The right to information in India is not a creature of statute alone. It is rooted in the constitutional guarantee of freedom of speech and expression under Article 19(1)(a) and, in later jurisprudence, in the right to life and personal liberty under Article 21. In State of Uttar Pradesh v. Raj Narain, Mathew J. observed that the people of this country have a right to know every public act done by their public functionaries, and traced that right to the concept of freedom of speech, since an informed citizenry is a precondition for democratic self-governance.1 S.P. Gupta v. Union of India carried the reasoning further, holding that disclosure of information about the functioning of government must be the rule and secrecy the exception, justified only where a compelling public interest in confidentiality is shown.2 The Court reaffirmed the constitutional stature of the right in Union of India v. Association for Democratic Reforms and People’s Union for Civil Liberties v. Union of India, both concerning the voter’s entitlement to know the antecedents of electoral candidates,3 and in Reliance Petrochemicals Ltd. v. Proprietors of Indian Express Newspapers, Bombay, which located the right to know within Article 21.4 These judgments culminated in the Right to Information Act, 2005, which converted a judicially recognised right into an enforceable statutory mechanism through the proactive disclosure obligations of Section 4(1)(b) and the narrowly drawn exemptions of Section 8.5
Fourteen years later, in K.S. Puttaswamy v. Union of India, a nine-judge Bench recognised privacy as a fundamental right intrinsic to Article 21 and identified informational privacy as a facet of it calling for a carefully framed statutory regime.6 The Digital Personal Data Protection Act, 2023 was enacted to supply that regime for digital personal data. Section 44(3) of the same Act simultaneously rewrote the RTI Act’s privacy exemption, and the substituted clause has been in force since 13 November 2025, when the commencement notification bringing selected provisions of the Act into operation was published alongside the Digital Personal Data Protection Rules, 2025.7 This paper interrogates the question that the overlap generates: does the DPDP Act harmonise privacy with transparency, or does it subordinate the latter to the former in a manner the Constitution does not sanction?
Before the amendment, Section 8(1)(j) exempted from disclosure “information which relates to personal information the disclosure of which has no relationship to any public activity or interest, or which would cause unwarranted invasion of the privacy of the individual, unless the Central Public Information Officer or the State Public Information Officer or the appellate authority, as the case may be, is satisfied that the larger public interest justifies the disclosure of such information”, followed by a proviso that information which cannot be denied to Parliament or a State Legislature shall not be denied to any person.8 The clause was conditional rather than categorical. The information had to be personal; it had to bear no relationship to any public activity or interest, or its disclosure had to work an unwarranted invasion of privacy; and even where both conditions were satisfied, the larger public interest could displace the exemption.
Girish Ramchandra Deshpande v. Central Information Commissioner and Canara Bank v. C.S. Shyam applied the first two limbs generously to public servants, treating service records, disciplinary memoranda, asset particulars and transfer details as personal information; but both preserved the third limb, refusing disclosure only because no larger public interest had been pleaded and proved.9 The Constitution Bench in CPIO, Supreme Court of India v. Subhash Chandra Agarwal put the structure beyond doubt: Section 8(1)(j) created a conditional and not an absolute exemption, requiring a fact-specific weighing in which the number of persons affected was not decisive and the applicant’s motive was irrelevant.10 The burden of justifying refusal lay on the Public Information Officer, consistent with Section 8(1)’s design as a narrow, enumerated set of exceptions to a general rule of openness.
Section 44(3) substituted that architecture with a single clause: “information which relates to personal information”.11 The conditions disappeared, as did the clause-level public interest override and the Parliament-equivalence proviso. What survives is a six-word disqualifier keyed to one inquiry: is the information personal? That inquiry is itself expansive, since Section 2(t) of the DPDP Act defines personal data as “any data about an individual who is identifiable by or in relation to such data”,12 a definition wide enough to capture asset declarations, disciplinary records, contract particulars and loan defaults, so long as they can be traced to an identifiable individual. Because the RTI Act never independently defined personal information, Public Information Officers now have every incentive to import the DPDP definition wholesale, collapsing a contextual inquiry into a categorical label.
The Union Government’s answer is that the override has not been abolished but relocated. Section 8(2) of the RTI Act, which the amendment leaves untouched, permits a public authority to allow access to information notwithstanding any exemption in sub-section (1) where the public interest in disclosure outweighs the harm to the protected interests, and the Ministry of Electronics and Information Technology has relied on that provision to argue that the amendment strikes a balance rather than extinguishing one.13 The answer is not without force, but it is not an equivalent. Section 8(2) is permissive in terms, conferring a discretion rather than a correlative entitlement; it is addressed to the “public authority” and not to the Public Information Officer or the first appellate authority who actually decide RTI applications; and it carries none of the sequential structure that made the pre-amendment clause reviewable on appeal. What was a condition upon the exemption has become a concession that may be withheld.14
A further complication is the mismatch in domain. The RTI Act’s disclosure obligations are format-neutral, extending to information held in any form, including records, documents, memoranda, opinions, papers, samples and data material held in any electronic form.15 The DPDP Act, by contrast, applies to digital personal data, meaning personal data collected in digital form or collected in non-digital form and digitised subsequently.16 Hearing the challenge on 7 August 2026, the Bench of Chief Justice Surya Kant and Bagchi and Mohana JJ. drew attention to precisely this asymmetry. Bagchi J. observed that the RTI Act operates in a much larger domain while the DPDP Act governs a much narrower sliver, and the Bench indicated that it would examine whether the distinction between digital personal data and other forms of information rests on an intelligible differentia bearing a rational nexus to the object of the statute.17 Given how far governmental record-keeping has been digitised, the practical purchase of that distinction is limited. What it does expose is the anomaly at the heart of the challenge: a statute textually confined to digital data has been used to rewrite an exemption clause in a statute of general application.
Despite the divergence just described, the RTI Act and the DPDP Act are not strangers to one another. Both trace their legitimacy to the same constitutional source. Transparency finds its anchor in Article 19(1)(a) and Article 21, while informational privacy, as Puttaswamy held, is itself an incident of Article 21’s guarantee of life and personal liberty.18 Neither statute is more constitutional than the other. Each is a legislative attempt to give content to rights inferred from the same text, and a reading that treats them as inherently opposed misconceives their common origin.
The Court’s framing of the dispute confirms that premise. Rather than treating the DPDP Act as impliedly repealing the earlier RTI Act by virtue of being the later central enactment, the Bench has approached the question through harmonious construction, asking whether the two central statutes can operate together and whether the DPDP Act indirectly overrides the RTI Act by creating a wider embargo on disclosure.19 That interpretive posture signals that the Court regards the statutes as compatible in principle, calling for reconciliation rather than a zero-sum contest.
The two regimes also converge in their residual protections. Statutorily mandated disclosures, such as the obligation to place records relating to the implementation of welfare legislation in the public domain and to conduct periodic social audits under the National Food Security Act, 2013, do not obviously fall away with Section 44(3), because disclosure there occurs under an independent statutory mandate rather than on a citizen’s request under the RTI Act.20 The Government’s defence of the amendment leans on this point, arguing that mandated disclosures remain undisturbed and that the amendment recalibrates only the residual, discretionary category of personal-information requests.21 Whether that recalibration is proportionate is a separate question, taken up below; but the premise of coexistence, however imperfectly realised, is a genuine point of connection.
The amendment nonetheless introduces at least five points of substantive contradiction between the two regimes.
First, the collapse of the clause-level balancing mechanism removes the feature that made the pre-amendment exemption constitutionally defensible. Subhash Chandra Agarwal had already held that the RTI Act contained no absolute bar on disclosing personal information where disclosure bore a reasonable nexus to public interest and worked no unwarranted invasion of privacy.22 Section 44(3) legislates past that reading, replacing a case-by-case weighing exercise with a categorical bar and leaving the applicant to whatever discretion a public authority chooses to exercise under Section 8(2).
Second, the amendment inverts the logic that justifies privacy as a fundamental right. Privacy jurisprudence, from Puttaswamy onward, is oriented towards shielding the individual from unwarranted intrusion by the State.23 Appearing for the petitioners, Vrinda Grover submitted that the DPDP Act fundamentally alters the RTI framework by excluding from disclosure information that was previously accessible as an incident of Articles 19 and 21.24 The paradox that submission exposes is worth stating plainly: a right conceived to protect citizens against state overreach is now available to public functionaries to resist citizen scrutiny, so that privacy functions less as a shield for the governed than as cover for the governing.
Third, the amendment tells against investigative journalism and whistleblowing. The DPDP Act contains no journalistic exemption comparable to Article 85 of the General Data Protection Regulation, which obliges Member States to reconcile data protection with freedom of expression and to provide derogations for processing carried out for journalistic purposes.25 On the face of the Indian Act, a reporter who processes a public functionary’s personal data in order to investigate wrongdoing is a Data Fiduciary bound by notice and consent obligations, and the data principal under investigation may assert a right to erasure against the very journalist scrutinising them.26 Senior Advocate Nisha Bhambhani, appearing for the Foundation for Media Professionals, told the Court that the amendments would seriously impede investigative reporting.27 The concern is not confined to the litigation. The Press Club of India, joined by other press bodies, submitted a memorandum to the Union Minister in June 2025 seeking an express exemption for journalistic work, and the Editors Guild of India renewed that demand in November 2025; the Ministry has given assurances in meetings but has issued no formal clarification.28 Whistleblowers, who necessarily handle the personal data of those they expose, face the same regime with no statutory shield.29
Fourth, the amendment tells against the social audit and welfare transparency mechanisms that depend on published personal data. Voter rolls, ration card and beneficiary lists under schemes such as MGNREGA and the National Food Security Act, and disclosures relating to wilful defaulters, have historically been obtained and cross-verified through RTI in order to detect leakage and fraud. Commentators warn that Section 44(3) risks reclassifying precisely this material as exempt personal information, and that public authorities, faced with the DPDP Act’s penalty structure, will lean towards refusal even where disclosure serves a demonstrable public interest.30 Because RTI is used disproportionately by applicants pursuing welfare entitlements, that risk falls hardest on those least equipped to litigate its consequences.31 The petitioners add that the amendment sits uneasily with Section 4(1)(b) of the RTI Act itself, several of whose mandatory proactive disclosures relate to identifiable individuals.32
Fifth, the amendment operates alongside other features of the DPDP Act that leave wide room for executive discretion, although those features are not yet operative. Section 17(2)(a) permits the Union Government to notify an instrumentality of the State as falling outside the Act altogether; Section 17(1)(c) disapplies the notice, consent and data-principal-rights provisions to processing in the interests of the prevention, detection, investigation or prosecution of any offence or contravention; Section 36 permits the Central Government to call for information from the Board or from any Data Fiduciary or intermediary without statutory criteria as to scope or grounds; and Section 33(1) leaves “significant” undefined as the threshold for penalty. All four were notified on 13 November 2025 but come into force only eighteen months afterwards.33 What is already in force is Rule 17 of the DPDP Rules, 2025, which constitutes the Search-cum-Selection Committees that recommend the Chairperson and Members of the Data Protection Board, a body exercising quasi-judicial functions and empowered to impose penalties of up to two hundred and fifty crore rupees.34 The petitioners’ submission is that the executive’s dominance of those Committees offends the separation of powers, and that the cumulative effect of these provisions is an architecture in which the same executive whose transparency obligations are narrowed by Section 44(3) also shapes the body charged with enforcing the Act.35
The constitutionality of Section 44(3) turns substantially on the four-fold proportionality standard formulated in K.S. Puttaswamy v. Union of India (the Aadhaar judgment) and applied in Anuradha Bhasin v. Union of India: the measure must pursue a legitimate goal, must be a suitable means of furthering that goal, must be the least restrictive but equally effective alternative available, and must not have a disproportionate impact on the right-holder.36 Protecting individuals against the misuse of their personal data is a legitimate aim, and the first requirement is comfortably met. The second is more doubtful. A blanket exemption is a suitable means of protecting privacy only if every disclosure of personal information causes privacy harm, yet the pre-amendment case law had already established that many such disclosures, the asset declarations of public officials or lists of defaulters among them, serve a public interest without any countervailing privacy harm at all.37 The remedy is accordingly wider than the mischief. The amendment fails more clearly still on necessity: the pre-existing conditional test, retaining a public interest override exercisable by the very officer who decides the application, was a demonstrably less restrictive alternative already on the statute book, and its wholesale replacement rather than calibrated retention suggests that the measure was not narrowly tailored.38 On the fourth limb, the cost to democratic accountability, welfare audits and press freedom described above is substantial and, on the material presently available, out of proportion to whatever incremental privacy protection a blanket bar secures over the pre-amendment regime.
Two further constitutional objections compound the proportionality deficit, and both are urged in the pending petitions. Article 14 is said to be engaged because the amendment equates the privacy interest of a public functionary acting in an official capacity with that of a private citizen acting in a personal one, treating unlikes alike without an intelligible differentia connected to the statute’s transparency objective.39 Article 19(2) is said to be engaged because privacy is not among the enumerated grounds, namely the sovereignty and integrity of India, the security of the State, friendly relations with foreign States, public order, decency, morality, contempt of court, defamation and incitement to an offence, on which the freedom guaranteed by Article 19(1)(a) may be restricted; which raises the question whether a privacy-based blanket bar on the right to information can be sustained by ordinary legislation at all.40 Neither argument has yet been ruled upon.
This paper has argued that Section 44(3) of the DPDP Act does not so much harmonise privacy and transparency as subordinate the latter to the former, dismantling a calibrated exemption in favour of a categorical bar that struggles on the suitability and necessity limbs of the proportionality test and inverts the protective logic that privacy jurisprudence was built to serve. The connections between the two statutes, namely their common constitutional origin, the survival of Section 8(2) and of statutorily mandated disclosures, and the Supreme Court’s own harmonisation-oriented framing, suggest that reconciliation rather than displacement was both doctrinally available and constitutionally preferable.
Four correctives would restore the balance. The public interest override should be reinstated within Section 8(1)(j) itself and vested in the officer who decides the application, rather than left to the discretion of the public authority under Section 8(2). A statutory exemption for journalistic and whistleblower processing should be enacted, modelled on the derogation that Article 85 of the GDPR requires Member States to provide. Sections 17(1)(c), 17(2) and 36 should be subjected to defined statutory criteria and to judicial or parliamentary oversight before they take effect. And appointments to the Data Protection Board should be insulated from executive dominance by amending Rule 17 of the DPDP Rules. With the challenge now pending before the Supreme Court, the eventual ruling will do more than settle a conflict between two statutes; it will fix, for a generation, the architecture of accountability in Indian democracy.
*****
1. State of Uttar Pradesh v. Raj Narain, AIR 1975 SC 865; (1975) 4 SCC 428 (Mathew J.).
2. S.P. Gupta v. Union of India, AIR 1982 SC 149; 1981 Supp SCC 87 (Bhagwati J.).
3. Union of India v. Association for Democratic Reforms, (2002) 5 SCC 294; People’s Union for Civil Liberties v. Union of India, (2003) 4 SCC 399.
4. Reliance Petrochemicals Ltd. v. Proprietors of Indian Express Newspapers, Bombay Pvt. Ltd., (1988) 4 SCC 592.
5. Right to Information Act, 2005 (Act 22 of 2005), ss. 4(1)(b), 8.
6. K.S. Puttaswamy v. Union of India, (2017) 10 SCC 1.
7. Digital Personal Data Protection Act, 2023 (Act 22 of 2023), s. 44(3), brought into force by notification G.S.R. 843(E) dated 13 November 2025; the Digital Personal Data Protection Rules, 2025 were notified the same day by G.S.R. 846(E).
8. Right to Information Act, 2005, s. 8(1)(j) and the proviso following it, as originally enacted.
9. Girish Ramchandra Deshpande v. Central Information Commissioner, (2013) 1 SCC 212; Canara Bank v. C.S. Shyam, (2018) 11 SCC 426.
10. Central Public Information Officer, Supreme Court of India v. Subhash Chandra Agarwal, (2020) 5 SCC 481.
11. Digital Personal Data Protection Act, 2023, s. 44(3), substituting cl. (j) of s. 8(1) of the Right to Information Act, 2005.
12. Digital Personal Data Protection Act, 2023, s. 2(t).
13. Right to Information Act, 2005, s. 8(2); Ministry of Electronics and Information Technology, DPDP Act, 2023 Upholds Privacy While Preserving Transparency Under RTI, Press Information Bureau (20 August 2025), Release ID 2158506.
14. Venkatesh Nayak v. Union of India, W.P.(C) No. 177 of 2026 (Supreme Court of India, filed 6 February 2026), Ground Q.
15. Right to Information Act, 2005, s. 2(f) read with s. 2(j).
16. Digital Personal Data Protection Act, 2023, s. 3(a) read with s. 2(n).
17. Namrata Banerjee, Challenge to DPDP Act, Day 2: Law May Impede Investigative Journalism, Petitioners Argue, Supreme Court Observer (7 August 2026).
18. Puttaswamy (n 6).
19. Banerjee (n 17).
20. National Food Security Act, 2013, ss. 27, 28.
21. Ministry of Electronics and Information Technology (n 13).
22. Subhash Chandra Agarwal (n 10).
23. Puttaswamy (n 6).
24. Banerjee (n 17), recording the submissions of Vrinda Grover, Adv.
25. Regulation (EU) 2016/679 (General Data Protection Regulation), art. 85. Article 85 obliges Member States to reconcile the two rights by law; it is not itself a self-executing exemption.
26. Digital Personal Data Protection Act, 2023, ss. 2(i), 5, 6, 12.
27. Banerjee (n 17), recording the submissions of Nisha Bhambhani, Sr. Adv., for the Foundation for Media Professionals.
28. Press Club of India, Memorandum on the Digital Personal Data Protection Act, 2023 (25 June 2025), submitted jointly with other press bodies to the Union Minister for Electronics and Information Technology; Editors Guild of India, statement of 19 November 2025 urging a clarification exempting bona fide journalistic activity.
29. India’s New Data Protection Law: Death Knell for Press Freedom?, The Wire (4 April 2026) (Jaanne Bhi Do Yaaro, Anjali Bhardwaj and Amrita Johri in conversation with Nitin Sethi).
30. Sanya D. Kishwar, Sadqua Khatoon & Kritika Vatsa, Revisiting Right to Information in India: Is the DPDP Act counterproductive to RTI Act?, Oxford Human Rights Hub (11 July 2025); Digital Personal Data Protection Act, 2023, s. 33 and the Schedule (scale of monetary penalties).
31. Kishwar, Khatoon & Vatsa (n 30).
32. Venkatesh Nayak (n 14), Ground R, referring to Right to Information Act, 2005, s. 4(1)(b)(viii), (ix), (x) and (xiii).
33. Digital Personal Data Protection Act, 2023, ss. 17(1)(c), 17(2), 33(1), 36, notified by G.S.R. 843(E) dated 13 November 2025 but to come into force eighteen months after publication.
34. Digital Personal Data Protection Rules, 2025, r. 17(1) and (2); Digital Personal Data Protection Act, 2023, s. 33 and the Schedule.
35. Venkatesh Nayak (n 14), Ground U. The petition separately challenges r. 23(2) of the Digital Personal Data Protection Rules, 2025, which is to come into force at the same eighteen-month remove.
36. K.S. Puttaswamy v. Union of India, (2019) 1 SCC 1; Anuradha Bhasin v. Union of India, (2020) 3 SCC 637, para. 66.
37. Subhash Chandra Agarwal (n 10); Girish Ramchandra Deshpande (n 9); Banerjee (n 17), recording the submission of Prashant Bhushan, Adv., that the balance struck by the original s. 8(1)(j) has been dismantled.
38. Venkatesh Nayak (n 14), Grounds P and Q.
39. Venkatesh Nayak (n 14), Synopsis (contending that s. 44(3) violates Article 14 by equating the privacy of public functionaries with that of ordinary citizens).
40. India Const. art. 19(2); Venkatesh Nayak (n 14), Ground F.