DPDP Act and RTI Act: Is the Balance Tilting Toward Secrecy?
DPDP Act amendments are before the Supreme Court, a case whose outcome could impact RTI Act transparency and citizens’ right to know.
DPDP Act and RTI Act: When Privacy Overrides Citizen’s Right to Know
For more than two decades, India’s transparency regime rested on the principle that citizens have a right to know how public power is exercised, even when that information concerns individuals in government service. Under the RTI Act, disclosure of official decisions, records of appointments, and declarations of assets could be compelled where there was a legitimate public interest.
Support Independent Journalism. Public interest stories that affect ordinary citizens — especially those without power or voice — requires time, resources, and independence. Your support — even a modest contribution — allows us to uncover stories that would otherwise remain hidden. Support The Probe by contributing to projects that resonate with you (Click Here), or Become a Member of The Probe to stand with us (Click Here). |
A citizen who sought to understand why a government officer was promoted, for example, could press for the relevant records on the grounds that they bore directly on the fairness of the decision. Similarly, routine disclosures of assets and liabilities declared by public servants were generally treated as disclosable under the RTI Act, reflecting the view that transparency in public life is a necessary element of democratic accountability. In such cases, the potential invasion of personal privacy was weighed against the larger public interest; when the balance favoured openness, disclosure followed.
That balance is now at the centre of controversy following the enactment of the DPDP Act and its amendments to the RTI Act. Under the revised regime, information that can be characterised as “personal data” may be withheld without the kind of balancing that previously governed requests under the RTI Act. In practical terms this means that a promotion record could be denied on the basis that it contains personal information, even where the public interest in accountability is clear.
Also Read: CIC Imposes Penalty on DGHS in Artemis Hospital Case, The Probe Impact
Likewise, declarations of assets by public officials may now be treated as personal data and thus withheld. Beyond questions of official accountability, the DPDP Act also provides broad exemptions allowing government agencies to collect and process data for reasons of crime prevention, sovereignty and security without informing the individual, without a hearing, and without independent review. In some cases, a person might not even know that their data has been collected.
This shift has prompted a Public Interest Litigation in the Supreme Court challenging the amendments, and on 16 February 2026, the court heard preliminary arguments and issued notice to the Union government in the case. The significance of the dispute extends beyond any single statutory provision, as it carries broader implications for transparency, accountability, and democratic participation.
The Constitutional Foundation of the Right to Know
For two decades, the RTI Act has been regarded not simply as an administrative reform, but as a statutory expression of a deeper constitutional principle. The Supreme Court has consistently held that the right to information and the broader right to know flow from Articles 19(1)(a) and 21 of the Constitution — the freedoms of speech and expression and the right to life and personal liberty. The PIL before the Supreme Court quoted decisions such as PUCL v. Union of India (2003), Union of India v. Association for Democratic Reforms (2002) and Reliance Petrochemicals v. Proprietors of Indian Express Newspapers (1988) in which the Court affirmed that democracy requires informed citizens. Parliament enacted the RTI Act in 2005 to operationalise that understanding.
The law mandated proactive disclosures under Section 4(1)(b), confined exemptions under Section 8(1) to specific and limited grounds, placed the burden of justifying denial on the Public Information Officer, and made clear that an applicant’s reasons for seeking information were irrelevant. In both design and philosophy, the RTI Act treated transparency as the rule and secrecy as the exception.
The Amendment and the Emerging Dispute
It is this framework that has now been drawn into dispute. The PIL filed by Venkatesh Nayak, a well-known RTI activist and Director of the Commonwealth Human Rights Initiative, contends that the DPDP Act has significantly altered the balance embedded in the RTI Act.
Also Read: Delhi High Court Flags Regulatory Failures at Saroj Hospital | Impact
Section 44(3) of the DPDP Act, brought into effect on 13 November 2025, amends Section 8(1)(j) of the RTI Act by substituting the earlier, more detailed exemption clause with a broader formulation covering “information which relates to personal information.” The earlier provision required a determination of whether disclosure would cause an unwarranted invasion of privacy and preserved a public interest override. The petition argues that the revised language expands the scope for withholding information, particularly where the records concern public officials performing public duties. In effect, the DPDP Act introduces a new interpretive centre of gravity into the RTI Act, one that privileges data protection over disclosure.
The Three Checks That Once Governed Disclosure
To understand the depth of the dispute, it is necessary to examine what precisely has changed within the RTI Act. Under the earlier version of Section 8(1)(j), a public authority could not deny information merely by describing it as “personal.” The provision required a structured inquiry.
First, officials had to consider whether the information related to a public activity or public duty. Second, they were required to assess whether disclosure would amount to an unwarranted invasion of privacy. Third, even if the information was personal, they had to determine whether a larger public interest justified disclosure.
These three checks created a balancing framework within the RTI Act, ensuring that privacy concerns were addressed without automatically defeating transparency. In practice, this meant that information about public servants acting in their official capacity — promotions, disciplinary records, declarations of assets — could not be withheld without reasoned justification.
The petition challenging the amendment argues that the DPDP Act, by substituting the earlier clause with a broader reference to “personal information,” removes this layered balancing exercise. According to the petitioner, the revised language permits authorities to deny access to any information that can be characterised as personal data, without undertaking the prior structured analysis of public activity, unwarranted invasion, or larger public interest.
In effect, the concern is that the DPDP Act reshapes the functioning of the RTI Act by altering the internal test that once governed disclosure. Where the earlier regime required privacy to be weighed against transparency, the amended framework is said to tilt decisively toward non-disclosure.
Building on this shift in the disclosure framework, the petitioner argues that the amendment introduced through the DPDP Act makes it significantly easier for authorities to withhold information under the RTI Act. The challenge contends that this change unfairly restricts the constitutional right to know, which flows from the guarantee of free speech and expression under Article 19(1)(a).
While the right to privacy has been recognised as part of Article 21, the petitioner maintains that it cannot operate as a blanket ground to override transparency, particularly when invoked by the State. Article 19(2), which sets out the permissible grounds for restricting free speech, does not expressly list privacy as one of them.
The petition further argues that the amendment fails the test of proportionality because it imposes a broad and undifferentiated restriction, treating public officials exercising public power in the same manner as private individuals, and granting officials wide discretion to refuse disclosure.
Speaking to The Probe, the petitioner Venkatesh Nayak said, “The amendments to the RTI Act were made without giving any rationale for their necessity or conducting any kind of widespread public consultation. The removal of parity between the citizenry and their elected representatives in terms of information access is a body blow to the regime of transparency that the Act had set out to establish. The amendments also are oblivious of the balancing that is required to be done while giving effect to the fundamental right to know and people's right to personal data protection. The amendments throw into a black box, all personal information especially that of public functionaries created in relation to the performance of their public duties. Such regressive legislation deserves to be challenged in the Apex Court. In fact it is the moral duty of every citizen to seek constitutional remedies against the curtailment of fundamental rights. I am glad that the Supreme Court has recognised the need for balancing RTI with the right to digital personal data privacy and issued notice to the Government to respond to the grounds and pleas contained in the petitions.”
When Access Shrinks, Oversight Shrinks
Democracy does not function only through elections; it relies on the steady flow of information between the State and its citizens. Over the years, the RTI Act became one of the principal tools through which ordinary people, journalists and civil society groups examined how decisions were made and resources were allocated. The concern raised in the challenge to the DPDP Act is that this everyday scrutiny may now become more difficult.
Also Read: Mussoorie Forest Scam: HC Notices Expose a Crisis of Governance
If a wider range of records can be withheld on the ground that they contain personal data, routine inquiries into administrative functioning could face new barriers. The petitioner argues that this shifts the culture of governance from one where disclosure must be justified to one where refusal becomes easier to sustain.
In that sense, the debate is not only about privacy or procedure; it is about whether the RTI Act will continue to operate as a practical instrument of civic oversight, or whether the amendments introduced by the DPDP Act will gradually narrow the space through which citizens engage with the workings of the State.
Oversight, Exemptions and the Direction of Reform
The challenge to the DPDP Act is not limited to its impact on the RTI Act. It also questions the structure and independence of the Data Protection Board, the body created to enforce the new regime. According to the petition, the process of appointing members of the Board is dominated by the executive, even though the Board performs quasi-judicial functions such as determining breaches and imposing penalties.
When a body exercises powers that resemble those of a court, the expectation is that it functions with a degree of institutional independence. The concern raised is that if the executive effectively controls appointments, the Board may struggle to act as an impartial regulator-particularly in cases involving the government itself. In that sense, the design of the enforcement mechanism under the DPDP Act becomes central to the broader debate about accountability.
Beyond appointments, the petition points to several provisions that it characterises as constitutionally problematic. Certain sections of the DPDP Act allow the government to exempt its own agencies from compliance in specified circumstances. Other provisions permit data collection and processing for reasons such as security or crime prevention, without what the petitioner considers adequate procedural safeguards. There are also concerns about vague standards-for instance, penalties tied to “significant” data breaches without a clear statutory definition of what qualifies as significant.
In addition, the government is empowered in some situations to call for information from the Data Protection Board, again without narrowly defined limits. Taken together, these features are described in the petition as arbitrary and lacking sufficient checks, potentially engaging Articles 14, 19 and 21 of the Constitution.
The larger apprehension is that the cumulative effect of these changes could reshape India’s transparency landscape. Over the past twenty years, the RTI Act helped institutionalise a culture in which access to information became a routine aspect of civic engagement. The argument now advanced is that, while the objective of protecting personal data is legitimate, the manner in which the DPDP Act interacts with the RTI Act risks narrowing that culture of openness.
The PIL has pressed the Supreme Court to strike down specific provisions of the DPDP Act and the accompanying Rules on the ground that they violate fundamental constitutional guarantees. It seeks a declaration that Section 44(3) of the DPDP Act, which amends the RTI Act, as well as Rule 17 of the Digital Personal Data Protection Rules, 2025, are unconstitutional for infringing Articles 14, 19(1)(a) and 21. The petition further challenges Sections 17(1)(c), 17(2), 33(1) and 36 of the DPDP Act, along with Rule 23(2), arguing that these provisions grant excessive exemptions and powers without adequate safeguards.
The debate, at its core, is not about rejecting privacy as a constitutional value. It is about whether the balance between privacy and transparency has shifted too far toward non-disclosure. The Supreme Court has, for now, declined to stay the amendment to the RTI Act, while agreeing to examine the constitutional challenge in depth. A bench led by Chief Justice Surya Kant, along with Justices Joymalya Bagchi and Vipul M Pancholi, noted that the issues involved are complex and sensitive and require fuller consideration. By issuing notice to the Union government and referring the matter to a larger bench, the Court has signalled that it will undertake a substantive review of the challenged provisions of the DPDP Act and their impact on the RTI Act. The question that now awaits judicial resolution is a fundamental one: how to safeguard personal data in a digital age without eroding the citizen’s right to know.
