INTRODUCTION
The relationship between informational privacy and the right to information is one of the most crucial and notable fields which have emerged as a new frontier in the Indian constitutional law. The very recent promulgation of the Digital Personal Data Protection Act 2023 (DPDP Act) and the following notification of the Digital Personal Data Protection Rules 2025 1have brought about a great change in terms of data processing and transparency regime. This litigation that proceeds in Venkatesh Nayak v. Union of India W.P.(C)177/2026 (SC) 2is a critical and significant test by the Indian courts on the whether the new data protection regime balances the delicate between the fundamental right to privacy as enshrinement in the Constitution of India 1950, Article 21 3and the fundamental right to information as enshrinement in the Constitution of India 1950, Article 19(1)(a). 4
This report is a comprehensive analysis of the constitutional problems that have emerged as a result of the DPDP Act that encompasses the amendment of the Right to Information Act 2005 (RTI Act) and the increase in the surveillance powers of the states as well as the institutional design of the Data Protection Board of India.
THE CONSTITUTIONAL GENESIS: FROM RAJ NARAIN TO PUTTASWAMY
The legal framework for the right to transparency in India did not develop in a vacuum and has been the result of judicial articulation and social activism spread over many decades. The right to information as an aspect of freedom of speech and expression was first articulated in the judgment of the Supreme Court of India in State of Uttar Pradesh v Raj Narain AIR SC 865, where it was observed that in a government of responsibility, where all the agents of the government are expected to be responsible for their actions, there can be few secrets. 5This principle has been enunciated in the Right to Information Act of 2005, which has been enacted with the purpose of providing a concrete framework for citizens to seek information under the control of public authorities, thereby promoting transparency and accountability in the working of every public authority6.
Along with the articulation of the right to information, the right to privacy has been evolving in India, with early cases such as MP Sharma v Satish Chandra SCR 1077 7and Kharak Singh v State of Uttar Pradesh AIR SC 12958 giving a limited understanding of the right to privacy, which has been revolutionized in the judgment of the nine-judge bench in Justice KS Puttaswamy (Retd) v Union of India 10 SCC 1 (Puttaswamy I), where it has been observed that the right to privacy is a fundamental right and is protected under Articles 14, 19, and 21 of the Constitution of India, and informational privacy is an essential aspect of individual autonomy9. In addition, it has been observed in the judgment of the nine-judge bench in Puttaswamy I that for any interference in the right to privacy, there has to be legality (the existence of a law), legitimacy (the existence of a valid state purpose), and proportionality (the existence of a rational nexus and least restrictive means).10
The rationale for the introduction of the DPDP Act 2023 was ostensibly to provide the legislative guidelines for data protection as required in the Puttaswamy judgment. However, the petitioners in Venkatesh Nayak v Union of India contend that the Act does not protect the citizen from the state but rather employs the right to privacy as a cloak for the state to protect itself from public scrutiny.11
STRUCTURAL ANALYSIS OF THE DIGITAL PERSONAL DATA PROTECTION ACT 2023
The DPDP Act 2023 is based on the “SARAL” principles – Simple, Accessible, Rational, and Actionable – aimed at providing a citizen-centric approach in the processing of data. The legislation is based on seven principles:
Consent and Transparency, Purpose Limitation, Data Minimization, Accuracy, Storage Limitation, Security Safeguard and Accountability.12
| Principle | Description and Implementation | Statutory Basis |
|---|---|---|
| Consent | Processing is lawful only with free, specific, informed, and unambiguous consent. | Section 6 |
| Purpose Limitation | Data must be processed only for the purpose for which consent was given. | Section 4 |
| Data Minimization | Only the data necessary for the specified purpose should be collected. | Section 5 |
| Accountability | Data fiduciaries are responsible for compliance, even if processing is outsourced. | Section 8 |
| Individual Rights | Data principals have rights to access, correction, erasure, and grievance redressal. | Sections 11–13 |
| Penalties | Significant financial penalties for breaches, up to ₹250 crore. | Section 33 |
Table 1- Provisions of DPDP Act
While the Act provides a robust framework for the regulation of private sector data fiduciaries, the exemptions provided to the state and the amendments to the RTI Act are the crux of the present constitutional challenge.
THE COLLISION: AMENDING SECTION 8(1)(J) OF THE RTI ACT 2005
The most contentious provision of the DPDP Act is Section 44(3), which amends Section 8(1)(j) of the RTI Act 2005. 13 This provision has been interpreted as the “death knell for participatory democracy” as it eliminates the nuanced test for disclosing personal information in the public interest.14
A. The Shift from Qualified to Absolute Exemption
Section 8(1)(j) of the RTI Act 2005 is a qualified exemption provision, which states that “information relating to any personal information which has no relationship to any public activity or interest, and which is otherwise available only in a directory or register which is available for inspection in person in public libraries or with any public body, shall not be subject to the right of access under this Act.15” However, this exemption is qualified with the following conditions:
1. The information has no relationship to any public activity or interest; or
2. The disclosure of the information would cause an unwarranted invasion of the privacy of the individual.
Moreover, the RTI Act 2005 has a proviso which allows disclosure where a larger public interest justifies it. The DPDP Act replaces this nuanced standard with the simplified phrase “information which relates to personal information.” 16By doing so, the amendment effectively removes:
1. The requirement to examine the connection between the information and any public activity.
2. The obligation to determine whether the invasion of privacy would be “unwarranted.”
3. The public interest override and the parliamentary proviso that previously ensured accountability.17
B. Impact on Transparency and Public Accountability
The removal of the public interest test results in a “blanket ban” on any information that can be considered personal data18. This effect is amplified by the broad definition of “personal data” under Section 2(t) of the DPDP Act, which defines it as any data about an individual who is identifiable by or in relation to such data. 19Consequently, public authorities may now refuse a wide range of information requests involving government employees, welfare beneficiaries, or public officials.20
Historically, the RTI Act has played a crucial role in exposing corruption, often through access to personal information closely linked with public duties. The following table illustrates categories of information that may now fall outside public scrutiny.
| Category of Information | Pre-Amendment Status (Qualified) | Post-Amendment Status (Blanket Exemption) |
|---|---|---|
| Asset Declarations | Disclosable if justified by public interest | Generally exempt as “personal information.” |
| Disciplinary Records | Disclosable when connected to corruption or public misconduct. | Likely exempt, potentially shielding corrupt officials. |
| Welfare Beneficiaries | Disclosable for social audits (e.g., MGNREGA, PDS lists). | Potentially exempt, weakening social audit mechanisms and anti-corruption monitoring. |
| Public Funds Usage | Disclosable to ensure accountability in statutory discretion. | May be denied if linked to identifiable public officials. |
Table 2 – Comparison of Pre amendment Status of DPDP Act and Post Amendment Status
The Union government argues that Section 8(2) of the RTI Act allowing disclosure when public interest outweighs potential harm provides an adequate safeguard. 21However, many legal scholars consider this insufficient because it operates only at the appellate stage. This structure places a heavier burden on citizens and effectively allows Public Information Officers (PIOs) to default to denying information at the initial stage22.
CONSTITUTIONAL INQUIRY: VENKATESH NAYAK V UNION OF INDIA
The writ petition filed by Venkatesh Nayak challenges the constitutionality of Sections 17(1)(c), 17(2), 33(1), 36, and 44(3) of the DPDP Act, along with certain provisions of the 2025 Rules. On February 16, 2026, the Supreme Court, headed by Chief Justice Surya Kant, issued notice and referred the matter to a Constitution Bench, observing that the case requires an “authoritative balancing” of competing fundamental rights.23
A. Challenge under Article 19(1)(a): The Right to Know
The petitioners argue that the amendment to Section 8(1)(j) imposes an unreasonable restriction on the freedom of speech and expression. The Supreme Court has consistently recognized the “right to know” as essential for the functioning of a democratic system. By transforming a limited privacy exemption into a broad and near-absolute bar, the state has effectively elevated a statutory data protection interest over the constitutionally protected right to information.24
Under the framework established in Anuradha Bhasin v Union of India (3 SCC 637), restrictions on fundamental rights must represent the least intrusive measure available. The petitioners therefore argue that privacy could have been protected through mechanisms such as anonymization or redaction of sensitive details while still allowing disclosure of the substantive content of public records, rather than imposing a sweeping prohibition on access.25
B. Challenge under Article 14: Manifest Arbitrariness
The petition also argues that several provisions of the DPDP Act are manifestly arbitrary and therefore violate Article 14 of the Constitution, which guarantees equality before the law. The doctrine of “manifest arbitrariness,” articulated in Shayara Bano v Union of India (9 SCC 1), permits courts to invalidate legislation that is capricious, irrational, or lacks a clear guiding principle.26
According to the petitioners, the DPDP Act demonstrates arbitrariness in several respects:
1. It places the privacy interests of public officials performing public duties on the same footing as those of ordinary private citizens, creating an irrational classification.
2. Section 36 authorizes the Union government to demand information from data
fiduciaries without clear statutory guidance or procedural safeguards.27
3. Section 33(1) imposes heavy financial penalties but does not clearly define what constitutes a “significant” data breach, raising the possibility of inconsistent or discriminatory enforcement.28
C. Challenge under Article 21: Proportionality and Privacy
Paradoxically, the Act is also challenged for infringing the very right it seeks to safeguard the right to privacy under Article 21, which encompasses the right to life and personal liberty. 29The Puttaswamy judgment established that any limitation on privacy must satisfy the proportionality requirement, meaning that the measure adopted must be necessary and proportionate to the legitimate objective pursued.30
The petitioners argue that the broad exemptions granted to the state under Section 17 risk enabling an unchecked surveillance framework.
SURVEILLANCE AND THE ARCHITECTURE OF STATE CONTROL
Sections 17 and 36 of the DPDP Act have been identified as possible structural “backdoors” that may facilitate state surveillance, potentially creating a significant imbalance between governmental authority and individual rights.31
A. Section 36: Coercive Power to Call for Information
Section 36 gives the Central Government the power to demand that Data Protection Board or any data fiduciary disclose “any such information” to the purposes of the Act. Critics claim that this authority does not have substantive preconditions that other statutes that have dealt with surveillance previously, like the Indian Telegraph Act 1885 or the Information Technology Act 2000. 32
The DPDP Rules 2025 further define the permissible “purposes” for seeking such information in ways that expand executive discretion.
| Purpose | Source | Critical Concern |
|---|---|---|
| Sovereignty and Security | Rule 22, Seventh Schedule | Does not require the traditional thresholds of “public emergency” or necessity. |
| Fulfilling any law | Rule 22, Seventh Schedule | A broad phrase that could permit intrusion into any legal domain without clear safeguards. |
| Determining SDF status | Rule 22, Seventh Schedule | Classification as a “Significant Data Fiduciary” is a policy decision that arguably should not require access to individual personal data. |
Table 3 – Rules of DPDP Act
An analysis published in the National Law School of India Review (NLSIR) suggests that these provisions fail the necessity stage of the proportionality test because they enable general and indiscriminate (bulk) surveillance rather than targeted monitoring. 33Moreover, the absence of safeguards such as executive review or mandatory destruction of collected records represents a regression when compared with standards laid down in PUCL v Union of India (1 SCC 301).34
B. Section 17: Broad State Exemptions
Section 17(2) authorizes the government to exempt any state agency or department from the Act’s provisions in the interests of sovereignty, security, public order, or prevention of incitement to an offence. 35Petitioners argue that such sweeping exemptions risk creating a “Big Brother” scenario in which the state acts as a powerful data fiduciary without being subject to the transparency and accountability obligations imposed on private entities.36
INSTITUTIONAL INDEPENDENCE: THE DATA PROTECTION BOARD OF INDIA
The Data Protection Board of India (DPBI), created under Chapter V of the DPDP Act, forms the institutional mechanism responsible for enforcing data protection obligations. 37However, the composition and appointment process of the Board have raised serious concerns regarding the principle of separation of powers.
Executive Dominance in the Selection Process
Under the DPDP Rules 2025, the search-cum-selection committee responsible for appointing the Chairperson and members of the Board consists primarily of government secretaries and government-nominated experts. 38Critics argue that this executive dominance undermines institutional independence because the Board exercises quasi-judicial functions such as investigating violations, adjudicating disputes, and imposing substantial penalties39.
The petitioners rely on the Madras Bar Association v Union of India line of cases as precedent. In Madras Bar Association v Union of India (INSC 352), the Supreme Court emphasized that the selection process for members of quasi-judicial bodies should remain independent of executive control and ideally involve the Chief Justice of India or a judicial nominee.40
| Feature of DPBI | Current Framework | Madras Bar Association Standard |
|---|---|---|
| Selection Committee | Dominated by government representatives | Judicial primacy or majority recommended |
| Tenure | Fixed term determined by government | Secure tenure to safeguard independence |
| Removal Process | Controlled by the executive | Removal should follow constitutional safeguards |
| Institutional Position | Placed under the Ministry of Electronics and IT | Independent regulator required |
Table 4
The lack of institutional autonomy becomes particularly problematic because the Board may be required to adjudicate matters involving government departments, which themselves act as major data fiduciaries.
IMPACT ON JOURNALISM AND FREEDOM OF THE PRESS
The DPDP Act’s classification of journalists as “data fiduciaries” has generated concerns about its implications for investigative journalism41. In contrast to the General Data Protection Regulation (GDPR) of the European Union, which clearly has a journalistic exemption in Article 8542, Indian one has journalists subjected to the same compliance requirements with respect to consent and notice as corporate entities.
Critics contend that such a provision might seriously hamper the investigative reporting, especially in the scenario where granting of prior consent to the subjects would be counterproductive to the reporting of corruption or malpractice.43
The “Chilling Effect” on Media Freedom
According to the Reporters’ Collective, the DPDP Act may create a significant “chilling effect” on press freedom for several reasons44:
1. Consent Paradox: Investigative journalism often requires processing personal data without the subject’s consent in order to expose matters of public interest.
2. Data Erasure: Section 12 stipulates that after its use; data should be erased after it has served its purpose which might hamper verification of the data after publication and defense of the media organization in defamation cases.45
3. Confidential Sources: Section 36 may be applied to force the media houses to divulge information which may lead to the disclosure of whistleblowers or confidential sources.46
In the case of Satamedia Case C-73/07, the Court of Justice of the European Union ruled that an activity can be discussed as a journalistic one provided that its goal is to inform the population about the issues that are of interest to the public and the manner of how these issues are addressed is irrelevant. 47One of the main issues that have been raised in the challenge made by the Reporters Collective is the lack of a comparable and comprehensive and protective definition on the Indian legal system.
SOCIO-POLITICAL IMPLICATIONS: WELFARE AND SOCIAL AUDITS
The revision of Section 8(1)(j) of the RTI Act may also have a major impact on social audit mechanisms that have traditionally enhanced transparency on welfare interventions like MGNREGA and Public Distribution System (PDS). 48
The social audits are based on publication of names of beneficiaries that includes information like names, addresses, and payment. Such revelations enable the local communities to determine whether their government funds have really reached the beneficiaries as intended or it has been stolen through the so-called ghost beneficiaries. In case such information is classified as personal data, the government officials have a chance to receive a legal ground to reject access requests. Opponents claim that this would weaken participatory governance and would turn decades of gains attained by grassroots accountability systems upside down.
COMPARATIVE CONSTITUTIONALISM: INDIA, THE UK, AND THE GDPR
According to scholars who examine the DPDP Act, India has a contrasting strategy to some of the international models, which seek to balance between privacy and transparency.
The GDPR Model: The General Data Protection regulation (2018) in the European Union acknowledges that data protection is not a right per se and is to be balanced with the conflicting rights, such as freedom of speech and access to information by the public49.
The UK Model: The United Kingdom maintains and enforces powerful public-interest override to prevent the privacy laws to become an instrument of governmental secrecy under the Data Protection Act 2018. 50
The Indian Divergence: Section 44(3) of the DPDP Act seems to be heading toward a kind of privacy absolutism in the case where the state is called upon, and at the same time increases the amount of access to personal data that the government has over its citizens.51
Scholars analyzing the DPDP Act note that India’s approach diverges from several international models that attempt to balance privacy with transparency.
CONCLUSION: SYNTHESIZING THE CONSTITUTIONAL PATH FORWARD
The case of ” Venkatesh Nayak v Union of India” is a turning point in the history of constitutional provisions of the digital era in India. The Supreme Court must resolve the new transparency-privacy paradox by adopting the proportionality doctrine to a law system that its critics say focuses on administrative convenience instead of constitutional protections.
According to the analysis, in spite of the fact that the aim to protect digital personal data is a justified one, the current legal regulation has three considerable constitutional flaws:
The expansion: The amendment to Section 8(1) (j) of the RTI Act has an overly broad approach, that is put in other words, it uses a hammer when it should have used a chisel, thus failing to meet the requirement of the least restrictive means.
Institutional weaknesses: The dominance of the executive over the selection process of Data Protection Board creates doubts over its ability to act as an independent regulatory body.
Unchecked Surveillance: The provisions under 17 and 36 give broad authority to the state without embedding the framework to the process required by the Supreme Court in Puttaswamy and PUCL.
The result of this case will have a determining factor in the development of the digital constitutional order in India. It will determine whether the system of governance adopted by the country focuses on openness and democratic responsibility or tends toward a regime that is marked on the increased surveillance capabilities that are supported by selective readings on privacy.
In order to reinstate constitutional balance, the judiciary might be required to read Section 8(1)(j) so as to revive that of a public-interest override and the establishment of an autonomous supervision of the state data-processing operations. Finally, the right to privacy and the right to information do not necessarily go in contradiction with each other, but are complementary values that ensure the maintenance of trust among the population, democratic participation, and accountability in the government.
*****
Footnotes
1. Press Information Bureau, ‘Digital Personal Data Protection Rules, 2025 notified’ (Government of India, 2025) https://static.pib.gov.in/WriteReadData/specificdocs/documents/2025/nov/doc20251117695301.pdf
2. Venkatesh Nayak v Union of India (n 1).
3. Constitution of India 1950, art 21.
4. Constitution of India 1950, art 15.
5. State of Uttar Pradesh v Raj Narain AIR 1975 SC 865; (1975) 4 SCC 428
6. Right to Information Act 2005.
7. MP Sharma v Satish Chandra AIR 1954 SC 300; (1954) SCR 1077.
8. Kharak Singh v State of Uttar Pradesh AIR 1963 SC 1295.
9. Justice KS Puttaswamy (Retd) v Union of India (2017) 10 SCC 1 (SC)
10. Ibid
11. Venkatesh Nayak v Union of India (n 1).
12. Press Information Bureau, ‘Press Release’ (Government of India) Press Release
13. Digital Personal Data Protection Act 2023, s 44(3); Right to Information Act 2005, s 8(1)(j)
14. Venkatesh Nayak v Union of India (n 1)
15. Right to Information Act 2005, s 8(1)(j).
16. Right to Information Act 2005, s 8(1)(j) proviso.
17. Natasha Matange and Arzu Chimni, ‘Privacy at the Price of Transparency: Legal Implications of the Amendments to Section 8 of the RTI Act’ (Mondaq, 22 December 2025)
18. Privacy and transparency: On the RTI Act amendment, petitions’ The Hindu (20 February 2026) https://www.thehindu.com/opinion/editorial/privacy-and-transparency-on-the-rti-act-amendment-petitions/article70652568.ece\
19. Digital Personal Data Protection Act 2023, s 2(t).
20. Matange and Chimni (n 18).
21. Ministry of Electronics and Information Technology, ‘DPDP Act, 2023 Upholds Privacy While Preserving Transparency Under RTI’ (Press Information Bureau, Government of India, 20 August 2025)
22. Rewati Karan, ‘Privacy, Public Interest and RTI: Why DPDP Act Is before Constitution Bench’ Moneycontrol (17 February 2026) https://www.moneycontrol.com/news/india/privacy-public-interest-and-rti-why-dpdp-act-is-before-constitution-bench-13832751.html\
23. Venkatesh Nayak v Union of India (n 1)
24. Ibid
25. Anuradha Bhasin v Union of India (2020) 3 SCC 637
26. Constitutionality of the Digital Personal Data Protection Act, 2023’ Supreme Court Observer https://www.scobserver.in/cases/constitutionality-of-the-digital-personal-data-protection-act-2023/\
27. Digital Personal Data Protection Act 2023, s 36.
28. Digital Personal Data Protection Act 2023, s 33.
29. Constitution of India 1950 (n 4) art 21.
30. Justice KS Puttaswamy (Retd) v Union of India (n 7)
31. Ananya Gupta, ‘Cybernetic Conundrum: Decrypting Privacy Concerns Amid Governmental Data Regulation Efforts’ (Chanakya Law Review, Vol V Issue I, Jan–June 2024)
32. Digital Personal Data Protection Act 2023, s 36; see also Indian Telegraph Act 1885, ss 5–7; Information Technology Act 2000, ss 69–69B.
33. G Bhatia, ‘State Surveillance and the Right to Privacy in India’ (2014) National Law School of India Review (NLSIR) https://repository.nls.ac.in/cgi/viewcontent.cgi?article=1192&context=nlsir\
34. People’s Union for Civil Liberties v Union of India (1982) 1 SCC 301.
35. DPDP Act 2023, s 17(2).
36. Justice KS Puttaswamy (Retd) v Union of India (n 10)
37. Digital Personal Data Protection Act 2023, ch V
38. Digital Personal Data Protection (DPDP) Rules 2023, r 17.
39. Venkatesh Nayak v Union of India (n 1).
40. Madras Bar Association v Union of India and Another (2025) INSC 1330, Supreme Court of India.
41. DPDP Act 2023, ss 2(t), 17–18
42. GDPR [2016] OJ L119/1, art 85
43. Ashwin Bhat, Navigating the New Norm: The DPDPA’s Critical Impact on Journalism in the Digital Age (Phoenix Legal) https://www.phoenixlegal.in/articles-updates-details.php?articles_id=624\
44. Editors Guild of India. (2023, August 6). EGI statement on Digital Personal Data Protection Bill, 2023. Editors Guild of India. Retrieved September 16, 2023, from https://bit.ly/3RZzecU
45. Digital Personal Data Protection Act 2023, s 12.
46. Digital Personal Data Protection Act 2023, s 36.
47. Satamedia SA v Institut national de la propriété industrielle (INPI) C-73/07, EU:C:2008:174.
48. Right to Information Act 2005 (India), s 8(1)(j), as amended by the Right to Information (Amendment) Act 2019.
49. Regulation (EU) 2016/679 (General Data Protection Regulation) [2016] OJ L119/1, art 85.
50. Data Protection Act 2018 (UK), ss 15–26 and sch 2 para 26.
51. Digital Personal Data Protection Act 2023, s 44(3).