The Privacy Shield or the Transparency Guillotine? Supreme Court Kicks the DPDP-RTI Clash to a Larger Bench

The Constitutional Collision of Our Time

The inevitable collision between Article 19(1)(a) (the right to know) and Article 21 (the right to privacy) has finally reached a critical inflection point. On February 16, 2026, the Supreme Court referred a batch of writ petitions challenging the Digital Personal Data Protection (DPDP) Act, 2023—specifically its surgical strike on the Right to Information (RTI) Act, 2005—to a larger bench. Crucially for practicing lawyers, the Court explicitly refused to grant a stay on the operation of the DPDP Act.

For Indian legal practitioners, this development is a double-edged sword. On the litigation front, the refusal to stay the amendment fundamentally alters how we advise clients on RTI strategies. On the corporate side, the compliance clock for the DPDP Rules, 2025 continues to tick mercilessly forward, even as the regulatory infrastructure remains dangerously hollow.

The Death of the 'Public Interest' Caveat

To understand why this larger bench referral is the most consequential privacy litigation since K.S. Puttaswamy, we must look at the mechanics of the amendment. Prior to the DPDP Act, Section 8(1)(j) of the RTI Act exempted personal information from disclosure unless the Public Information Officer (PIO) was satisfied that the larger public interest justified the disclosure. It was a delicate, functional balancing act.

Section 44(3) of the DPDP Act obliterated this balance. It amended Section 8(1)(j) to create a blanket ban on the disclosure of personal information, completely stripping away the "larger public interest" override.

"By removing the public interest test, the DPDP Act effectively weaponizes privacy to shield public servants from accountability. A journalist seeking asset declarations of corrupt officials, or an activist investigating ghost beneficiaries in welfare schemes, now faces an impenetrable statutory wall."

The petitioners—including Venkatesh Nayak, the National Campaign for People’s Right to Information (NCPRI), and The Reporters Collective—rightly argue that this is ultra vires the Constitution. But for the practicing lawyer, the Supreme Court's refusal to stay the amendment dictates immediate ground reality. Expect PIOs to routinely and aggressively reject any RTI application that tangentially involves a name, an ID number, or personal data, citing the amended Section 8(1)(j). Until the larger bench rules, appellate strategies before the Central Information Commission (CIC) must pivot from arguing "public interest" to arguing whether the requested data legally constitutes "personal information" at all.

Corporate Counsel Alert: The Ticking Compliance Clock

While litigators grapple with the RTI fallout, in-house counsel and technology lawyers have no time to breathe. The Supreme Court's refusal to stay the Act means the phased rollout of the DPDP Rules, 2025 (notified on November 13, 2025) is fully active.

If you are advising Data Fiduciaries, your compliance roadmap is already written in stone:

• November 13, 2026: The Consent Manager framework under Rule 4 becomes operational. Fiduciaries must be technologically integrated to accept, track, and honor consent withdrawals via these centralized managers.
• May 13, 2027: The substantive operational obligations hit with full force. This includes the implementation of verifiable parental consent mechanisms, strict breach-reporting timelines, and the heavy localized obligations for Significant Data Fiduciaries (SDFs).

Do not wait for the government to issue clarifications. The Supreme Court is already enforcing the spirit of the DPDP Act in parallel proceedings. Take the recent 2026 order regarding the government's APAAR Scheme (the education registry). The Court mandated that parents be given an explicit, accessible option to withhold consent, treating the student data collection strictly under the purview of the DPDP Act. The era of bundled, implied consent is judicially dead.

The Ghost Town Regulator

The most glaring irony in this entire landscape is the state of the Data Protection Board of India (DPBI). As of mid-2026, while the Board exists on paper, it remains headless and unstaffed. The nomination processes were only initiated in May and June 2026.

This creates a perilous regulatory vacuum. We have a live, enforceable data protection law, an active compliance timeline, and a Supreme Court actively interpreting consent obligations—but no primary regulator to issue guidance, adjudicate initial disputes, or clarify the technical standards for Consent Managers.

The Verdict for Practice

The larger bench of the Supreme Court now faces a mammoth constitutional task: reconciling the legacy of Raj Narain (the right to know) with Puttaswamy (the right to privacy).

However, practitioners cannot wait for that jurisprudential masterpiece. The takeaway is clear: Corporate lawyers must push their clients to finalize their data-mapping and consent-architecture by late 2026, operating on the assumption of maximum statutory penalty. Meanwhile, writ courts are going to be flooded with challenges to RTI rejections. The DPDP Act has fundamentally rewritten the rules of information governance in India, and the transition period is going to be incredibly messy.