Current Affairs Topics Archive
International Relations Economics Polity & Governance Environment & Ecology Science & Technology Internal Security Geography Social Issues Art & Culture Modern History

Why the new Digital Personal Data Protection Act faces a constitutional challenge in the Supreme Court

February 17, 2026 5 min read Polity & Governance GS2 (Governance Fundamental Rights Data Protection) GS3 (Science & Technology Cybersecurity)
On This Page ▼

What Happened

  • On February 16, 2026, the Supreme Court issued notice in The Reporters Collective Trust v. Union of India, admitting a constitutional challenge to the Digital Personal Data Protection (DPDP) Act, 2023 and the DPDP Rules, 2025.
  • The Supreme Court referred core questions — including the DPDP Act's amendment to the Right to Information (RTI) Act — to a five-judge Constitution Bench for hearing in March 2026.
  • Key constitutional concerns raised: Section 44(3) of the DPDP Act (which amends Section 8(1)(j) of the RTI Act) is alleged to be unconstitutional; Section 36 empowering the Centre to demand data from any "data fiduciary" is said to violate Articles 14, 19, and 21.
  • The petitions argue the Act lacks adequate protection for journalistic activities and public interest data processing, and allows overbroad government surveillance without proportionality safeguards.

Static Topic Bridges

The Puttaswamy Judgment: Right to Privacy as a Fundamental Right

The constitutional foundation for data protection in India is the landmark 2017 Supreme Court judgment in Justice K.S. Puttaswamy (Retd.) v. Union of India, in which a nine-judge bench unanimously held that the right to privacy is a fundamental right protected under Article 21 (right to life and personal liberty) and Part III of the Constitution. The judgment established a three-pronged test for any state encroachment on privacy: legality (there must be a law), necessity (there must be a legitimate state objective), and proportionality (the restriction must be rationally connected to the objective and minimally invasive).

  • Puttaswamy judgment delivered on August 24, 2017, by a nine-judge Constitution Bench.
  • The judgment overruled M.P. Sharma (1954) and Kharak Singh (1963), which had held privacy was not a fundamental right.
  • Privacy protection extends to: informational privacy (personal data), bodily integrity, and autonomy over personal decisions.
  • The proportionality standard — requiring that state action be the least restrictive means of achieving a legitimate objective — is now the test for data-related legislation.
  • The DPDP Act 2023 was enacted partly in response to the Supreme Court's mandate in Puttaswamy for a data protection law.

Connection to this news: The constitutional challenge to the DPDP Act directly invokes the Puttaswamy framework — petitioners argue the Act fails its own proportionality test by granting broad government exemptions from data protection norms while imposing stringent obligations on private data fiduciaries.

Section 44(3) of the DPDP Act: The RTI-Privacy Conflict

Section 44(3) of the DPDP Act, 2023 amends Section 8(1)(j) of the Right to Information Act, 2005. The original Section 8(1)(j) of the RTI Act allowed public authorities to deny disclosure of personal information only if disclosure would constitute an "unwarranted invasion of privacy" — but it preserved an override: if disclosure served a larger public interest, information could still be shared. The DPDP amendment replaces this nuanced provision with a blanket exemption for "information which relates to personal information," effectively removing the public interest override that had made the RTI Act a powerful accountability tool.

  • RTI Act 2005 was a landmark transparency law enabling citizens to access government-held information.
  • Section 8(1)(j) (original): personal information exempted unless larger public interest justified disclosure or it related to public activity.
  • Section 44(3) DPDP amendment: replaces this with a near-absolute exemption for personal information — significantly weakening RTI.
  • Critics argue this enables governments to refuse disclosure of information about public officials by classifying it as "personal information."
  • The Supreme Court's referral to a five-judge bench signals the issue has substantial constitutional significance.

Connection to this news: The conflict between data privacy (protected under Article 21 after Puttaswamy) and the right to information (essential for democratic accountability) raises fundamental constitutional questions about which fundamental right prevails — and whether the DPDP Act's tilting toward privacy protection at the cost of transparency meets the proportionality test.

Government Exemptions in Data Protection: Surveillance and Article 21 Concerns

Section 36 of the DPDP Act authorises the Union government to demand any information from a "data fiduciary" — an entity that determines the purpose and means of processing personal data. The DPDP Rules, 2025 (Rule 23) operationalise this power. Petitioners argue this provision is "vague, overbroad and arbitrary" and enables government surveillance of personal data without the individual's consent or judicial oversight.

  • A "data fiduciary" under the DPDP Act can be any entity — from a hospital to a social media platform to a bank — that holds and processes personal data.
  • Section 36 creates an asymmetry: private data fiduciaries face stringent notice, consent, and protection obligations; the government is exempt from key provisions under Section 17.
  • The Act contains broad governmental exemptions (Section 17) for national security, public order, and law enforcement — with no independent oversight mechanism.
  • Articles 14 (equality before law), 19 (freedom of speech and expression), and 21 (life and liberty) are invoked, arguing the unchecked government access violates the proportionality doctrine.
  • The Srikrishna Committee Report (2017) — which preceded the DPDP Act — had recommended a data protection authority independent of government control; the enacted law's Data Protection Board has weaker independence provisions.

Connection to this news: The Supreme Court's willingness to refer the matter to a Constitution Bench suggests judicial concern that the DPDP Act may not adequately balance the state's data interests against citizens' fundamental privacy rights — the very balance the Puttaswamy judgment required Parliament to strike.

Key Facts & Data

  • Digital Personal Data Protection Act, 2023 (No. 22 of 2023) — passed by Parliament in August 2023.
  • DPDP Rules, 2025 notified in January 2025.
  • Supreme Court issued notice on constitutional challenge: February 16, 2026.
  • Case: The Reporters Collective Trust v. Union of India.
  • Matter referred to five-judge Constitution Bench; hearing scheduled March 2026.
  • Section 44(3): amends Section 8(1)(j) of RTI Act — removes public interest override for personal information disclosures.
  • Section 36: empowers Centre to demand information from any data fiduciary.
  • Section 17: broad government exemptions from data protection obligations.
  • Puttaswamy v. Union of India (2017): nine-judge bench; right to privacy is fundamental right under Article 21.
  • Three-pronged test for privacy infringement: legality, necessity, proportionality.
  • Srikrishna Committee Report (2017) had recommended independent data protection authority.
  • Data Protection Board (under DPDP Act) — a government-constituted body; independence questioned.