Moneylife: New Delhi: Wednesday, 27 May 2026.
The Supreme Court on
Tuesday issued notice to the Union government on a batch of petitions
challenging provisions of the Digital Personal Data Protection (DPDP) Act, 2023
and the Digital Personal Data Protection Rules, 2025, particularly amendments
affecting the Right to Information (RTI) Act.
A bench comprising chief justice of India (CJI) Surya Kant and justice Joymalya Bagchi agreed that the matter required consideration and sought the Centre’s response.
Among the petitions before the court is one filed by Newslaundry challenging Section 8(1)(j) of the RTI Act, which deals with exemption from disclosure of personal information under the transparency law.
The challenge assumes significance because Section 44(3) of the DPDP Act substantially altered the language of Section 8(1)(j) of the RTI Act, 2005.
Before the amendment, the RTI provision exempted disclosure only where personal information had no relationship to public activity or public interest, or where disclosure would amount to an unwarranted invasion of privacy. It also contained a ‘larger public interest’ override allowing disclosure if public interest justified it. In addition, information that could not be denied to Parliament or a state legislature could not be denied to citizens.
After the amendment introduced through the DPDP Act, the clause was reduced to a much broader exemption covering information ‘which relates to personal information’.
Petitioners have argued that the change effectively creates a blanket exemption that can be used by public authorities to deny access to records merely by classifying them as personal information.
The petitions contend that the amendment removes three crucial safeguards embedded in the earlier RTI framework the public activity test, the unwarranted invasion of privacy test and the larger public interest override.
They have argued that the amended provision violates citizens’ right to information and the right to know under Article 19(1)(a) of the Constitution.
The challenge also relies on the Supreme Court’s 2019 judgment in central public information officer (CPIO), Supreme Court of India vs Subhash Chandra Agarwal, where the court held that personal information could still be disclosed under the RTI Act if it had a reasonable nexus with public activity and larger public interest.
The petitioners have further challenged multiple provisions of the DPDP Act and Rules, including Sections 17, 18, 33 and 36 of the law.
Section 17(1)(c), which permits processing of data in the interest of prevention, detection, investigation or prosecution of offences, and Section 17(2), which exempts government agencies from the law on grounds including sovereignty, security of the state and public order, have been criticised for allegedly enabling excessive state surveillance without adequate safeguards.
The petitions also question Rule 23(2) of the DPDP Rules, 2025, which prevents intermediaries or data fiduciaries from informing users if their information has been shared with the Union government in matters linked to national security or sovereignty concerns.
Another challenge concerns the composition of the proposed data protection board of India under Section 18 of the Act. Petitioners have alleged ‘executive dominance’ in the appointment mechanism under Rules 17(1) and 17(2), arguing that it undermines institutional independence and violates the principle of separation of powers.
Section 33(1), dealing with penalties for ‘significant’ data breaches, has also been challenged on grounds of vagueness, with petitioners arguing that the law provides no statutory guidance on what constitutes a significant breach.
The DPDP Rules, 2025, notified by the Union government in November last year, operationalised key portions of India’s data protection framework following the enactment of the DPDP Act in August 2023. The legislation was introduced after the Supreme Court’s landmark 2017 judgment in Justice KS Puttaswamy vs Union of India, which recognised privacy as a fundamental right under Article 21.
However, transparency activists, journalists and former information commissioners have argued that the RTI amendments embedded within the DPDP framework fundamentally weaken public accountability mechanisms.
Former central information commissioner M Sridhar Acharyulu had described the RTI amendment as a change that ‘destroyed transparency’, arguing that the removal of the public interest override would make it easier for authorities to deny information related to public servants’ conduct, assets, welfare schemes and expenditure of public funds. (Read: How the Data Law Killed RTI: Exempting ‘Journalistic Purpose’ Threatens Freedom of Expression)
The case could become one of the most consequential constitutional challenges involving the balance between privacy rights and transparency obligations since the enactment of the RTI Act in 2005.
A bench comprising chief justice of India (CJI) Surya Kant and justice Joymalya Bagchi agreed that the matter required consideration and sought the Centre’s response.
Among the petitions before the court is one filed by Newslaundry challenging Section 8(1)(j) of the RTI Act, which deals with exemption from disclosure of personal information under the transparency law.
The challenge assumes significance because Section 44(3) of the DPDP Act substantially altered the language of Section 8(1)(j) of the RTI Act, 2005.
Before the amendment, the RTI provision exempted disclosure only where personal information had no relationship to public activity or public interest, or where disclosure would amount to an unwarranted invasion of privacy. It also contained a ‘larger public interest’ override allowing disclosure if public interest justified it. In addition, information that could not be denied to Parliament or a state legislature could not be denied to citizens.
After the amendment introduced through the DPDP Act, the clause was reduced to a much broader exemption covering information ‘which relates to personal information’.
Petitioners have argued that the change effectively creates a blanket exemption that can be used by public authorities to deny access to records merely by classifying them as personal information.
The petitions contend that the amendment removes three crucial safeguards embedded in the earlier RTI framework the public activity test, the unwarranted invasion of privacy test and the larger public interest override.
They have argued that the amended provision violates citizens’ right to information and the right to know under Article 19(1)(a) of the Constitution.
The challenge also relies on the Supreme Court’s 2019 judgment in central public information officer (CPIO), Supreme Court of India vs Subhash Chandra Agarwal, where the court held that personal information could still be disclosed under the RTI Act if it had a reasonable nexus with public activity and larger public interest.
The petitioners have further challenged multiple provisions of the DPDP Act and Rules, including Sections 17, 18, 33 and 36 of the law.
Section 17(1)(c), which permits processing of data in the interest of prevention, detection, investigation or prosecution of offences, and Section 17(2), which exempts government agencies from the law on grounds including sovereignty, security of the state and public order, have been criticised for allegedly enabling excessive state surveillance without adequate safeguards.
The petitions also question Rule 23(2) of the DPDP Rules, 2025, which prevents intermediaries or data fiduciaries from informing users if their information has been shared with the Union government in matters linked to national security or sovereignty concerns.
Another challenge concerns the composition of the proposed data protection board of India under Section 18 of the Act. Petitioners have alleged ‘executive dominance’ in the appointment mechanism under Rules 17(1) and 17(2), arguing that it undermines institutional independence and violates the principle of separation of powers.
Section 33(1), dealing with penalties for ‘significant’ data breaches, has also been challenged on grounds of vagueness, with petitioners arguing that the law provides no statutory guidance on what constitutes a significant breach.
The DPDP Rules, 2025, notified by the Union government in November last year, operationalised key portions of India’s data protection framework following the enactment of the DPDP Act in August 2023. The legislation was introduced after the Supreme Court’s landmark 2017 judgment in Justice KS Puttaswamy vs Union of India, which recognised privacy as a fundamental right under Article 21.
However, transparency activists, journalists and former information commissioners have argued that the RTI amendments embedded within the DPDP framework fundamentally weaken public accountability mechanisms.
Former central information commissioner M Sridhar Acharyulu had described the RTI amendment as a change that ‘destroyed transparency’, arguing that the removal of the public interest override would make it easier for authorities to deny information related to public servants’ conduct, assets, welfare schemes and expenditure of public funds. (Read: How the Data Law Killed RTI: Exempting ‘Journalistic Purpose’ Threatens Freedom of Expression)
The case could become one of the most consequential constitutional challenges involving the balance between privacy rights and transparency obligations since the enactment of the RTI Act in 2005.
.JPG)
.JPG)
