What Happened
- On March 12, 2026, the Supreme Court issued notice to the Union of India on a Public Interest Litigation challenging the Digital Personal Data Protection (DPDP) Act, 2023 and DPDP Rules, 2025
- The court identified the central legal question as: "What is public data and what is private data?" — specifically, whether information about persons holding public office can be classified as private personal data and shielded from disclosure
- Petitioners include journalist Geeta Seshu, the Software Freedom Law Centre, Reporters' Collective journalist Nitin Sethi, RTI activist Venkatesh Nayak, and the National Campaign for People's Right to Information
- Key concern: Section 44(3) of the DPDP Act amends Section 8(1)(j) of the RTI Act, potentially removing the balancing test that previously allowed disclosure when public interest outweighed privacy
- The petition alleges the Act legalises disproportionate state surveillance, creates a "compensation vacuum" for data breach victims, and dilutes press freedom
- The Centre was asked to respond by March 23, 2026; the court refused to grant interim stay on the Act
Static Topic Bridges
The Digital Personal Data Protection Act, 2023: Key Provisions
The DPDP Act 2023 is India's first dedicated personal data protection legislation, passed after nearly six years of Parliamentary deliberation (following the Justice Srikrishna Committee Report of 2018 and multiple draft versions). It governs the processing of digital personal data in India, establishing rights for "Data Principals" (individuals) and obligations for "Data Fiduciaries" (entities processing data). The Act also creates a Data Protection Board of India for adjudication and enforcement.
- "Personal data" under Section 2(t): "any data about an individual who is identifiable by or in relation to such data"
- Data Fiduciaries must obtain consent for data processing; certain "legitimate uses" are exempt (state functions, employment, etc.)
- Section 36 grants the Central Government broad powers to exempt any entity from the Act's provisions in the interest of state sovereignty, security, public order, or friendly relations with foreign states
- The DPDP Rules 2025 notified the operational details, but were simultaneously challenged in court
- Data Protection Board: a government-appointed body (not independent tribunal), which has drawn criticism from privacy advocates
Connection to this news: The Supreme Court's framing of the "public data vs private data" question goes to the heart of the Act's scope — if elected officials' conduct of public duties can be termed "personal data," the Act could be weaponised to prevent accountability disclosures.
RTI Act and the DPDP Amendment to Section 8(1)(j)
The Right to Information Act, 2005 (RTI Act) enables citizens to access information held by public authorities, subject to specified exemptions. Section 8(1)(j) was one of the key exemptions — it protected personal information from disclosure unless the disclosure was in public interest. The original provision had a calibrated balancing test. The DPDP Act's Section 44(3) amended this provision to simply exempt "information which relates to personal information," potentially removing the balancing test and broadening the exemption.
- RTI Act 2005: landmark transparency legislation enabling accountability of government
- Original Section 8(1)(j) exempted personal information lacking nexus to public activity or interest and causing unwarranted privacy invasion — a balanced test
- Post-DPDP amendment: the exemption broadly covers "personal information" — critics argue this enables public officials to shield conduct-in-office data as "personal"
- The Puttaswamy judgment (2017) established privacy as a fundamental right under Article 21; the DPDP Act claims to operationalise this
- The DPDP Act's broad government exemptions under Section 36 have been characterised as legalising surveillance without adequate safeguard
Connection to this news: The Supreme Court's inquiry into whether public office-related data can be "personal" directly tests whether the DPDP amendment unlawfully narrows the RTI Act's reach over government accountability.
Right to Privacy as a Fundamental Right: Puttaswamy Legacy
The Supreme Court's nine-judge constitutional bench in Justice K.S. Puttaswamy v. Union of India (2017) unanimously held that the right to privacy is a fundamental right under Article 21 of the Constitution. The judgment identified privacy's multiple dimensions — spatial, personal autonomy, informational, and decisional — and required any state infringement to satisfy a three-part test: legality (law must exist), necessity (compelling state interest), and proportionality (means must be proportionate to ends).
- Puttaswamy (2017): nine-judge bench, unanimous on privacy as fundamental right
- The judgment directed Parliament to create a data protection law — this ultimately resulted in the DPDP Act 2023
- Proportionality test: state's data processing must serve a legitimate aim, be necessary for that aim, and not be excessive
- Critics of the DPDP Act argue that its broad government exemptions fail the proportionality test established in Puttaswamy
Connection to this news: The petitioners' argument that the DPDP Act "legalises disproportionate state surveillance" is framed directly in terms of the Puttaswamy proportionality standard — whether the Act's surveillance permissions satisfy the constitutional test.
Key Facts & Data
- DPDP Act enacted: August 11, 2023 (No. 22 of 2023)
- DPDP Rules notified: 2025
- Justice Srikrishna Committee report: 2018 (first expert committee on data protection)
- Puttaswamy judgment: August 24, 2017 (nine-judge constitutional bench)
- Section 44(3) of DPDP Act: amends Section 8(1)(j) of the RTI Act 2005
- Key petitioners: Geeta Seshu (journalist), Software Freedom Law Centre, Venkatesh Nayak (RTI activist)
- Date of Supreme Court notice: March 12, 2026
- Government response deadline: March 23, 2026
- Supreme Court bench (as of hearing): CJI Surya Kant + Justices Joymalya Bagchi and V.M. Pancholi