SC Hears Petitions Challenging DPDP Act Provisions Diluting the RTI

On August 7, 2026, the Supreme Court of India heard a batch of public interest petitions challenging provisions of the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025 (DPDP Rules)(together, the “DPDP Laws”), foremost among them Section 44(3) of the DPDP Act, which amends Section 8(1)(j) of the Right to Information Act, 2005 (RTI Act) to remove the public-interest override for the disclosure of personal information.

The lead petition i.e. [W.P. (C) No. 177 of 2026], filed by RTI expert Venkatesh Nayak is heard with a batch of connected matters (summarised below) and seeks a declaration that Sections 44(3), 17(1)(c), 17(2), 33(1) and 36 of the DPDP Act, read with Rules 17 and 23(2) of the DPDP Rules, are ultra vires the Constitution for violating Articles 14, 19(1)(a) and 21.   

The Court had earlier, by its order of February 16, 2026, issued notice, declined to stay the DPDP framework, and observed that the challenge raised complex and constitutionally sensitive questions on the balance between the right to privacy and the right to information, warranting consideration by a larger Bench.

Latest Proceedings before the Supreme Court

A Bench of Chief Justice Surya Kant and Justices Joymalya Bagchi and V. Mohana heard submissions from the petitioners. Solicitor General Tushar Mehta appeared for the Union of India, and the petitioners advanced, among others, that the amendment rewrites Section 8(1)(j) by removing the safeguards that earlier permitted disclosure, so that information about public officials, public functions and matters of public interest could be denied merely by labelling it “personal” (Advocate Vrinda Grover); that it could seriously impede investigative reporting, as journalists may be required to obtain the data principal’s consent and individuals could later seek the erasure of information relevant to public-interest reporting (Senior Advocate Nisha Bhambhani); and that the balance between the right to information and the right to privacy had already been settled in CPIO v. Subhash Chandra Agarwal (2020), the amendment in any event travelling beyond “digital personal data” because it expressly substitutes Section 8(1)(j) (Advocate Prashant Bhushan).

The Bench indicated that it would examine, among other things, whether the distinction between digital personal data and other information rests on an intelligible differentia bearing a rational nexus to the object of the legislation, and whether the law can impose a blanket prohibition on the disclosure of personal information. The Union of India’s counter affidavit is awaited

Key Issues and Contentions: Section 44(3) and the RTI Amendment

Section 8(1)(j) of the Right to Information Act, 2005 (RTI Act) exempted personal information from disclosure only through a three-pronged test i.e. a public-activity test, an unwarranted-invasion test, and a mandatory larger-public-interest override that allowed disclosure where justified along with a proviso that information which cannot be denied to Parliament or a State Legislature shall not be denied to any person.

Section 44(3) of the DPDP Act substitutes clause (j) of Section 8(1) of the RTI Act as follows:

Before: “information which relates to personal information the disclosure of which has no relationship to any public activity or interest, or which would cause unwarranted invasion of the privacy of the individual unless the [PIO or appellate authority] is satisfied that the larger public interest justifies the disclosure of such information,” followed by the proviso protecting information that cannot be denied to Parliament or a State Legislature shall not be denied to any person.

After: “(j) information which relates to personal information.”

The Petitioner contended that the substitution strips Section 8(1)(j) of its three-pronged test and its proviso, converting a calibrated exemption into a blanket bar on the disclosure of all personal information, with no statutory mechanism to weigh it against the larger public interest.

The Petitioner submitted that the substitution of Section 8(1)(j) is liable to be struck down, inter alia, on the following grounds:

• Unreasonable restriction on Article 19(1)(a): The right to information and the right to know are fundamental rights under Articles 19(1)(a) and 21 (State of U.P. v. Raj Narain (1975); S.P. Gupta (1981); Association for Democratic Reforms (2002); PUCL vs Union of India (2003) 4 SCC 399; Reliance Petrochemicals (1988); CPIO v. Subhash Chandra Agarwal (2020)). By removing the public-interest override, the amendment operates as an unreasonable restriction on that right.
• Privacy is not a permissible ground under Article 19(2): A right traceable to Article 19(1)(a) may be curtailed only by the restrictions listed in Article 19(2), among which privacy does not figure (PUCL 2003). Privacy is also not a fundamental right available to the State.
• Public interest overrides the privacy of public functionaries: The Court has consistently subordinated the privacy of public functionaries to the citizens’ right to information (PUCL (2003), as reiterated in KS Puttaswamy vs Union of India (2019) 1 SCC 1); the amendment inverts this settled jurisprudence.
• Failure of the five-pronged proportionality test: A law curtailing fundamental rights must be the least restrictive measure and satisfy all five prongs of proportionality (K.S. Puttaswamy, 2017; Ramesh Chandra Sharma, 2024). An absolute bar prevents the reasoned, case-by-case balancing required by CPIO v. Subhash Chandra Agarwal (2020).
• Travelling beyond the scope of the DPDP Act: The DPDP Act governs only “digital personal data” (Sections 2(n), 2(t) and 2(x)), yet the amendment sweeps in all personal information whether digital or not, suffering from overbreadth and going beyond the Act’s stated objects.
• Violation of Article 14 by treating unequals equally: The amendment places public functionaries entrusted with public duties on the same footing as ordinary citizens for the purpose of privacy, contrary to Association for Democratic Reforms (2002), PUCL (2003) and Modern Dental College (2016).
• Deletion of the proviso undermines representative democracy: Removing the proviso i.e., that information which cannot be denied to Parliament or a State Legislature shall not be denied to any person, destroys the symmetry of information between electors and their representatives, without any rational basis connected to digital data processing.
• Manifest arbitrariness and unguided discretion: The amendment was not separately tabled or debated for its RTI impact, extinguishes the PIO’s and First Appellate Authority’s power to balance public interest, is not saved by Section 8(2), conflicts with the mandatory disclosure duties in Section 4(1)(b) of the RTI Act (Kishan Chand Jain (2023); CBSE v. Aditya Bandopadhyay, 2011)), and confers unguided discretion on the executive to deny information (Anuradha Bhasin, 2020).

Key Issues and Contentions: Surveillance and Administrative Provisions

The Petitioner further challenged Sections 17(1)(c), 17(2), 33(1) and 36 of the DPDP Act and Rules 17 and 23(2) of the DPDP Rules (notified but, save for Rule 17, coming into force eighteen months after November 13, 2025) as violative of Articles 14, 19(1)(a) and 21:

• Sections 17(1)(c) and 17(2), disproportionate surveillance: These grant sweeping exemptions to State and non-State actors to collect, preserve, process and share data without objective scrutiny or a review mechanism, enabling disproportionate surveillance and failing the “necessary safeguards” limb of the proportionality test (Gujarat Mazdoor Sabha, 2020). There is no reasonable nexus between the blanket exemption for State instrumentalities under Section 17(2)(b) and the Act’s objects.
• Section 33(1), “significant” data breach undefined: Penalties attach only where a breach is found “significant,” but neither the Act nor the Rules define the term, conferring unguided discretion that is manifestly arbitrary and violates Article 14.
• Section 36, unchecked power to call for information: The Central Government may require the Board or data fiduciaries to furnish any information, with no stated purpose or limitation and no appeal or review, again failing the necessary-safeguards limb of proportionality.
• Rule 23(2), no notice to the Data Principal: The Central Government and data fiduciaries are exempted from informing the Data Principal where disclosure is deemed to affect the sovereignty and integrity of the country, with no pre-decisional hearing or review mechanism (Anuradha Bhasin, 2020).
• Rule 17, executive dominance and separation of powers: The Search-cum-Selection Committees for appointing the Chairperson and members of the Data Protection Board are dominated by the Central Government, itself a likely litigant before the Board; given the Board’s quasi-judicial functions, this violates the separation of powers.
• Overbroad definitions chilling free expression and profession: The wide definitions of “data fiduciary,” “processing” and “personal data” bring journalists, academics, lawyers, researchers and NGOs within the Act’s compliance and penalty regime, casting a chilling effect on the rights under Articles 19(1)(a) and 19(1)(g).

Relief Sought

The Petitioner prayed that the Supreme Court declare that Sections 44(3), 17(1)(c), 17(2), 33(1) and 36 of the DPDP Act, 2023 and Rules 17 and 23(2) of the DPDP Rules, 2025 are ultra vires the Constitution, being violative of Articles 14, 19(1)(a) and 21 and pass appropriate directions.

Related Challenges before the Supreme Court

Mr. Nayak’s petition was heard together with connected petitions i.e. The Reporters Collective Trust & Anr. v. Union of India [W.P. (C) No. 211 of 2026] challenging, inter alia, the absence of any exemption for the processing of personal data for journalistic purposes and the powers of the Central Government under Section 36 read with Rule 23. Another petition i.e. National Campaign for People’s Right to Information (NCPRI) v. Union of India, [W.P. (C) No. 212 of 2026] raising cognate challenges to the amendment’s impact on the RTI regime was also tagged along.

A further petition i.e. Geeta Sheshu & Anr. v. Union of India & Ors., [W.P. (C) No. 275 of 2026], mounts a broader challenge to the DPDP Laws as a regression from the right to privacy recognised in K.S. Puttaswamy (2017) and a departure from the B.N. Srikrishna Committee Report, in violation of Articles 14, 19(1)(a), 19(1)(g), 21 and 21A. The petition organises its contentions under five heads:

• Journalistic exemptions: the absence of any carve-out permitting the processing of personal data for journalistic purposes;
• State data processing: the constitutionality of data processing by the State and the overbroad power to exempt State instrumentalities from the Act;
• Compensation vacuum: the absence of any statutory compensation for data principals affected by a breach;
• Independence of the Board: the structural dependence of the Data Protection Board on the Executive; and
• Surveillance: the facilitation of disproportionate State surveillance without adequate safeguards.

Since notice was issued, few more petitions raising the same challenge, including W.P. (C) Nos. 286, 655 and 722 of 2026, have been tagged with the lead matter.