The RTI-DPDP Collision: Why the Supreme Court's "Complex But Interesting" Question Will Reshape Indian Transparency Law

The Battle Lines Are Drawn

When the Supreme Court described the constitutional challenge to Section 44(3) of the DPDP Act, 2023 as raising a "complex but interesting" question about the balance between privacy and transparency, it wasn't merely being judicially polite. The Court has now referred the matter to a larger bench—a signal that what's at stake isn't just statutory interpretation, but a fundamental reordering of two rights that have coexisted uneasily since the RTI Act came into force in 2005.

The petitioners have challenged the DPDP Act's amendment to Section 8(1)(j) of the RTI Act, which previously allowed disclosure of personal information if larger public interest justified it. The amended provision now exempts all personal information from disclosure unless it relates to public activity or interest—a shift that transparency advocates argue creates a near-absolute privacy shield over information that was previously accessible on a case-by-case basis.

What's particularly significant is the Court's refusal to grant interim relief against the masking or deletion of data already available on public portals. This suggests the bench isn't convinced that irreparable harm flows from maintaining the status quo pending final adjudication. But it also means that government departments and public authorities now have legal cover to begin scrubbing personal data from public records—a process that, once completed, may be difficult to reverse even if the challenge succeeds.

What Section 44(3) Actually Does

The original Section 8(1)(j) of the RTI Act exempted personal information from disclosure unless the Public Information Officer was satisfied that larger public interest justified disclosure. This created a balancing test—admittedly imperfect, but one that allowed journalists, activists, and lawyers to access information about public officials' assets, beneficiaries of government schemes, and even marksheets in cases involving public employment.

The DPDP amendment replaces this with language that exempts information which "relates to personal information" unless it cannot be disclosed without infringing privacy. The proviso allowing disclosure in larger public interest has been deleted entirely. This isn't a clarification—it's a substantive rewrite that tilts the scales decisively toward privacy.

The Court's observation that the case involves determining "what's public data" versus "personal data" cuts to the heart of the problem. In the digital age, this binary is increasingly artificial. A bureaucrat's property records are personal, but they're also public accountability data. A student's exam results are personal, but they become public interest information when that student is selected for a government job.

The Practical Fallout for Lawyers

For practitioners, the immediate implications are stark. RTI lawyers will find their practice substantially narrowed if the amendment stands. Due diligence investigations that rely on public records—asset declarations, educational credentials, criminal antecedents—will become harder to conduct. Corporate lawyers advising on regulatory compliance will need to recalibrate what information can legitimately be sought from public authorities.

More troubling is the precedent this sets for retrospective application. The petitioners' plea for interim relief specifically mentioned masking or deletion of data already in the public domain. If the DPDP framework is interpreted to require removal of previously accessible information, we're looking at a massive sanitization of public records—electoral rolls, court judgments, land records, company filings. The administrative burden alone would be staggering, but the loss to public accountability would be incalculable.

The Broader DPDP Implementation Context

This challenge comes at a peculiar moment in DPDP implementation. While certain provisions came into force on 13 November 2025, the core obligations for Data Fiduciaries and Data Processors don't kick in until 13 May 2027. The government is clearly using this interregnum to iron out ambiguities—witness the Digital Personal Data Protection (Removal of Difficulties) Order, 2026 notified on 5 October, which clarifies consent requirements for children and persons with disabilities under Section 9, and confirms that Section 10's audit language refers to "data audit" for Significant Data Fiduciaries.

But the RTI amendment is already operational, creating an asymmetry: privacy protections are being enforced before the full DPDP compliance infrastructure is in place. The Data Protection Board of India remains non-functional—a fact highlighted by the Kerala High Court PIL seeking to make the Board operational within eight weeks. We're witnessing privacy law enforcement without institutional capacity, which is a recipe for arbitrary application.

What Happens Next

The larger bench will have to grapple with Justice K.S. Puttaswamy v. Union of India, which recognized privacy as a fundamental right but also acknowledged that it must be balanced against other rights, including the right to information under Article 19(1)(a). The question isn't whether privacy wins—it's whether Parliament can legislatively override the RTI Act's public interest test without violating the basic structure.

My prediction: the Court will uphold the amendment but read in a public interest exception, effectively restoring the status quo through judicial interpretation. This would be consistent with the Court's approach in other privacy-transparency conflicts. But until that happens, practitioners should assume that Section 44(3) is good law and advise clients accordingly.

For compliance teams, the message is clear: privacy notices are no longer boilerplate, as recent commentary emphasizes. The DPDP framework is being implemented piecemeal, and each clarification—from the Removal of Difficulties Order to the eventual Supreme Court ruling—will require immediate operational adjustments. The era of treating Indian data protection as a soft-touch regulatory environment is definitively over.