DPDP Act vs RTI Act: Privacy, Transparency and the Supreme Court Challenge

UPSC Polity & Governance Editor | Covers the Constitution, Judiciary, RTI and Digital Governance

India spent two decades building a legal architecture around a citizen's right to ask the State a simple question: why?

Why was a contract awarded? Why was a welfare application rejected? Who was responsible for a public decision? How was public money spent?

The Right to Information Act, 2005 turned such questions into legally enforceable claims against public authorities. India's new data protection framework creates an equally important obligation: personal information cannot be treated as though privacy does not matter.

The constitutional difficulty begins when those principles collide.

In 2026, the Supreme Court is considering challenges to provisions of the Digital Personal Data Protection Act, 2023. The Supreme Court's official cause list for 7 August 2026 lists W.P.(C) No. 177/2026, Venkatesh Nayak v Union of India. The pending challenge includes the effect of the DPDP Act's amendment to Section 8(1)(j) of the RTI Act, according to the case record maintained by Supreme Court Observer.

For UPSC aspirants, this is not merely a dispute between two statutes. It sits at the intersection of Fundamental Rights, accountability, judicial review and digital governance.

The deeper question is this:

How can India protect citizens from unnecessary disclosure of personal information without allowing privacy to become a shield around the exercise of public power?

For the constitutional foundation behind this debate, it is useful to first revise Fundamental Rights under the Indian Constitution.

The Legal Change: What Section 44(3) Actually Did

The controversy becomes easier to understand once the old and new versions of Section 8(1)(j) of the RTI Act are separated.

Before the amendment, Section 8(1)(j) contained a relatively detailed test for withholding personal information.

Under the earlier text of the RTI Act available through India Code, personal information could be withheld where it had no relationship to a public activity or public interest, or where disclosure would cause an unwarranted invasion of privacy.

Even then, the provision allowed disclosure where the larger public interest justified it. It also contained a proviso concerning information that could not be denied to Parliament or a State Legislature.

That statutory structure changed through Section 44(3) of the Digital Personal Data Protection Act, 2023.

The official text of the DPDP Act on India Code substitutes Section 8(1)(j) with a much shorter clause:

“information which relates to personal information”

The MeitY commencement notification dated 13 November 2025 brought Section 44(3) into force from the date of publication.

The current India Code version of the RTI Act therefore now contains this shorter formulation.

This is the central statutory change behind the present privacy versus transparency debate.

Section 17 Matters, but It Is Not the RTI Amendment

One of the easiest mistakes in analysing this controversy is to treat Section 17 of the DPDP Act and Section 44(3) as though they perform the same function.

They do not.

Section 17 of the DPDP Act creates exemptions from specified parts of the data protection framework in situations such as enforcement of legal rights, judicial or regulatory functions, investigation or prosecution of offences and certain processing by notified State instrumentalities for specified security and public-order interests.

But Section 17 did not amend the RTI Act.

Section 44(3) did.

There is also an important commencement issue.

Under the 13 November 2025 Gazette notification, Section 44(3) came into force immediately, while Sections 11 to 17 were scheduled to come into force eighteen months after publication of the notification.

Therefore, as of August 2026, Section 17 is not yet the operative provision determining whether an RTI request for personal information is refused.

For UPSC answers, this distinction matters because it separates three different questions:

1. What the DPDP Act says about exemptions from data-protection obligations.
2. What Section 44(3) changed in the RTI Act.
3. Which provisions are actually in force at the time of analysis.

Conflating these questions can produce a legally incorrect answer.

Did the DPDP Act Remove the Public Interest Test Completely?

This requires an important qualification.

It is accurate to say that the amended Section 8(1)(j) no longer contains the specific balancing language that previously appeared within that clause.

It is not accurate to say that the RTI Act now contains no public-interest override at all.

Section 8(2) still exists.

The current RTI Act provides that, notwithstanding the exemptions under Section 8(1), a public authority may allow access where:

“public interest in disclosure outweighs the harm to the protected interests.”

This distinction changes the quality of the constitutional debate.

The question is no longer simply:

Did Parliament abolish public interest from the RTI framework?

A more precise question is:

What happens when the specific safeguards previously embedded in Section 8(1)(j) disappear, even though the general public-interest override in Section 8(2) survives?

That is a much stronger way to frame the issue in a UPSC Mains answer.

For the wider institutional context, see PrepAiro's explainer on the Right to Information Act, its challenges and possible reforms.

Why the Amendment Can Still Change Administrative Behaviour

A legal safeguard can continue to exist while becoming more difficult to invoke in practice.

Consider an RTI application seeking records concerning a public official.

The file may contain a mixture of information:

• the officer's name and designation
• an official decision
• disciplinary material
• financial information
• a residential address
• medical information
• correspondence concerning the exercise of public duties

Not every item deserves the same privacy treatment.

Under the earlier Section 8(1)(j), the statutory language itself directed the Public Information Officer towards questions about public activity, public interest, privacy and larger public interest.

The amended clause begins from a much broader formulation: whether the material “relates to personal information”.

That does not automatically make every record containing a person's name secret. Section 8(2), Section 10, other provisions of the RTI Act and constitutional principles remain relevant.

But the amendment can still alter the first stage of administrative decision making.

An authority may invoke Section 8(1)(j). The applicant may then have to argue for disclosure under Section 8(2), seek partial disclosure, or pursue the appellate mechanism.

The practical burden can therefore shift even if the legal possibility of disclosure has not disappeared completely.

That is why implementation matters as much as statutory wording.

Article 19(1)(a) and the Right to Information

The constitutional dimension begins with freedom of speech and expression.

Indian constitutional jurisprudence has treated access to information necessary for democratic participation as part of the freedom protected by Article 19(1)(a).

The Supreme Court's 2024 Electoral Bonds judgment revisited this jurisprudence and traced the right to information to Article 19(1)(a), particularly where information enables meaningful democratic participation.

This matters because transparency is not merely administrative convenience.

Citizens need information in order to scrutinise power, evaluate decisions, participate in democracy and hold institutions accountable.

The RTI Act gives a statutory mechanism through which that democratic interest can be exercised against public authorities.

Privacy Is Also a Fundamental Right

Transparency does not operate in a constitutional vacuum.

In Justice K.S. Puttaswamy v Union of India, a nine-judge Bench of the Supreme Court recognised privacy as a constitutionally protected fundamental right.

The Supreme Court's Electoral Bonds judgment, while discussing Puttaswamy, reiterates the constitutional protection of privacy and specifically considers informational privacy.

This prevents the DPDP versus RTI debate from being reduced to a simple contest between a “good” right and a “bad” restriction.

A citizen needs privacy against unnecessary State or institutional intrusion.

The same citizen needs transparency to scrutinise how public power is exercised.

Both principles constrain arbitrary power, but they operate in different directions.

Privacy Does Not Automatically Mean Secrecy

Recognising privacy as a fundamental right does not mean that every record containing personal information must remain confidential in every circumstance.

At the same time, invoking transparency does not mean that the State should disclose every personal detail it possesses.

A person's medical history, private address, personal identification documents or intimate family information may raise serious privacy concerns.

Information showing how a public authority exercised statutory power, allocated public funds, conducted a recruitment process or took an administrative decision raises a different set of accountability interests.

The challenge is therefore to distinguish between:

information whose disclosure unnecessarily exposes an individual

and

information whose disclosure is necessary to understand the exercise of public power.

That distinction becomes particularly important when the same government document contains both.

The Supreme Court Has Already Recognised That Privacy and Information May Need Balancing

The constitutional structure does not necessarily require one right to defeat the other automatically.

In its 2024 Electoral Bonds judgment, the Supreme Court considered a conflict between the right to information and informational privacy.

Importantly, the Court observed that the Constitution does not create a hierarchy between those rights in that context and applied a balancing approach.

The DPDP and RTI controversy arises in a different statutory setting, so the Electoral Bonds decision does not predetermine the outcome of the present challenge.

But the constitutional principle is useful.

When two protected interests collide, the answer need not be absolute secrecy or unrestricted disclosure. Courts can examine whether the legal framework has created a proportionate and constitutionally defensible balance.

Why “Personal Information” Is Now the Critical Phrase

The amended Section 8(1)(j) is extremely short.

That simplicity creates a major interpretive problem because modern government records are full of information connected to identifiable people.

A welfare database contains beneficiary details.

A government contract identifies officials and private contractors.

A recruitment process contains candidate information.

A disciplinary proceeding concerns an employee.

An inspection report may identify officers, witnesses, complainants or beneficiaries.

A public procurement file may contain signatures, contact details and the names of officials who approved expenditure.

If the mere presence of personal information were sufficient to make the entire record inaccessible, large areas of public administration could become difficult to scrutinise.

Conversely, treating every piece of information associated with a public authority as automatically public could expose individuals to unnecessary harm.

This is the interpretive tension at the heart of the litigation.

Section 10 Provides an Important Middle Path: Redaction

The RTI Act already contains a mechanism capable of reducing this conflict.

Section 10 deals with severability.

The current India Code text of Section 10 allows access to the portion of a record that does not contain exempt information where that material can reasonably be separated from the protected portion.

This creates an important alternative to the false binary of:

disclose everything versus disclose nothing.

Suppose a government file contains:

• an official decision
• expenditure details
• the name and designation of the decision-making authority
• a beneficiary's home address
• medical information
• a private mobile number

Where the law permits, the genuinely private fields can potentially be severed while the non-exempt part of the record remains available.

In other words, privacy does not always require secrecy.

Sometimes it requires careful redaction.

For public administration, this may be one of the most practical mechanisms for reconciling the competing interests involved.

Why the State Has a Legitimate Privacy Concern

A serious analysis must also recognise the government's side of the constitutional problem.

Public authorities now hold enormous volumes of personal data.

Records that were once stored in isolated paper files may now exist in searchable databases and interconnected digital systems. Once sensitive information is released digitally, it can be copied, indexed and redistributed at enormous scale.

Unnecessary disclosure of addresses, financial information, medical records, identity documents or family information can expose individuals to fraud, harassment or other harm.

A modern information regime therefore needs meaningful privacy protection.

The constitutional criticism cannot simply be that the State is protecting personal information.

The more difficult question is whether the mechanism used to protect privacy is sufficiently precise to prevent legitimate accountability information from being withheld at the same time.

The Risk of Privacy Becoming Bureaucratic Convenience

Public administration also creates incentives in the opposite direction.

Disclosure can reveal delays, irregular expenditure, conflicts of interest, inconsistent decisions, disciplinary failures and administrative mistakes.

A broadly worded exemption can therefore create an institutional temptation to refuse first and leave the applicant to challenge the decision later.

This matters because RTI is not used only by journalists, researchers or activists.

It may be used by:

• pensioners trying to understand delayed payments
• welfare beneficiaries challenging rejection of claims
• families seeking information about administrative decisions
• workers pursuing service-related records
• citizens questioning local expenditure
• applicants examining recruitment or selection procedures

If obtaining legitimate accountability information increasingly requires repeated appeals, the formal existence of a right may not accurately describe the citizen's practical experience of exercising it.

The quality of an information regime must therefore be judged both by what courts can eventually order and by what an ordinary citizen can realistically obtain from the first public authority.

Digital Governance Makes the Conflict More Important, Not Less

The DPDP versus RTI dispute is part of a much larger transformation in Indian governance.

Governments are becoming increasingly data intensive.

Welfare delivery uses databases. Recruitment processes are digitised. Identity systems interact with public services. Administrative decisions create electronic records. Public authorities collect and process information at a scale that earlier generations of governance law did not have to confront.

That produces a constitutional paradox.

The more data the State possesses about individuals, the stronger the need for privacy protection becomes.

At the same time, the more public power is exercised through complex digital systems, the stronger the need for transparency and accountability becomes.

This is why the dispute connects directly with the wider UPSC debate around India's digital governance model and the citizen's place within it.

Data protection and transparency cannot be designed as separate governance silos. They increasingly regulate the same administrative State.

What Should the Supreme Court Clarify?

The petitions are pending, so it would be incorrect to present any preferred interpretation as though it were already the law declared by the Court.

However, the litigation raises several questions that a durable constitutional settlement may need to address.

1. How broad is “personal information” under the amended RTI exemption?

The Court may need to clarify whether the presence of information connected with an identifiable individual is, by itself, enough to justify withholding an entire record.

2. How should Section 8(2) operate after the amendment?

The general public-interest override remains in the statute. Its practical relationship with the new Section 8(1)(j) will therefore be crucial.

3. How should public functions affect the privacy analysis?

Information about a person's private life and information concerning that person's exercise of official power do not necessarily raise identical constitutional interests.

4. What role should Section 10 severability play?

If private information can reasonably be removed while the accountable portion of a document is disclosed, redaction may often provide a less restrictive solution than complete refusal.

5. What standards should guide Public Information Officers?

Clear administrative standards matter because constitutional rights are experienced first through routine decisions by public authorities, not only through eventual litigation before constitutional courts.

The objective should be neither automatic disclosure nor automatic secrecy.

It should be a legally structured method of deciding what genuinely requires privacy protection and what democratic accountability requires citizens to know.

UPSC Mains Perspective

This issue is especially important for GS Paper II because it connects several syllabus areas at once:

• Fundamental Rights
• freedom of speech and expression
• right to privacy
• transparency and accountability
• Right to Information
• judiciary and judicial review
• citizen-centric administration
• e-governance
• institutional accountability
• impact of technology on governance

It can also strengthen Essay and Ethics answers because it demonstrates an important constitutional principle: rights do not always operate in isolation.

A strong UPSC answer should avoid simplistic statements such as:

“DPDP has abolished public-interest disclosure under RTI.”

That is too broad because Section 8(2) continues to exist.

A better formulation would be:

“Section 44(3) of the DPDP Act has replaced the detailed personal-information exemption in Section 8(1)(j) of the RTI Act with a broader formulation. Although the general public-interest override under Section 8(2) and the severability mechanism under Section 10 remain, the amendment raises questions about how privacy and transparency will be balanced in administrative practice.”

That formulation is more precise, legally defensible and useful in a Mains answer.

A Simple Framework for Answer Writing

If this issue appears in a UPSC Mains question, structure the answer through four layers.

First, identify the statutory change. Section 44(3) of the DPDP Act substituted Section 8(1)(j) of the RTI Act.

Second, identify what still survives. Section 8(2) continues to provide a general public-interest override, while Section 10 retains severability.

Third, identify the constitutional rights. The right to information is connected with Article 19(1)(a), while privacy has constitutional protection following Puttaswamy.

Fourth, provide a balanced way forward. Focus on proportionality, meaningful application of the public-interest test, redaction where possible, clear guidance for Public Information Officers and protection against both unnecessary exposure and unnecessary secrecy.

This avoids turning a complex constitutional controversy into a one-sided argument.

Conclusion

The Supreme Court's examination of the relationship between the DPDP framework and the RTI Act goes beyond statutory drafting.

It concerns the architecture of democratic accountability in a data-driven State.

India's institutions possess more personal information about citizens than ever before. That makes privacy indispensable.

At the same time, citizens increasingly depend on access to records and data to understand how government decisions are taken. That makes transparency indispensable too.

Section 44(3) has undeniably changed the legal structure of the personal-information exemption under the RTI Act. But it has not erased the rest of the statute. Section 8(2)'s public-interest override remains. Section 10's severability mechanism remains. Constitutional principles governing privacy, information and democratic accountability remain.

The challenge is therefore not to choose between privacy and transparency.

It is to ensure that privacy protects individuals from unnecessary exposure without becoming an unnecessary shield around public power.

That is the constitutional balance the present debate ultimately places before India.