In the age of a fully realized Digital India, the need for adequate data protection is essential to safeguard citizens. The Digital Personal Data Protection Act 2023 (‘the Act’ or ‘the DPDPA’) is India’s first holistic piece of legislation that regulates how data can be stored and used. A long-awaited measure, the Act aims to balance the numerous requirements for raw data and the privacy of citizens. One part of the Act has been of particular interest since its introduction: the amendment to Section 8(1)(j) of the Right to Information Act 2005 (‘RTI Act’). Multiple petitions have been brought to the Supreme Court on the grounds that the DPDPA is unconstitutional and dilutes the protection afforded by the RTI Act. This article will discuss the main constitutional challenge against the DPDPA to evaluate the extent of its infringement on fundamental rights and whether it is justifiable.
What is the Digital Personal Data Protection Act 2023 (DPDPA)?
The two main features of the DPDPA in the context of this article are as follows:
Section 44(3) amends Section 8(1)(j) of the RTI Act by deleting a large portion of the clause.
‘Personal data’ is defined as data about an individual who is identifiable by or in relation to that data.
The individual who the data relates to is known as the ‘Data Principal’ and the entity that decides how the data is processed is the ‘Data Fiduciary’, establishing a fiduciary relationship between the two.
Previously, digital data processing was governed by the Information Technology Act 2000 and its subsequent Privacy Rules. The 2017 Supreme Court judgment in Justice K. S. Puttaswamy v. Union of India catalysed the birth of the DPDPA. The judgment recognized and entrenched the right to privacy as a fundamental right as part of Article 21 of the Constitution of India, the Right to Life & Liberty. Overruling previous Supreme Court judgments, the bench placed the right to privacy on the same standing as other fundamental rights; it can only be infringed upon if there is a compelling state interest. This applies not only to the State, but also to private entities.
A year later, in concert with experts from the UIDAI, MeitY and DSCI, a committee chaired by former SC Judge Justice B.N. Srikrishna proposed the Personal Data Protection Bill 2018 which was then introduced in Parliament (‘the 2019 Bill’). After further deliberations by a parliamentary committee, the 2019 Bill was withdrawn and re-submitted as the Digital Personal Data Protection Bill 2022. Consequently, the Act, while retaining some key aspects, provided the government wide discretionary powers, established a weak monitoring body rather than a regulatory one and revised Section 8(1)(j) of the Right to Information Act 2005 (‘the RTI Act).
The RTI Act and The DPDPA: Venkatesh Nayak v. Union of India
As the right to privacy is a fundamental right under Part III of the Constitution, it can be reasonably restricted by Parliamentary legislation on certain grounds such as public order, security of the state or threats to the sovereignty and integrity of India. Section 8(1)(j) of the RTI Act hinges on this feature; Disclosure of information related to “personal information” that cannot legally be withheld from Parliament or State legislature will be allowed in cases where the appellate authority is satisfied that it is justified by “larger public interest”. Essentially, this allows the judiciary to infringe on any citizen’s right to privacy if there is a public interest in doing so. Section 44(3) of the DPDPA alters this entire clause by making such information exempted from disclosure in any case. While this provision protects the right to privacy, it eradicates a mechanism of accountability and undermines the rule of law established in Article 14 of the Constitution.
Although Section 44(3) retains the first half of the original clause, the added context of the DPDPA’s definition of ‘personal data’ means there must be identifying information of a Data Principal in the information requested. This, so far, is unjustifiably broad. It is unclear how much relation there must be between the identifying details and the requested information. In the case of public functionaries, most of the information requested will inevitably feature details of the relevant public officials, i.e. names, positions, signatures, etc. The amendment now exempts information with any of these identifying aspects, realistically meaning no information on any government decision can be requested.
This issue is the basis of the constitutional challenge in Venkatesh Nayak v. Union of India where the petitioners have contested that Section 44(3) is effectively a blanket ban on demanding accountability from public officials. Given that PUCL v. Union of India and later K.S. Puttaswamy established that the privacy of public functionaries is secondary to citizens’ right to information, the original clause was a powerful tool to demand transparency. In practice, Section 8(1)(j) formulated a three-limbed test for the relevant Public Information Officer to determine whether disclosure is in the “larger public interest”; The information requested should not be related to any public activity, the invasion of privacy should not be unwarranted and there must be a public interest that overrides the right to privacy.
The third limb of Section 8(1)(j) required the Central Public Information Officer/State Public Information Officer to balance ‘public interest’ with the ‘right to access and right to know’. The Supreme Court in CPIO v. Subhash Chandra Agarwal held that this includes factoring inter alia the ‘purpose’ or ‘motive’ of the applicant, the consequences of invasion of the right to privacy, and possible harm and injury caused to the third party by disclosure. Additionally, it held that a decision by the Public Information Officer must have a clear reasoning that must be stated with the outcome. Both requirements are now null due to the amendment.
Consequentially, there may be little to no transparency in public decisions as there is no obligation for public bodies to justify non-disclosure. Venkatesh Nayak rightfully argues that Section 8(1)(j) was purposely drafted to provide a very narrow scope for exemptions. The amendment has excessively widened the scope to the point that any information can possibly be denied if it contains even the smallest of identifying details. Thus, the DPDPA has already strayed far from the original Parliamentary intention behind the RTI Act. Now, the right to information may survive in theory but it will be largely ineffective in practice.
The Reasoning and Significance of the Section 44(3) Amendment
A further question arises when we view the rest of Section 8: why was Section 8(1)(j) amended in such an extreme manner when the first nine sub-sections already protect a variety of sensitive information? In the case of Bihar Public Service Commission v. Saiyed Hussain Abbas Rizwi, the appellant (BPSC) strongly argued under Section 8(1)(g) that disclosure could endanger the life or physical safety of its Interview Board members. Considering this precedent, it seems redundant for Parliament to amend Section 8(1)(j) when the Supreme Court upheld this defense as a viable option.
However, it is possible that the clause had to be amended due to the preceding Section 8(1)(e) which exempts information in a fiduciary relationship unless there is a greater public interest that requires it. One of the DPDPA’s main features is that it establishes a fiduciary relationship between the Data Principal and the Data Fiduciary. When the Data Fiduciary is a public body, the threshold to prove a ‘greater public interest’ may be much lower, making this a weak defense. If read in conjunction with the ruling in the CPIO case, ‘public interest’ within the RTI Act simply means the general welfare of the public, in which the collective public has a stake. Therefore, the Section 8(1)(e) defense has a high likelihood of failing.
From this analysis, there seemingly was a need to provide such Data Fiduciaries with an adequate exemption rule by amending Section 8(1)(j). By attaching identifying details, Data Fiduciaries ensure that their information is exempt from disclosure. The deletion of the three-limbed test and the subsequent lack of a third-party decision-maker is fundamental to this objective. Previously, a denial of an information request had to be justified by the PIO and could be appealed via Section 19. The information would then be subject to judicial review. If the PIO’s reasoning was not sound, the court would order disclosure. With Section 44(3), this route of appeal and judicial review does not exist in relation to the so-called ‘personal information’.
Presently, it is strongly contended that the DPDPA is unconstitutional, as it unreasonably restricts the right to information, but is it justifiable for it to do so? A key issue the Indian legal system faces is an enormous backlog of cases and appeal. For example, Maharashtra: as of April 2026, the State Information Commission had more than 60,000 pending RTI second appeals and 14,430 pending complaints. Despite having disposed of a total of 84,569 cases between April 21st 2025 and May 31st 2026, the state continues to have the highest number of pending RTI cases in the country.
It is incontestable that much of the backlog has been due to the mismanagement and defunction of State Information Commissions. Unfortunately, it seems the legislature has chosen to address the issue of RTIs being filed rather than fix these systematic errors. Naturally, the backlog does technically exist due to the large number of complaints being filed. Decreasing the likelihood of success is an effective method to discourage people from filing RTIs and appealing rejections. While it may strip citizens of the right to information, it does give courts and the ICs an opportunity to clear the backlog. This is vital as case backlog enables litigation to stretch for years. Justice delayed is justice denied. Additionally, the costs of litigation disproportionately affect plaintiffs with fewer resources. Wealthy, upper-class individuals can afford to continue cases for longer periods while those without that monetary privilege are forced to withdraw complaints or accept unfair settlements. Consequently, the public could begin to lose faith in the procedural integrity of the legal system.
On the other hand, the backlog of RTI cases inevitably weakens citizens’ belief in accountability and transparency. India, as a representative democracy, provides its citizens the right to question their elected officials and the RTI spearheaded the practice of demanding disclosure of public decisions. When there are no routes to ask questions and no obligation to answer them, the executive’s power goes unchecked. India’s orthodox separation of powers model is a foundational part of the Constitution; it works to prevent concentration of power and ensure actions of one decision-maker are checked by another. Judicial review is an integral mechanism of this model and allows the judiciary to adjudicate whether decisions by the executive are lawful, fair, and constitutional.
Nevertheless, arguments can still be made for preventing judicial review. The executive and the legislature significantly consist of elected officials who aim to, ideally, enact the will of the people they represent. Allowing judges, who are unelected and therefore, not answerable to the people, to interfere with the autonomy of the executive risks judicial overreach. Furthermore, public officials are far more knowledgeable and specialised in their respective fields, as compared to judges. A decision to not disclose certain information on public activities may be more nuanced than at first glance, but this complexity may only be fully understood by the executive. Ultimately, the Central Government must choose between efficient decision-making or open governance, and the amendment of Section 8(1)(j) marks a movement towards the former.
THIS ARTICLE IS WRITTEN BY DEEKSHA SENTHIL KUMAR 2ND YEAR LLB STUDENT AT UCL .
REFERENCES :
Section 2(t), The Digital Personal Data Protection Act 2023 (No. 22 of 2023)
Justice K.S. Puttaswamy (Retd.) And Another v. Union of India and Others AIR 2017 AC 4161
The Constitution of India, art. 21
Committee of Experts under the Chairmanship of Justice B.N. Srikrishna, A Free and Fair Digital Economy: Protecting Privacy, Empowering Indians (July 2018)
The Digital Personal Data Protection Bill, 2022 (Ministry of Electronics and Information Technology)
The Constitution of India, art. 19
The Constitution of India, art. 14
Writ Petition (Civil) No. 177 of 2026
People’s Union for Civil Liberties (PUCL) v. Union of India AIR 1997 SC 568
Section 8(1)(j), The Right to Information Act, 2005 (No. 22 of 2005)
Central Public Information Officer, Supreme Court of India v. Subhash Chandra Agarwal 2020 5 SCC 481
The Right to Information Act, 2005 (No. 22 of 2005)
Bihar Public Service Commission v. Saiyed Hussain Abbas Rizwi & Anr (2012) 13 SCC 61
Section 8(1)(e), The Right to Information Act, 2005 (No. 22 of 2005)
Section 19, The Right to Information Act, 2005 (No. 22 of 2005)
Maharashtra State Information Commission, Report: Monthly Report Complaints April 2026
Satark Nagrik Sanganathan, Report: Report Card for Information Commissions in India 2023-2024 (2025)
Yashomati Ghosh, “Indian Judiciary: An Analysis of the Cyclic Syndrome of Delay, Arrears and Pendency,” 5(1) Asian Journal of Legal Education (2018)
Vairshala Aithala, Rathan Sudheer & Nandana Sengupta, “Justice Delayed: A District-Wise Empirical Study on Indian Judiciary,” 12(1) Journal of Indian Law and Society (2021)
M. Narmadha, “RTI Act’s Impact on Transparency and Accountability in Governance,” 2(7) International Journal for Legal Research and Analysis (2024)
The Constitution of India, art. 50 ; art. 32
The Constitution of India, art. 13; art.32; art.226
Vijayalakshmi K. Koradhanyamath, Sandeep.C.Desai, “Judicial Activism and Overreach In India,” 11(7) International Journal of Advanced Research (2023)
