The Digital Personal Data Protection (DPDP) Act is under Supreme Court review, focusing on its conflict with the Right to Information (RTI) Act. With full implementation set for May 2027, the law mandates strict compliance, with penalties reaching up to ₹250 crore per violation. Investors and businesses are closely monitoring the legal developments as they will dictate future data governance and transparency standards.
India is currently in a transitional phase regarding data privacy, with the Digital Personal Data Protection (DPDP) Act, 2023, undergoing a phased implementation. While the framework is designed to modernize data handling, it is simultaneously facing significant constitutional scrutiny in the Supreme Court. The full enforcement of the Act is scheduled for May 13, 2027, and the current legal uncertainty creates a complex environment for both businesses and the public sector.
The core of the legal debate involves the relationship between the new data protection framework and the established Right to Information (RTI) Act of 2005. Critics and legal experts are challenging Section 44(3) of the DPDP Act, which amends Section 8(1)(j) of the RTI Act. This amendment effectively changes how personal information is handled by public authorities, creating a broader exemption that some argue limits transparency and accountability. Multiple Public Interest Litigations have been admitted by the Supreme Court, which is now evaluating whether these changes conflict with the principles of open governance and the public's right to access government data.
For businesses, the DPDP Act introduces substantial operational and financial risks. Companies must now navigate a stringent regulatory environment where non-compliance can lead to severe financial penalties of up to ₹250 crore per violation. To avoid these risks, firms across sectors—especially in fintech, banking, and e-commerce—are investing in updated consent management systems, data governance protocols, and mandatory breach reporting mechanisms. The Data Protection Board of India, which was established in November 2025 to oversee these regulations, is a key entity that companies will need to engage with as the compliance deadline approaches.
Parallel to the transparency debate, the Supreme Court is also reviewing the use of facial recognition technology by law enforcement agencies. Petitions have argued that deploying such surveillance at public protest sites lacks a specific statutory framework and may violate privacy standards established in the landmark K.S. Puttaswamy judgment. This judgment remains the gold standard for balancing state interests with individual rights, and it is currently being used as a benchmark to test the legality of current surveillance practices.
The ongoing judicial process will be the primary monitorable for all stakeholders. As the Supreme Court hears these cases, the outcomes could potentially lead to amendments or stricter interpretations of the DPDP Act’s provisions. Investors and corporate boards should track the court's stance on the RTI amendments and surveillance rules, as these decisions will directly influence the final cost of compliance and the scope of data access permitted under the new law.