The Privacy Shield or a Transparency Gag? How the DPDP Act is Swallowing the RTI Act, While IP Lawyers Finally Get GUI Protection

As we cross the mid-point of 2026, the honeymoon period for India’s tech and privacy regulations is officially over. The Digital Personal Data Protection (DPDP) Act, 2023, now armed with the operational teeth of the 2025 Rules, is no longer just a boardroom compliance checklist. It is actively colliding with constitutional rights in the Supreme Court, fundamentally altering how we litigate transparency, while simultaneously reshaping the intellectual property landscape for digital assets.

For Indian practitioners—whether you are arguing writ petitions in the High Courts or drafting tech-transfer agreements—the latest developments require an immediate recalibration of strategy. Here is why the current intersection of privacy, transparency, and IP law demands your attention.

The Constitutional Crisis: Section 44(3) vs. The RTI Act

The most alarming development currently sitting before the Supreme Court is the challenge to Section 44(3) of the DPDP Act. For practitioners handling transparency and administrative law, this provision is a ticking time bomb.

Section 44(3) stealthily amends Section 8(1)(j) of the Right to Information (RTI) Act, 2005. Previously, Section 8(1)(j) allowed Public Information Officers (PIOs) to disclose personal information if the larger public interest justified it. The DPDP Act has effectively nuked this public interest caveat, creating a near-total blackout on the disclosure of any personal data by state authorities.

"By removing the public interest test, the DPDP Act has weaponized privacy to shield bureaucratic opacity. What was designed to protect the Data Principal from corporate exploitation is now protecting the State from citizen scrutiny."

The Supreme Court has rightly identified this as a genuine and significant issue, referring the matter to a larger bench. Why this matters for your practice: If you represent whistleblowers, journalists, or rely on RTI applications for pre-litigation discovery in administrative matters, your pipeline of information is currently frozen. Until the larger bench rules, expect PIOs to aggressively use the DPDP Act as a blanket shield against RTI queries. Litigators must now pivot to arguing that absolute non-disclosure violates the basic structure of Article 19(1)(a).

The ₹250 Crore AI Blindspot: DPDP Meets Machine Unlearning

While MEITY Secretary S. Krishnan recently confirmed that the government prefers using existing frameworks like the DPDP Act over drafting net-new AI regulations, applying a data privacy statute to generative AI is proving to be a logistical nightmare.

Take Section 12 of the DPDP Act—the Right to Erasure. Data Principals have the absolute right to demand the erasure of personal data once consent is withdrawn. But how do you enforce Section 12 against a Large Language Model (LLM)? If a Data Fiduciary (like a fintech company) uses an employee's or customer's personal data to train an internal AI model, simply deleting the original database doesn't remove the "learned" intelligence from the AI's neural network.

This has birthed the legal-technical requirement of Machine Unlearning. Furthermore, under Section 8(5), Data Fiduciaries are strictly liable for the actions of their Data Processors (e.g., third-party cloud and AI providers). With penalties maxing out at ₹250 crore for severe breaches, the stakes are existential.

Practice Point: Corporate lawyers can no longer rely on boilerplate indemnity clauses in vendor agreements. If you are drafting a SaaS or Cloud Processor agreement today, you must include specific "Multilevel Machine Unlearning" SLA clauses. If the processor cannot mathematically prove that a Data Principal's information has been unlearned from their AI models, the Fiduciary will be the one footing the ₹250 crore penalty.

A Massive Win for IP Lawyers: Virtual Designs Get Statutory Backing

While privacy lawyers are putting out fires, IP practitioners finally have reason to celebrate. The Department for Promotion of Industry and Internal Trade (DPIIT)'s January 2026 proposed amendments to the Designs Act, 2000 are a long-overdue modernization of India’s IP regime.

For years, IP lawyers have been forced to shoehorn Graphical User Interfaces (GUIs), icons, and digital animations into the Copyright Act, simply because the Designs Act mandated that a design be applied to a "tangible article." The new amendments fix this glaring anachronism by:

• Decoupling eligibility from tangibility: Explicitly extending design protection to virtual designs, AR/VR interfaces, typefaces, and GUIs.
• Introducing a 12-Month Grace Period: Replacing the highly restrictive 6-month exhibition-only rule under the old Section 16. Startups can now launch products online or demo them to investors without instantly destroying novelty.
• Statutory Damages: Introducing statutory damages of up to ₹50 lakh for wilful infringement.

Why this changes the game: Proving actual commercial loss in digital design infringement (e.g., a competitor copying your app's UI) has traditionally been an evidentiary nightmare. The introduction of ₹50 lakh in statutory damages gives IP litigators a massive stick to wield in cease-and-desist letters and interim injunction applications. IP portfolios must now be aggressively updated to register core digital interfaces under the Designs Act rather than relying solely on software copyright.

The Verdict

2026 is the year abstract technology law meets hard judicial reality. The Supreme Court's impending decision on Section 44(3) will determine whether India’s privacy law will co-exist with transparency or consume it. Meanwhile, the modernization of the Designs Act and the strict localization of financial data signal a mature, digitally sovereign India. For the sharp lawyer, the mandate is clear: update your IP filing strategies, rewrite those data-processing indemnities, and prepare for a seismic shift in constitutional litigation.