#The Supreme Court Just Put the DPDP Act's Section 44(3) on a Two-Week Clock

For the first time since the Digital Personal Data Protection Act rewrote India's transparency law, the Union government has been given a deadline to explain itself in writing. On Friday, August 7, a Supreme Court bench led by Chief Justice Surya Kant granted the Centre two weeks to file its response to a batch of petitions challenging DPDP Act Section 44(3) — the clause that quietly replaced the operative text of the Right to Information Act's Section 8(1)(j).

The order itself is procedural. What matters is the question the bench attached to it, and the fact that a government which has so far defended the amendment mainly in press statements and parliamentary replies must now commit a legal theory to an affidavit that can be tested.

#What the Supreme Court actually ordered on August 7

The bench — Chief Justice Surya Kant, Justice Joymalya Bagchi and Justice V. Mohana — commenced hearing a consolidated batch of petitions challenging the DPDP Act's amendment to the RTI Act. Solicitor General Tushar Mehta, appearing for the Union, sought two weeks to file its reply and said the government would justify the amendment in its affidavit, subject to judicial review.

Three things came out of the hearing that were not true a week ago:

The Centre is on a clock. Two weeks from August 7 puts the Union's counter-affidavit due around August 21, 2026. Until now, the government's position on Section 44(3) has largely been asserted rather than pleaded — most visibly by IT Minister Ashwini Vaishnaw, who has maintained that the amendment does not damage the RTI framework. An affidavit is a different instrument. It has to name the constitutional basis for a blanket exemption and survive cross-examination on it.

MeitY has been impleaded. The Ministry of Electronics and Information Technology was added as a party to the proceedings. The ministry that drafted the DPDP Act and notified the DPDP Rules 2025 is now formally answerable in the case, rather than sitting behind the Union's general representation.

The matter moves off the miscellaneous list. The bench directed that the case be listed on a non-miscellaneous day once the Union files. In Supreme Court practice this is the difference between a five-minute mention and a hearing with time allotted for argument. The court is signalling it intends to hear this properly.

The petitioners include RTI activist Venkatesh Nayak, the National Campaign for Peoples' Right to Information, activist Anjali Bhardwaj and the Foundation for Media Professionals, argued by advocates Vrinda Grover, Prashant Bhushan and senior advocate Nisha Bhambhani. The broader challenge — which also takes in the Data Protection Board's independence and the government's data-access powers — has been building since the Supreme Court issued notice in February 2026 on a petition brought by The Reporters Collective, and flagged core questions for consideration by a larger bench.

#The one sentence DPDP Act Section 44(3) deleted

The technical change is small enough to miss and consequential enough to have produced four years of litigation risk.

Before the amendment, Section 8(1)(j) of the RTI Act exempted:

information which relates to personal information the disclosure of which has no relationship to any public activity or interest, or which would cause unwarranted invasion of the privacy of the individual...

followed by a proviso: information that could not be denied to Parliament or a State Legislature could not be denied to a citizen either. The clause carried three distinct filters. Was the information personal? Did it relate to public activity or public interest? Would disclosure be an unwarranted invasion of privacy? A Public Information Officer had to work through all three, and a larger public interest could override the exemption.

Section 44(3) of the DPDP Act, notified on November 14, 2025, substituted the entire clause with six words:

information which relates to personal information

Every qualifier is gone. The public-activity test, the "unwarranted" threshold, the balancing exercise — all of it collapses into a single categorical question: is this personal information? If yes, it is exempt. As one analysis of the amendment puts it, the new text "systematically deletes every safeguard and qualifier of the original clause."

Advocate Prashant Bhushan's argument to the bench was that a previously balanced provision has been dismantled, allowing refusal solely on the basis that information is personal in character. Vrinda Grover contended that the DPDP Act effectively rewrites Section 8(1)(j) by stripping out the safeguards that governed disclosure of personal information about public officials performing public functions.

#Blanket prohibition or proportionate approach: the test that decides this case

The most important sentence from the hearing came from Justice Bagchi:

The question is whether there can be a blanket prohibition on disclosure of all digital personal information, or whether the legislation has to adopt a proportionate approach.

That framing matters more than any individual argument, because it places the case squarely inside the doctrine the Supreme Court built in K.S. Puttaswamy — where privacy limitations must satisfy legality, legitimate aim, proportionality and procedural safeguards. Proportionality is a two-edged instrument here. It is normally invoked to strike down state action that intrudes on privacy. In this case, petitioners are invoking it against a provision that protects privacy too categorically, at the cost of Article 19(1)(a) rights.

The bench added two further observations that narrow the government's defensive ground. On the relationship between the statutes, Justice Bagchi noted: "The Right to Information Act is a Central law. This is also a Central law. We have to harmonise the two." And on scope: "The Right to Information Act operates on a much larger domain. It covers all forms of information, not merely digital information."

That second point is a genuine structural problem for the amendment, and it is worth stating plainly. The DPDP Act, by its own Section 3, governs digital personal data and non-digital data subsequently digitised. The RTI Act governs information in any form — paper files, registers, samples, models. Section 44(3) does not carve out a digital-only exemption; it amends the RTI Act's general exemption clause. A statute whose entire subject-matter competence is digital personal data has been used to restrict access to information that was never within its scope. Expect that mismatch to feature heavily in the Union's affidavit, and in the petitioners' rejoinder.

Nisha Bhambhani's submission pressed the press-freedom dimension: the amendment would seriously impede investigative journalism if reporting could be restricted by reference to a data principal's interest in their own personal data, with no journalistic exemption written into the DPDP Act. India's data protection law, unlike the GDPR's Article 85, contains no carve-out for processing carried out for journalistic purposes — an omission the Editors Guild and press bodies have raised since the Bill stage.

#Does Section 8(2) still save the public interest override?

This is the strongest argument available to the government, and it deserves a fair hearing rather than a dismissal.

Section 8(2) of the RTI Act is untouched by the DPDP Act. It provides that a public authority may allow access to exempt information if public interest in disclosure outweighs the harm to the protected interests. On the government's likely reading, the public-interest override was not abolished — it simply moved. It no longer sits inside clause (j); it operates at the level of Section 8 as a whole.

The counter-argument is behavioural rather than textual, and it is why the point is unlikely to settle the case. Section 8(1)(j) made balancing mandatory: a PIO had to apply the public-activity and unwarranted-invasion tests before refusing. Section 8(2) makes disclosure discretionary: a PIO may release exempt information. Shifting a duty into a discretion changes real-world outcomes even when the words on the page still permit the same result.

The DPDP Act sharpens that asymmetry considerably. A PIO who wrongly refuses information faces the RTI Act's penalty regime — ₹250 per day up to ₹25,000, levied on the officer. A public authority that wrongly discloses personal data faces the DPDP Act's penalty schedule, which runs to ₹250 crore. When one side of a discretionary judgment carries a five-figure personal risk and the other carries a nine-figure institutional one, the discretion is not being exercised on a level field. Refusal becomes the rational default, and the override withers without a word of it being repealed.

Whether that constitutes a constitutional defect or merely a policy consequence is precisely what the bench will have to decide. Courts are ordinarily reluctant to strike down legislation on the basis of how officials are likely to behave under it. But the proportionality inquiry Justice Bagchi framed does look at whether a measure is more restrictive than necessary to achieve its aim — and "the override technically survives in another sub-section" is a weaker answer to that question than it first appears.

#Why this matters to businesses, not just to journalists

It is easy for compliance teams to file this case under civil liberties and move on. That would be a mistake, for three reasons.

A proportionality ruling would travel. If the court holds that Section 44(3) fails because it prohibits categorically where it should have calibrated, the reasoning does not stop at the RTI Act. The same critique has been aimed at Section 36, which lets the government require any data fiduciary to furnish information, and at the structure of the Data Protection Board itself. A judgment that reads proportionality requirements into the DPDP Act would reshape how those provisions are interpreted and applied to regulated entities.

Legal uncertainty is now a planning input. Enterprises are building toward two fixed dates: November 13, 2026 for the consent manager framework under Rule 4, and May 13, 2027 for full substantive compliance. Neither is affected by this case in the near term — the court has repeatedly declined to stay the DPDP framework, and Chief Justice Kant was explicit in February that legislation cannot be stayed by interim order absent a definite conclusion. But organisations designing consent architectures and retention schedules should understand that specific provisions of the parent Act remain under active constitutional challenge, and build for adaptability rather than assuming the statute is settled.

Public-facing entities are directly exposed. Public sector undertakings, banks with government shareholding, regulated utilities and any body falling within the RTI Act's definition of a "public authority" are now sitting between two statutes with opposing default settings. Their RTI cells are refusing under the amended clause while their privacy teams build DPDP consent flows, frequently without either function knowing what the other is doing. If the court restores a balancing test, every refusal issued on the bare ground of "personal information" becomes reviewable — and the appeals will arrive faster than the systems can be rebuilt.

#What to watch over the next fortnight

Three signals will tell you where this is heading.

The content of the Union's affidavit, due around August 21. The specific question to look for: does the Centre defend Section 44(3) as a categorical exemption, or does it argue that Section 8(2) preserves the balancing exercise? Those are materially different positions. The second concedes that proportionality is required and merely relocates it — and once conceded, it invites the court to make the relocation explicit and enforceable.

Whether the composition question resurfaces. Core questions in this challenge were earlier flagged for a larger bench. How the matter is eventually listed — before a three-judge bench or a Constitution Bench — will indicate how far the court intends to go on the underlying privacy-versus-transparency conflict.

Whether the Data Protection Board is constituted in the interim. Nine months after the DPDP Rules were notified, the Board still has no chairperson and no members. That vacancy is itself part of the broader constitutional challenge, and it undercuts any government argument that adequate institutional safeguards exist to police the boundary Section 44(3) draws.

#The pattern worth taking away

India's data protection law is being tested first at its least commercial edge. Not on consent notices or breach timelines, but on a six-word substitution in a transparency statute that most compliance programmes have never read.

That is a useful reminder about what the DPDP Act actually is. It is not a self-contained compliance regime that can be implemented in isolation from the rest of Indian law. It amends other statutes, overrides some, and sits uneasily beside several more. The RTI conflict is simply the first instance where the friction became sharp enough to reach the Supreme Court — the collisions with the IT Rules' retention mandates, sectoral KYC requirements and the Telecommunications Act's new localisation rules are all queued behind it.

For organisations building toward November 2026 and May 2027, the practical lesson is to map obligations against the whole statutory landscape rather than the DPDP Act alone. Our resources cover section-by-section obligation mapping, including where the DPDP Act's requirements conflict with existing sectoral rules. If you are designing the consent and purpose-tracking layer that both the consent-manager deadline and the data principal rights regime depend on, our consent manager is built for exactly that.

The Centre has until roughly August 21 to explain why six words were enough. It is worth reading what it says.

---

Sources: Business Standard · LawBeat · Moneylife · NextIAS · Internet Freedom Foundation · Supreme Court Observer · AMLEGALS — Section 8(1)(j) analysis · Vajiram & Ravi · Shardul Amarchand Mangaldas