Constitutional Validity of the Digital Personal Data Protection Act (DPDP Act), 2023 : Privacy, RTI and the Supreme Court Challenge
Introduction
India’s Digital Personal Data Protection Act, 2023 (DPDP Act) was enacted to create an exhaustive legal framework for the protection of digital personal data and individuals’ privacy. Ironically, the law enacted to strengthen privacy has itself become the subject to a constitutional challenge in the supreme court.
The controversy is mainly on the amendment to Section 8(1)(j) of the Right to Information Act, 2005. The amendment to section 8(1)(j) expands the exemption of personal information by removing the term ‘larger public interest’. This amendment blanket bans any digital personal information from being shared even if it is for larger public interest.
The petitioners argued, this weakens and restricts the citizens’ right to know. This raises the important question – Can protection of personal privacy be achieved at the cost of transparency, freedom of expression and public’s right to information?
Evolution of Data Protection in India
The DPDP Act is the result of several years of constitutional and legislative development. The starting point is the supreme court’s landmark K.S. Puttaswamy judgment.
K.S. Puttaswamy v. UOI (2017)
In this case, Petitioners challenged the validity of governments Aadhar biometric identification program, arguing that it violates the individual’s privacy by collecting data. A nine-judge Bench recognised that the right to privacy is a fundamental right. It ruled that privacy is an essential part of human dignity and personal liberty protected under article 21.
Justice B.N. Srikrishna Committee (2017-2018)
Following Puttaswamy judgment, the government created the committee of experts under Justice B.N. Srikrishna in 2017 to examine data protection in India. The committee submitted its report in 2018 and proposed the statutory framework for protection of personal data.
Personal Data Protection Bill, 2019
The government introduced the Personal Data Protection Bill, 2019 in parliament on 11 December 2019. It referred to a joint parliamentary committee which submitted its report in December 2021.
The bill contained broader aspects than the current DPDP Act. It contained detailed provisions of data localisation, categories of personal data, proposed data protection authorities and exemptions relating to matters such as journalism. The bill did not pass and was withdrawn on 3rd August, 2022.
DPDP Bill, 2023
The Digital Personal Data Protection Bill, 2023 was introduced in the lok sabha on 3rd August 2023 and passed by parliament on 9th August 2023. It received presidential assent on 11 August 2023.
The DPDP Rules, 2025 were subsequently notified on 14 November 2025, providing the detailed framework of the implementation of the act.
Importance of the DPDP Act
DPDP Act is India’s first comprehensive legislation specifically focused on digital personal data protection. The importance of the act arises because of the large quantity of personal data processed in the digital economy.
Mostly in every sector like government, banks, hospitals, e-commerce platforms, social-media companies and other digital services routinely process data or personal information.
Misuse of such data can result in –
- Reputational harm
- Loss of individual autonomy
- Identity theft
- Financial fraud
The DPDP Act is therefore significant as it attempts to create a legal balance between individual privacy and legitimate data processing by businesses and State.
Objective of DPDP Act
The main aim of the Act is to regulate the processing of digital personal data while recognising both-
- The individual’s right to protect personal data, and
- The need to process personal data for lawful purposes
The act establishes the relationship between:
- Data Principal – an individual to whom data relates
- Data Fiducary – the entity determining why and how personal data is processed.
- Data Processor – an entity processing data on behalf of a data fiduciary.
The act deals with consent, notice, security safeguards, data breaches, children’ data, individual rights, grievance redressal and penalties. It also establishes the Data Protection Board of India.
How does the DPDP Act amend other laws?
Section 44 of the DPDP Act provides amendments to several statutes, including the Information Technology Act, 2000 and the Right to Information Act, 2005. The most Constitutionally significant amendment is to the RTI Act.
Amendment to the RTI Act
Section 44(3) of the DPDP Act substitutes section 8(1)(j) of the RTI Act. Earlier, section 8(1)(j) exempted personal information where disclosure had no connection to the public at large or public interest. Disclosure was permitted only if there was a larger public interest involved.
The section 44(3) of the DPDP Act amends section 8(1)(j) of the RTI Act as ‘information which relates to personal information’.
It explicitly removed the term ‘public interest’. This is controversial as now authorities may simply classify information as ‘personal information’ and refuse to disclose it. This creates a direct constitutional conflict between two articles, Article 19(1)(a) Right to know and access information and Article 21 Right to privacy.
Therefore, the question arises whether the parliament can expand privacy protection in a manner that restricts the constitutional right to know.
Why was the DPDP Act challenged?
The constitutional challenge began with the petition filed by RTI activist ‘Venkatesh Nayak’ on 2nd February 2026 under the article 32 of the constitution. The petition challenges sections 17(1)(c), 17(2), 33(1), 36 and 44(3) of the DPDP Act and Rules 17 and 23(2) of DPDP rules, 2025.
The petitioners argue that specific provisions are unconstitutional as they interfere with fundamental rights. The major challenges concern Articles 14, 19(1)(a) and 21.
How it infringes Articles 14, 19(1)(a) and 21 of the Constitution of India?
It infringes article 14 as the provisions of DPDP Act provides the broad power to the executive which may lead to arbitrary decision-making. Journalists argued that the provisions of DPDP Act affects Article 19(1)(a), right to know and journalism. They said this framework could affect investigative journalism, particularly where journalists process personal information while investigating matters of public interest.
After Puttaswamy judgment, informational privacy forms part of the fundamental right to privacy. Privacy is the objective of both the DPDP Act and Constitutional interest. The issue here is whether the statutory provisions made by parliament protects privacy proportionally while respecting other fundamental rights.
What has happened recently?
On 16th February, 2026, the supreme Court issued notice to the centre but declined to grant an interim stay on the challenged provisions. The court said that it would not stay a statutory law enacted by parliament without hearing the full matter.
In the most recent hearing on 7th August 2026, the bench of CJI Surya Kant, Justice Joymalya Bagchi and Justice V. Mohana, focused on the amendment to section 8(1)(j) of the RTI Act. Constitutional challenge remains pending and the supreme court has not yet delivered a final judgement.
Conclusion
The constitutional validity of the challenged provisions of DPDP Act and Rules are still pending before the Supreme Court. No final judgement has been delivered yet and therefore, no blanket stay on the DPDP framework.
The case is significant as it requires the supreme court to determine how India should balance, right to privacy (Article 21), right to know (Article 19(1)(j)) and equality and protection against arbitrariness (Article 14).
For CLAT PG aspirants, the DPDP litigation is therefore an important example of constitutional balancing and proportionality in the digital age.
Subscribe for updates
Join 10,000+ subscribers.
JU
Julie Nigam
Contributing author
Have a doubt about this?Ask Doubts
