The Great AI Cop-Out: How the DPDP Act and Copyright 'Fair Dealing' Just Became India's De Facto AI Law

If you were holding your breath for a bespoke, European-style Artificial Intelligence regulation in India, it is time to exhale and look at the statutes already sitting on your desk. In a defining policy pivot for 2026, the Ministry of Electronics and Information Technology (MeitY) has explicitly signaled that the government prefers existing legal frameworks over new regulations to govern AI. The message to the Indian legal fraternity is clear: figure it out using the Digital Personal Data Protection (DPDP) Act, 2023, and the Copyright Act, 1957.

This hands-off approach by the legislature is forcing Indian courts to do the heavy lifting, resulting in a chaotic, high-stakes environment for tech litigators and in-house counsel alike. Here is why the latest developments from the Supreme Court and the Delhi High Court are about to fundamentally rewrite your advisory practice.

The Copyright Bombshell: ANI v. OpenAI and "Fair Dealing"

Perhaps the most seismic shift for IP practitioners this year comes from the Delhi High Court. In a landmark ruling, the Court held that OpenAI’s storage and use of ANI’s copyrighted works for training its Large Language Models (LLMs) falls within the ambit of "fair dealing."

This is a staggering interpretation of Section 52(1)(a) of the Copyright Act, 1957, which exempts fair dealing with any work for the purposes of "private or personal use, including research."

To equate the ingestion of petabytes of proprietary journalistic content by a multi-billion-dollar commercial enterprise with "research" is not just a liberal reading of the statute; it is a complete reimagining of Indian copyright law in the age of generative AI.

Practice Implication: If you represent publishers, media houses, or content creators, your traditional cease-and-desist letters against data scrapers just lost their teeth. You can no longer rely on a prima facie infringement argument. You must now litigate the nuances of the four-factor fair dealing test, proving that the AI's commercial output directly usurps your client's market. Conversely, if you represent tech startups, this ruling is your golden shield—though you should advise clients that this interpretation is highly likely to face Supreme Court scrutiny.

The DPDP Act: Live, Bleeding in Court, but Not Stayed

While IP law handles the scraping of works, the DPDP Act is now the battleground for the scraping of people. With the Centre finally notifying the administrative rules for the DPDP Act, we have officially moved from the enactment phase to the compliance phase. However, the Supreme Court has made it clear that while it will not stay the operation of the Act, it is highly skeptical of its constitutional validity.

The apex court is currently hearing constitutional challenges under Articles 14, 19, and 21. For practicing lawyers, two specific issues flagged by the Supreme Court in its February and March 2026 hearings demand immediate attention:

1. The "Publicly Available Data" Loophole: The Supreme Court is scrutinizing exactly what constitutes "public data" versus "private data." Under Section 3(c)(ii) of the DPDP Act, the law does not apply to personal data made publicly available by the Data Principal themselves. Tech companies are currently using this as a carte blanche to scrape social media for AI training. If the Supreme Court reads this exemption narrowly—for instance, ruling that posting a photo on Instagram does not equate to consent for algorithmic ingestion—every major AI platform operating in India will be in immediate violation of the Act.

2. The RTI Act Dilution: The Supreme Court has referred the interplay between the DPDP Act and the Right to Information (RTI) Act to a larger bench. The DPDP Act amended Section 8(1)(j) of the RTI Act, effectively creating a blanket ban on the disclosure of personal information, removing the earlier "public interest" override. Litigators who rely on RTI applications to gather evidence involving public servants or government beneficiaries need to track this closely; the amendment has severely crippled investigative legal strategies.

Consent Cannot Be a Maze

If your corporate clients are still using pre-checked boxes and labyrinthine privacy policies, they are operating on borrowed time. Courts and regulatory bodies are interpreting the DPDP Act's consent obligations with draconian strictness.

A recent Supreme Court ruling regarding the APAAR (Automated Permanent Academic Account Registry) student ID system set the gold standard: the Court mandated that consent forms must include a clear opt-out option, affirming that student data handling is strictly subject to DPDP principles. The legal standard is now unequivocal: under Section 6 of the DPDP Act, consent must be free, specific, informed, unconditional, and unambiguous. More importantly, withdrawal of consent must be as easy as giving it.

Practice Implication: Data Fiduciaries can no longer hide behind "legitimate interest" for broad data processing. As counsel, you must audit your clients' UI/UX designs. If it takes one click to accept a cookie policy but five clicks and an email to withdraw it, your client is non-compliant and exposed to the Act's crippling financial penalties (up to ₹250 crores).

The Bottom Line

The Indian government has abdicated the creation of a specialized AI law, leaving the judiciary to retro-fit 20th-century copyright concepts and a nascent data protection framework onto 21st-century technology. For law students and tech lawyers, this is the most exciting—and dangerous—time to practice. The statutes are fixed, but the jurisprudence is entirely up for grabs. Your ability to creatively argue the scope of "fair dealing" under Section 52 and the limits of "publicly available data" under Section 3 of the DPDP Act will define your success in this new era.