India's Privacy Law Is Silencing the Right to Information — and the Supreme Court Must Now Choose
India's DPDP Act amended RTI's Section 8(1)(j), removing the public-interest override. RTI rejections have risen 35%. A five-judge bench will now decide.
#India's Privacy Law Is Silencing the Right to Information — and the Supreme Court Must Now Choose
India's Digital Personal Data Protection Act was supposed to give citizens more control over their personal data. Instead, a single provision buried in its amendment clauses has been used to block the very tool that citizens rely on to hold power accountable: the Right to Information Act. Since the DPDP Act and Rules came into force in November 2025, RTI rejections have risen by 35 percent. A five-judge Constitution Bench of the Supreme Court is now set to determine whether that outcome was the law's intent — or its abuse.
This is not a minor technical glitch in the law's design. It is the most consequential civil liberties question embedded in India's data protection framework, and one that has received almost no attention in the compliance conversation dominating corporate India's response to the DPDP Act.
#What Section 44(3) Actually Changed in the RTI Act
The Right to Information Act, 2005 is one of India's landmark governance laws. Under its original Section 8(1)(j), a Public Information Officer could refuse to disclose personal information only if: (a) the information had no relationship to any public activity or interest, or (b) disclosing it would cause unwarranted invasion of privacy — unless the Information Commissioner or court was satisfied that "the larger public interest justifies the disclosure of such information."
That four-word qualification — the larger public interest — was the safety valve. It allowed journalists, activists, and ordinary citizens to obtain information about ministers' asset declarations, procurement decisions, disciplinary proceedings against civil servants, and the beneficiaries of government welfare schemes, even when those requests touched personal information.
Section 44(3) of the Digital Personal Data Protection Act, 2023 replaced the entire text of Section 8(1)(j) with a single minimal phrase: "information which relates to personal information."
There is no override. There is no public interest test. There is no balancing of privacy against accountability. Under the amended provision, any information classifiable as "personal" is simply exempt — and the Central Public Information Officer's discretion to weigh competing rights has been eliminated.
Legal scholars and transparency advocates warned about this from the moment the DPDP Bill passed Parliament. Their worst fears are now documented in concrete numbers: India's Central Information Commission reported a 35 percent increase in RTI rejections in 2026, with "personal information under the DPDP Act" emerging as a new and frequently-cited basis for refusal.
#The Real-World Impact: Who Is Losing Access to What
The affected requests are not obscure edge cases. Public Information Officers across central ministries and state governments have cited the DPDP amendment to reject requests for:
- Ministers' asset and liability declarations, on the grounds that financial information is personal data
- Performance appraisal records of senior civil servants, even where the requester has a demonstrated public interest in the officer's conduct
- Disciplinary proceedings against officials in regulatory and law enforcement roles
- Aadhaar-linked beneficiary lists for welfare schemes, blocking citizen verification of whether funds actually reached intended recipients
- Names and identifications of government contractors handling public funds, cited as personal business information
The pattern is consistent. The removal of the public interest override has given officials a clean exemption they can invoke without having to justify, weigh, or apply proportionality reasoning. The landmark 2017 Supreme Court judgment in Puttaswamy v. Union of India — which established privacy as a fundamental right under Article 21 — required that any interference with privacy must be necessary, proportionate, and subject to procedural safeguards. Ironically, the amended Section 8(1)(j) strips away the oversight mechanism that the RTI Act itself had built in, substituting blanket exemption for calibrated judgment.
Advocate Vrinda Grover, representing The Reporters Collective in its Supreme Court petition, described the approach as using "a sledgehammer" — an instrument that crushes accountability in the name of protecting individuals, without distinguishing between private citizens deserving of strong protection and public officials exercising State power over public resources.
#High Courts in Conflict: Bombay Versus Karnataka
Two of India's most significant High Courts have reached opposing conclusions about the amendment's validity — a judicial conflict that both clarifies the stakes and explains why the Supreme Court referral was necessary.
The Bombay High Court, in a 2026 ruling, stayed the application of the DPDP exemption in RTI matters pending the Supreme Court's resolution, directing Public Information Officers to continue applying the public interest test from the original Section 8(1)(j). The court reasoned that automatically applying a blanket exemption would cause irreparable harm to citizens' accountability rights during the pendency of constitutional proceedings.
The Karnataka High Court, in a separate 2026 ruling, reached the opposite conclusion — upholding the DPDP Act's amendment and treating privacy as the paramount consideration, reasoning that Parliament had deliberately chosen to strengthen privacy protection by removing the earlier balancing mechanism.
The consequence is a jurisdictional inconsistency that is itself constitutionally problematic: citizens filing RTI applications whose appeals reach the Bombay High Court's jurisdiction will have the public interest test applied in their favor; citizens elsewhere may face the blanket exemption with no recourse short of the Supreme Court itself.
Chief Justice Surya Kant, presiding at the February 2026 hearing, signaled that the court understood this required substantive resolution. "Some ironing out of the creases might be needed to strike a balance," the bench observed — language that transparency advocates read as a signal the court is unlikely to endorse a blanket exemption as constitutionally sufficient under the Puttaswamy proportionality framework.
#The Supreme Court's Five-Judge Constitution Bench
On February 16, 2026, the Supreme Court admitted three writ petitions and referred the DPDP-RTI conflict to a five-judge Constitution Bench. The three petitions were filed by:
- Venkatesh Nayak, a prominent transparency activist and researcher (W.P. (C) No. 177 of 2026)
- The Reporters Collective Trust (W.P. (C) No. 211 of 2026) — an investigative journalism organization whose work depends on RTI disclosures to trace public money and expose government wrongdoing
- The National Campaign for Peoples Right to Information (W.P. (C) No. 212 of 2026) — the civil society network instrumental in getting the original RTI Act passed in 2005
The court declined to grant an interim stay, so the DPDP Act and its Rules remain fully operative. In jurisdictions outside the Bombay High Court's stay, PIOs continue to apply the blanket exemption today.
A Constitution Bench referral is significant in Indian legal practice. Five-judge benches are convened specifically for substantial questions of constitutional law — typically the interpretation of fundamental rights or the validity of parliamentary legislation. The bench will examine whether Section 44(3) violates:
- Article 14 (right to equality and protection from arbitrary action), by replacing a calibrated balancing test with a blanket rule that treats the personal information of a cabinet minister identically to that of a private citizen
- Article 19(1)(a) (freedom of speech and expression, including press freedom), by creating a legal chilling effect on investigative journalism that relies on personal information to trace money flows and misconduct
- Article 21 (right to life and personal liberty, including the right to privacy itself) — because Puttaswamy requires proportionality, and a blanket exemption that eliminates judicial oversight may itself be a disproportionate restriction on the right to access information under Article 21's companion right to live with dignity
#Section 36, Press Freedom, and Board Independence: Three More Challenges
Section 44(3) is the most publicized challenge, but the petitions raise two additional issues that deserve equal attention:
Section 36 — Government surveillance power without oversight. Under Section 36 of the DPDP Act, the Central Government can demand personal data from any Data Fiduciary — any company or organization holding personal data — without a judicial warrant, independent review mechanism, or an appeal right for the entity receiving the demand. The petitioners argue this creates a surveillance power of unlimited scope, untempered by the procedural safeguards the Puttaswamy framework requires. Unlike the IT Act's interception provisions, which require Secretary-level authorization and periodic review, Section 36 has no structural check.
Journalists as Data Fiduciaries — a compliance trap. Under the DPDP Act, a journalist who collects personal data about a public official — their financial connections, their communications, their professional conduct — is technically a "Data Fiduciary." The Act contains no meaningful carve-out for journalism in the public interest. This means investigative reporters could theoretically face demands for prior consent from the subjects of their investigations, and penalties of up to ₹250 crore for processing personal data without it. The Reporters Collective petition makes this concrete: the journalism that broke stories about offshore financial structures, state-sponsored spyware deployments, and public procurement irregularities all required collecting and processing personal information without the subject's consent or knowledge.
Data Protection Board independence. The Board's appointment mechanism — a search-cum-selection committee composed entirely of serving government officials — is challenged as structurally compromising the quasi-judicial independence required of a body that adjudicates privacy rights, particularly when government ministries are themselves data fiduciaries subject to Board oversight.
The GDPR offers a useful contrast here. Articles 85 and 89 of the EU regulation contain explicit carve-outs for journalism, research, archiving, and public interest purposes, precisely because drafters recognized that privacy and accountability are both fundamental values requiring calibrated coexistence. India's DPDP Act contains no equivalent — a gap that civil society flagged during the legislation's drafting and that was not addressed before the law passed.
#What This Means for Indian Businesses and Compliance Teams
The Constitution Bench litigation has practical implications beyond journalism and governance advocacy.
Cross-compliance risk in regulatory disputes. Businesses that file RTI applications in the course of procurement challenges, regulatory disputes, or investigations of competitor conduct may face DPDP-cited exemptions when seeking information about government decision-making. The blanket exemption is now available to PIOs who do not want to answer questions about official conduct, regardless of whether personal privacy is genuinely at stake.
Media companies and editorial operations are Data Fiduciaries. If your business collects personal data from sources, interview subjects, or third-party databases for editorial purposes, you are a Data Fiduciary under the DPDP Act, with no clear statutory exemption protecting your information-gathering process. Until the Constitution Bench rules, that legal exposure is real and unresolved.
Section 36 demands require a response protocol. The government's power to demand personal data without independent oversight has not yet been tested in a published enforcement context. But organizations holding significant personal data inventories — in financial services, telecommunications, health, and technology — should ensure their legal and compliance teams understand Section 36 and have a documented response framework, including escalation procedures and legal privilege assessments.
Track the Constitution Bench timeline. The matter was scheduled for hearing before the larger bench in March 2026. As of July 2026, no final ruling has been issued and no public cause list update has confirmed the date of the next substantive hearing. Businesses operating at the intersection of public interest data, journalism, or government information access should monitor this case directly through the Supreme Court's cause list. A ruling that reinstates the public interest override in RTI would have immediate practical consequences for information strategy across industries that rely on RTI as a compliance and due-diligence tool.
#The Question the DPDP Act Left Unanswered
The fundamental tension at the heart of this litigation is not new. Every modern privacy law struggles with where to draw the boundary between protecting individuals and maintaining the accountability of those who hold public power. India's approach — replacing a calibrated balancing test with a blanket exemption — chose privacy over accountability in absolute terms.
The Constitution Bench has an opportunity not just to restore the public interest test to the RTI framework, but to direct Parliament to create the journalism and public interest exemptions the DPDP Act currently lacks. Chief Justice Surya Kant's comment about "ironing out creases" suggests the court may favor a surgical intervention over wholesale invalidation — one that preserves the DPDP Act's core architecture while restoring the transparency safeguards that Section 44(3) removed.
Until that ruling arrives, the 35 percent increase in RTI rejections is not an abstract number. It represents thousands of information requests — from journalists, researchers, activists, and citizens — that have been turned away under a privacy law designed to protect them, not silence them. India's Digital Personal Data Protection Act was built to give citizens control over their personal data. The question before the Supreme Court is whether it was also built to give the government control over theirs.
Tracking India's DPDP Act enforcement and compliance deadlines? Explore our /resources page for regulatory guides and implementation templates, or review /consent-manager tools for the November 2026 Consent Manager Framework.