Supreme Court challenge to the DPDP Act: what stands today

India's new data protection law is being tested in its own top court. Since February 2026 the Supreme Court has been hearing writ petitions that challenge parts of the DPDP Act 2023 and the DPDP Rules 2025 as unconstitutional, with the Act's quiet rewrite of the Right to Information Act at the centre of the fight. This page tracks the case: who is challenging what, what the challenged provisions actually say in the Gazette text, and what has and has not changed for anyone building DPDP compliance. Litigation facts here come from named court reporters and are labelled explanation; every statement about what the law says is cited to the official text.

The position in 1 table

The single most practical fact sits in the last 3 rows. The court has been explicit that the law keeps operating while it thinks: at the first hearing on 16 February 2026, LiveLaw quoted Chief Justice Surya Kant saying there was "no question of stay" and that "through interim order, we will not introduce a regime which Parliament has thought of". Until an order or a fresh Gazette notification says otherwise, everything on the timeline runs exactly as notified.

Who is challenging the Act

The Supreme Court's own cause list of 23 March 2026, Chief Justice's Court, item 38, lists the lead petition with 4 connected matters, so the petition numbers and party names below rest on an official court record rather than on reporting:

A 6th petition, by Mazdoor Kisan Shakti Sangathan with Aruna Roy, Nikhil Dey and Shankar Singh, was reported in April 2026; it asks for the earlier RTI clause to be restored with retrospective effect. The grounds run under Article 14 (equality), Article 19(1)(a) (free expression, including the press) and Article 21 (life and personal liberty, the home of the right to privacy).

What exactly is challenged, and whether it operates yet

The target list is precise. The synopsis of the Nayak petition, as hosted by the Supreme Court Observer, asks the court to declare sections 17(1)(c), 17(2), 33(1), 36 and 44(3) of the DPDP Act 2023 and Rules 17 and 23(2) of the DPDP Rules 2025 ultra vires the Constitution.

Here is the detail most coverage skips: most of those provisions are not yet in force. Under commencement notification G.S.R. 843(E) and Rule 1 of the Rules, the challenged provisions split like this:

The computed date 13 May 2027 is interpretation until officially confirmed: the official text states an 18 month period from publication, not a calendar date. So the constitutional case is, for now, mostly about provisions whose operation is still ahead, with a large exception: the RTI amendment, which has been live since the day the commencement notification published.

The RTI amendment: what section 44(3) did

Section 44(3) of the DPDP Act is 1 sentence:

"In section 8 of the Right to Information Act, 2005, in sub-section (1), for clause (j), the following clause shall be substituted, namely:— "(j) information which relates to personal information;"."

Section 8(1) of the RTI Act lists the categories of information a public authority may refuse to disclose. After the substitution, the personal information category reads, in full, "information which relates to personal information". As the petitions describe the change in the reporting cited here, the clause it replaced was conditional: personal information could be withheld only where disclosure had no relationship to any public activity or interest or would cause unwarranted invasion of privacy, disclosure could still be ordered where the larger public interest justified it, and a proviso kept citizens level with legislators, so that information which could not be denied to Parliament or a State Legislature could not be denied to any person. The petitioners' case is that removing those conditions converts a balanced exemption into a blanket one, and that this violates Articles 14, 19(1)(a) and 21. No report of the Union Government's formal response had been found when this page was last reviewed on 6 October 2026.

A detail in the reporting matches the primary record exactly: per Law Trend's account of the April 2026 hearing, the Mazdoor Kisan Shakti Sangathan petition asks for the earlier clause to be restored with retrospective effect from 13 November 2025. That is the date section 44(3) came into force, because paragraph (a) of G.S.R. 843(E) put section 44(1) and (3) in the group that commenced on publication of the notification.

The state power strand: sections 17 and 36, Rule 23

The second strand of the challenge goes to how much room the Act leaves the Government itself. 3 provisions recur in the reporting.

Section 17(2)(a) allows the Central Government to exempt, by notification, processing "by such instrumentality of the State as the Central Government may notify, in the interests of sovereignty and integrity of India, security of the State, friendly relations with foreign States, maintenance of public order or preventing incitement to any cognizable offence relating to any of these". An exempted instrumentality steps outside the Act entirely for that processing. Section 17(1)(c) separately switches off most duties where processing serves the "prevention, detection, investigation or prosecution of any offence". The petition challenges the whole of section 17(2), which includes clause (b), the research, archiving and statistical exemption, and not clause (a) alone.

Section 36 is 1 sentence: "The Central Government may, for the purposes of this Act, require the Board and any Data Fiduciary or intermediary to furnish such information as it may call for."

Rule 23 supplies the machinery for section 36: authorised persons listed in the Seventh Schedule may require any Data Fiduciary or intermediary to furnish information for specified purposes within a specified period. Rule 23(2) then adds the provision the petitions single out:

"Where the disclosure of furnishing of information as referred to in sub-rule (1) is likely to prejudicially affect the sovereignty and integrity of India or security of the State, the Central Government may require the Data Fiduciary or intermediary to not disclose such furnishing to affected Data Principal or any other person except with the previous permission, in writing, of the authorised person."

In other words, a company handed an information demand can be ordered not to tell the people whose data it hands over. The petitioners, as reported, argue this combination enables surveillance without adequate safeguards; whether it does is exactly what the court has been asked to decide, and this site takes no position on the outcome.

The Board design strand: Rule 17

The petitions also reach the institution meant to enforce the Act. Rule 17(1) has the Central Government constitute a "Search-cum-Selection Committee, with the Cabinet Secretary as the chairperson" to recommend the Data Protection Board's Chairperson, joined by the Secretaries in charge of the Department of Legal Affairs and the Ministry of Electronics and Information Technology and 2 outside experts. Members are selected by a parallel committee under Rule 17(2). The reported argument is that a Board appointed this way, judging complaints that may run against government bodies, lacks structural independence; the counterargument, that section 28(1) obliges the Board to function as an independent body, is for the court. Rule 17 has operated since 13 November 2025, and how the Board actually handles complaints is covered in the Board complaint and appeal guide.

Hearing log

Dates and outcomes below are compiled from the Supreme Court Observer case page, LiveLaw, MediaNama, LawBeat, Law Trend and Business Standard, each recording proceedings it covered; all of it is secondary reporting of the court's orders.

16 February 2026. A bench of Chief Justice Surya Kant, Justice Joymalya Bagchi and Justice Vipul M Pancholi issued notice on the first 3 petitions and refused an interim stay. LiveLaw quoted the Chief Justice calling the matter complex but interesting, involving fundamental rights on both sides, and remarking that "some ironing out of the creases might be needed"; the petitions were sent for consideration by a larger bench.

12 March 2026. The court observed, per MediaNama, that determining what counts as public data and what counts as private data is central to the Act's validity, and issued notice on a connected petition, with the Geeta Seshu and SFLC.in petition bringing that distinction squarely before the court.

13 April 2026. Notice issued on the Mazdoor Kisan Shakti Sangathan petition against section 44(3), with the State of Rajasthan added as a party because the petition also defends proactive disclosure systems built on state transparency portals. The matter was listed for 13 May 2026.

7 August 2026. The court granted the Central Government 2 weeks to respond to the petitions against the RTI amendment, petitioners having argued that the change guts the transparency regime and impedes investigative journalism.

Where that leaves things. The 2 week window from 7 August 2026 ran out around 21 August 2026 (a computed date, interpretation); no further hearing or order had been reported when this page was last reviewed on 6 October 2026, and the Supreme Court Observer case page, read that day, still recorded the 7 August 2026 hearing as its latest, so nothing reported since contradicts the position the summary image above states for 23 August 2026. The stay and interim relief applications filed with the petitions were still shown as pending on the 23 March 2026 cause list, and no order deciding them has been reported since, so an interim order remains possible at any hearing. Several outlets describe the case as headed to a larger bench, some saying a Constitution Bench of 5 judges; the case page this article anchors on still shows the 3 judge bench, so treat the formal constitution of any larger bench as unconfirmed.

What this means if you are building DPDP compliance

Nothing about your obligations has changed, and nothing is likely to change without a clearly reported court order. Concretely, and offered as this site's recommendation rather than law:

• The commencement clock runs. Consent Manager registration opens with the 1 year group, computed at 13 November 2026, and the main obligations arrive with the 18 month group, computed at 13 May 2027, both interpretation until officially confirmed. A pending challenge with no stay does not pause either date, so check what applies to you and keep your company plan moving.
• The provisions most businesses spend money on, notice, consent, security safeguards, breach intimation, retention, rights handling, are not among the challenged provisions at all. The challenge aims at the RTI amendment, the exemption powers, the penalty mechanism and the Government's information demand powers.
• If the court eventually strikes down or reads down a challenged provision, the change will land in an order with a date, and this page and the timeline will record it with the same source discipline as everything else on this site.

How this page verifies its claims

Court proceedings produce two kinds of claims, and this page keeps them apart. What a provision says is quoted from the official Gazette texts on file with this site and labelled official. The petition numbers and party names come from the Supreme Court's own published cause list, an official court record. What the petitions ask comes from the filed synopsis as hosted by the Supreme Court Observer, cited for what it asks, never for the truth of its contentions. What happened in court, what was argued, what the judges said, is compiled from named court reporters, the Supreme Court Observer, LiveLaw, MediaNama, LawBeat, Law Trend and Business Standard, and labelled explanation, because this site has not read the certified orders. Where reports conflict or a fact rests on a single outlet, the text above says so. The full citation list, with a last verified date on every entry, is in the sources block below.