NASSCOM: National: Tuesday, 01 September 2026.
The Digital Personal Data Protection Act, 2023 (DPDPA) establishes the framework for protecting digital personal data while enabling its lawful processing. The consequential amendment made to the Right to Information (RTI) Act, 2025 has raised a constitutional question: how should India reconcile the right to privacy with the citizen’s right to information?
Nasscom had highlighted
this issue during the stakeholder consultations in 2022 itself wherein we had
emphasised the right to personal data protection must not hamper the right to
information on matters of public interest.
The issue arises from Section 44(3) of DPDPA which amended Section 8(1)(j) of the Right to Information Act, 2005 (RTI Act). The amendment came into force on 13 November 2025. The principal challenge is presently before the Supreme Court in Venkatesh Nayak v. Union of India, W.P. (C) No. 177/2026 along with other connected petitions.
Amendment to the RTI Act via DPDPA
Section 8 of the RTI Act sets out information that public authorities are not obliged to disclose.
Prior to the amendment, Section 8(1)(j) provided a balanced exemption to:
information relating to personal information where disclosure had no relationship to public activity or interest, or would cause an unwarranted invasion of privacy, unless larger public interest justified disclosure.
It replaces this sub clause with this: “information which relates to personal information”.
Position before the amendment
A Public Information Officer (“PIO”) examining personal information was required to engage with questions such as: Is the information connected with a public activity or public interest? Would disclosure result in an unwarranted invasion of privacy? If privacy is implicated, does the larger public interest justify disclosure? This approach required a balancing exercise between transparency and privacy.
The Supreme Court’s Constitution Bench in CPIO, Supreme Court of India v. Subhash Chandra Agarwal (2019) emphasised that “the public interest test in the context of the RTI Act would mean reflecting upon the object and purpose behind the right to information, the right to privacy and consequences of invasion, and breach of confidentiality and possible harm and injury that would be caused to the third party, with reference to particular information and the person.” For the purpose of Section 8(1)(j), the Court also clarified that it would treat the word “information,” which if disclosed would lead to invasion of privacy, to mean personal information, as distinct from public information.
Legal position post Amendment
The specific language relating to: relationship with public activity or interest; unwarranted invasion of privacy; and “larger public interest” within Section 8(1)(j) has been removed. In other words, the newly substituted clause simply refers to information which relates to personal information and broadens the scope of exemption from disclosure.
What is the constitutional challenge before the Supreme Court
The petitions challenge several provisions of the DPDP Act and Rules. In relation to RTI, the principal challenge is to Section 44(3). The petition contends that the amendment infringes Articles 14, 19(1)(a) and 21 of the Constitution.
The petitioners’ argument is that the amended Section 8(1)(j) could operate as a much broader exemption from disclosure than the previous provision and information relating to a public official, public decision, public expenditure or the exercise of public power may contain personal information while simultaneously having substantial public significance. The petitioners argue that the amendment removes that balancing mechanism from Section 8(1)(j) and therefore weakens the constitutional right to information and the citizen’s right to know.
On the other hand, in a PIB statement, the government has stated that the amendment to the RTI Act does not prevent the disclosure of personal information. It simply requires that such information be assessed with care and shared only after considering the privacy interests involved. At the same time, Section 8(2) of the RTI Act remains fully operative which stipulates that a public authority may allow access to information, if public interest in disclosure outweighs the harm to the protected interests.
Core Issues before the Court
First, the amendment has not eliminated every public-interest route to disclosure under the RTI Act. This is because Section 8(2) of the RTI Act still allows disclosure where public interest outweighs the harm to the protected interest. However, before the DPDP amendment, Section 8(1)(j) itself required authorities to balance privacy against public interest when dealing with personal information. The amendment removed this specific balancing test and replaced it with a broader exemption for information relating to personal information.
Therefore, the legal question is not whether public interest can still justify disclosure. It is whether Section 8(2), along with the amended Section 8(1)(j), provides enough protection against the excessive withholding of personal information. This is one of the issues the Supreme Court may have to decide.
Second, the amended RTI provision uses the expression “personal information.” DPDPA, however, principally defines “personal data”, not “personal information”. Therefore, it does not expressly say that every reference to “personal information” in the RTI Act must automatically be interpreted using the DPDPA’s definition of personal data. This could become an important interpretive issue.
Given the need to harmonise two crucial individual rights, our objective should not be to choose any one right at the cost of the other one. It should be to establish rules that protect privacy without making legitimate accountability impossible, and preserve transparency without turning personal information into a public commodity. The Supreme Court’s judgement may shape the broader philosophy of India's digital governance framework.
The Digital Personal Data Protection Act, 2023 (DPDPA) establishes the framework for protecting digital personal data while enabling its lawful processing. The consequential amendment made to the Right to Information (RTI) Act, 2025 has raised a constitutional question: how should India reconcile the right to privacy with the citizen’s right to information?
The issue arises from Section 44(3) of DPDPA which amended Section 8(1)(j) of the Right to Information Act, 2005 (RTI Act). The amendment came into force on 13 November 2025. The principal challenge is presently before the Supreme Court in Venkatesh Nayak v. Union of India, W.P. (C) No. 177/2026 along with other connected petitions.
Amendment to the RTI Act via DPDPA
Section 8 of the RTI Act sets out information that public authorities are not obliged to disclose.
Prior to the amendment, Section 8(1)(j) provided a balanced exemption to:
information relating to personal information where disclosure had no relationship to public activity or interest, or would cause an unwarranted invasion of privacy, unless larger public interest justified disclosure.
It replaces this sub clause with this: “information which relates to personal information”.
Position before the amendment
A Public Information Officer (“PIO”) examining personal information was required to engage with questions such as: Is the information connected with a public activity or public interest? Would disclosure result in an unwarranted invasion of privacy? If privacy is implicated, does the larger public interest justify disclosure? This approach required a balancing exercise between transparency and privacy.
The Supreme Court’s Constitution Bench in CPIO, Supreme Court of India v. Subhash Chandra Agarwal (2019) emphasised that “the public interest test in the context of the RTI Act would mean reflecting upon the object and purpose behind the right to information, the right to privacy and consequences of invasion, and breach of confidentiality and possible harm and injury that would be caused to the third party, with reference to particular information and the person.” For the purpose of Section 8(1)(j), the Court also clarified that it would treat the word “information,” which if disclosed would lead to invasion of privacy, to mean personal information, as distinct from public information.
Legal position post Amendment
The specific language relating to: relationship with public activity or interest; unwarranted invasion of privacy; and “larger public interest” within Section 8(1)(j) has been removed. In other words, the newly substituted clause simply refers to information which relates to personal information and broadens the scope of exemption from disclosure.
What is the constitutional challenge before the Supreme Court
The petitions challenge several provisions of the DPDP Act and Rules. In relation to RTI, the principal challenge is to Section 44(3). The petition contends that the amendment infringes Articles 14, 19(1)(a) and 21 of the Constitution.
The petitioners’ argument is that the amended Section 8(1)(j) could operate as a much broader exemption from disclosure than the previous provision and information relating to a public official, public decision, public expenditure or the exercise of public power may contain personal information while simultaneously having substantial public significance. The petitioners argue that the amendment removes that balancing mechanism from Section 8(1)(j) and therefore weakens the constitutional right to information and the citizen’s right to know.
On the other hand, in a PIB statement, the government has stated that the amendment to the RTI Act does not prevent the disclosure of personal information. It simply requires that such information be assessed with care and shared only after considering the privacy interests involved. At the same time, Section 8(2) of the RTI Act remains fully operative which stipulates that a public authority may allow access to information, if public interest in disclosure outweighs the harm to the protected interests.
Core Issues before the Court
First, the amendment has not eliminated every public-interest route to disclosure under the RTI Act. This is because Section 8(2) of the RTI Act still allows disclosure where public interest outweighs the harm to the protected interest. However, before the DPDP amendment, Section 8(1)(j) itself required authorities to balance privacy against public interest when dealing with personal information. The amendment removed this specific balancing test and replaced it with a broader exemption for information relating to personal information.
Therefore, the legal question is not whether public interest can still justify disclosure. It is whether Section 8(2), along with the amended Section 8(1)(j), provides enough protection against the excessive withholding of personal information. This is one of the issues the Supreme Court may have to decide.
Second, the amended RTI provision uses the expression “personal information.” DPDPA, however, principally defines “personal data”, not “personal information”. Therefore, it does not expressly say that every reference to “personal information” in the RTI Act must automatically be interpreted using the DPDPA’s definition of personal data. This could become an important interpretive issue.
Given the need to harmonise two crucial individual rights, our objective should not be to choose any one right at the cost of the other one. It should be to establish rules that protect privacy without making legitimate accountability impossible, and preserve transparency without turning personal information into a public commodity. The Supreme Court’s judgement may shape the broader philosophy of India's digital governance framework.
.JPG)
.JPG)
