DPDP Act has finally landed. Whether it serves as a shield for citizen privacy or a weapon for government opacity and corporate harassment will depend entirely on how the Supreme Court rules in the coming months.