India’s Privacy Laws Come With a Huge Cost to RTI

After years of deliberation and legislative back-and-forths, the Digital Personal Data Protection (DPDP) Act, implemented last November, marked the end of India’s long wait for a data privacy regime that recognises privacy as a fundamental right. 

But at what cost? 

The DPDP Act alters the balance between privacy and transparency by amending Section 8 1(j) of the Right to Information (RTI) Act.

The RTI Act did not regard personal privacy as an absolute barrier to transparency. Rather, the original Section 8 1(j) sought to strike a careful balance, permitting the disclosure of personal information under specified conditions. It exempted personal information only where disclosure was unrelated to public activity or would amount to an unwarranted invasion of privacy, but still allowed disclosure if a larger public interest justified it.

Now, Section 44(3) of the DPDP Act directly amends Section 8 1(j), replacing this nuanced, multi-part test with what critics describe as a near-blanket exemption. The amended section exempts all “information which relates to personal information,” removing the core safeguards that previously governed disclosure.

Legal Challenges

At least three separate writ petitions have been filed before the Supreme Court challenging the amendment. 

One petition was filed by transparency activist Venkatesh Nayak, another by The Reporters Collective Trust along with journalist Nitin Sethi, and a third by the National Campaign for People’s Right to Information.

In February 2026, the Supreme Court issued notice on these petitions but declined to stay the law, allowing the new regime to remain in force. At the same time, it also referred the matter to a Constitution Bench, indicating that it views the conflict between privacy and transparency as a fundamental rights issue requiring authoritative resolution.

The union government has defended the change as a move to “harmonise” the RTI Act with the DPDP Act, arguing during parliamentary discussions that stronger safeguards are needed to prevent the unwarranted disclosure of personal data. It maintains that transparency is not curtailed, as disclosures mandated under other laws remain unaffected.

Multiple lawyers and activists AIM spoke to have raised concerns about the implications of the change. 

“The RTI Act already allowed for an exemption for personal information, but what it allowed each government office that is subject to RTI is to take a call in terms of whether a public interest is served in disclosing the information despite it being personal,” says Thomas Vallianeth, a tech, media, and telecom lawyer, and a partner at Trilegal law firm.

As a result of the amendments, he adds that the RTI mechanism is weakened and that the government is emboldened to refuse RTI applications on grounds of privacy. “Expect a few more rejections to your RTI requests,” he puts it bluntly.

Venkatesh Nayak, Director of the Commonwealth Human Rights Initiative and a petitioner challenging the amendment, argues that RTI access provisions serve a legitimate public interest in transparency, and that personal information protections should not trump the public interest in disclosure.

“The amendment to Section 8 1(j) makes it look like all personal information will be in a black box which nobody can access,” Nayak criticises.

The Parity Principle and Its Breakdown

The RTI Act had built in a safeguard to limit how exemptions could be used. Under Section 8 1(j), even when information was classified as “personal,” it could not be denied if it could be disclosed to Parliament or a state legislature.

“In the original scheme of the RTI Act, citizens’ rights were much bigger and broader than what MPs or MLAs could get on the floor of the house,” Nayak observes. 

Formally, this provision is attached to the personal information exemption under Section 8 1(j). Courts have generally treated it as a test within that clause, rather than as a rule governing all exemptions, even though it reflects a broader idea of democratic accountability.

The structure of the law reinforced this balance, allowing personal information to be denied only if it had no link to public activity or disclosure would constitute an unwarranted invasion of privacy. Even then, authorities had to consider whether a larger public interest justified disclosure.

In 2012, when the privacy law was still in its conceptual stage, the Justice AP Shah Committee, analysing various international privacy principles, had cautioned against allowing such a law to override RTI disclosures. 

In 2018, when the data protection law was drafted, the Justice BN Srikrishna Committee retained a case-by-case framework based on demonstrable harm. In both, privacy and transparency were meant to be balanced, not separated.

However, in 2023, with the enactment of the Digital Personal Data Protection Act, this structure was altered. By redefining the exemption to cover all “personal information” without the earlier conditions, the law allows authorities to deny requests at the threshold.

“The parity between people who elect the MPs and MLAs and the legislators has been removed, and that is a most unfortunate development,” says Nayak.

The parity clause still exists on paper, but its practical role is diminished. 

“They’ve simply not justified why they are necessary. The only thing they’ve said is the DPDP Act is there, and therefore Section 8 1(j) has to be amended,” he adds.

From Welfare to AI: Where the Impact Lands

Anjali Bhardwaj, a petitioner and founding member of Satark Nagarik Sangathan, a citizens’ group promoting transparency and accountability, notes that the effectiveness of the RTI framework has historically relied on access to granular information to hold governments accountable and analyse programmes like MGNREGA. 

She illustrates a case wherein, in Delhi, women experiencing ration shortages filed RTIs for sale and stock registers. “They were able to regularly access sale registers, stock registers and hold the department accountable, and therefore, corruption has gone down,” she tells AIM.

Similarly, students from Economically Weaker Sections or SC/ST categories have used the law to request lists of scholarship recipients. Other examples could be citizens who aren’t satisfied with civic infrastructure. 

“Now, what people immediately do is that they will go and file an RTI application asking for the name of the contractor who built this road,” Bharadwaj says. “But because personal information may include any information that identifies an individual, people will not be able to access these details,” she adds. 

This becomes even more consequential as the government is bent on scaling AI skilling and education programmes. Under the IndiaAI Mission, the government is funding compute infrastructure, datasets, and large-scale training initiatives. These programmes increasingly rely on data-driven selection, certification, and funding pipelines. In such a system, RTI has traditionally enabled scrutiny of beneficiary lists, selection criteria, and institutional partnerships. 

A broad exemption on “personal information” could make it significantly harder to audit who is being trained, funded, or excluded, particularly in high-value AI pipelines where public and private actors intersect.

The stakes are even higher in the context of public-private partnerships shaping India’s AI ecosystem. Under the IndiaAI Mission, private firms—from infrastructure providers to foundation model startups—are being onboarded to build core components of national AI capability, often with access to publicly funded compute resources and datasets.

In such arrangements, RTI has historically served as a tool to examine procurement decisions, allocation of public resources, and the terms of engagement between the state and private entities. If information relating to individuals, such as company executives, decision-makers, or beneficiaries, is categorically exempted as personal data, it risks limiting visibility into how these partnerships are structured and who ultimately benefits. This would also lead to challenges before the Data Protection Board.

What Next?

Nayak advocates for a case-by-case approach. He points to how countries like the US have approached this challenge. The United States’ Freedom of Information Act of 1966 operates on a case-by-case balancing framework; government records are presumed to be disclosable unless they fall within specific exemptions, including those protecting personal privacy.

And Indian courts have also historically followed a similar principle.

In the case of ‘Mr X versus Hospital Z’, the Supreme Court dealt with the disclosure of an HIV-positive patient’s medical status by a hospital to his fiancée’s family, leading to the cancellation of his marriage. The Court held that privacy could be overridden where disclosure served a competing public interest, illustrating a contextual approach rather than blanket exclusion.

Similarly, Bhardwaj’s petition challenges the amendment on the grounds of proportionality, arguing that it disproportionately restricts the fundamental right to information. She also questions the legislative scope of using a digital data protection law to amend the RTI Act, which governs access to public records across formats, digital or not. 

In practice, a significant portion of government records continues to exist in physical formats. “Digitisation is a fairly recent phenomenon… till 2020, Delhi Police records were not digitised,” she says. 

Applying a law designed for digital data to restrict access to all categories of public records, including physical documents, creates a mismatch between the scope of the law and the information it now governs. While the DPDP Act constitutionalises personal data protection, it does so by narrowing the citizens’ ability to scrutinise the world’s largest democracy.