Context:

Recently, three separate PILs filed in the Supreme Court by the National Campaign for Peoples’ Right to Information (NCPRI), transparency advocate Venkatesh Nayak, and the Reporters’ Collective Trust have challenged the constitutionality of the Digital Personal Data Protection (DPDP) Act. The petitions argue that the DPDP Act undermines the Right to Information (RTI), hampers investigative journalism, and expands state surveillance powers.

Key Objections:

• • • • A key objection concerns the amendment to the RTI Act, 2005 under Section 44(3) of the DPDP Act. The amendment replaces the RTI Act’s “public interest override” with a blanket exemption for personal information. Previously, public officials could disclose personal information if it served a larger public interest. Petitioners argue that the new provision removes this balance, enabling public authorities to withhold information even when disclosure is critical for governance or accountability.
      • The petitions invoke the Supreme Court’s Puttaswamy judgment (2017), which mandates that any restriction on fundamental rights must satisfy the proportionality test. Petitioners contend that the DPDP Act fails this test, as it does not adopt the least restrictive means and arbitrarily limits the RTI framework, thereby threatening participatory democracy.

Impact on Investigative Journalism:

The Act classifies journalists handling personal data as data fiduciaries, imposing obligations to seek consent and erase data if consent is denied. Petitioners argue that these provisions are impractical for investigative reporting, make post-facto verification difficult, and create a chilling effect due to penalties of up to ₹250 crore. Such measures may discourage reporting on corruption, public interest issues, and government accountability.

Expansion of State Power and Surveillance:

Section 36 empowers the Union government to demand information from any data fiduciary without independent authorization or an appellate mechanism. Petitioners contend that this provision allows unrestricted access to personal data, including information that could reveal anonymous sources, thereby raising concerns about privacy, state overreach, and potential misuse in policy or electoral processes.

Independence of the Data Protection Board:

The DPDP Act establishes a Data Protection Board to enforce the law and impose penalties. Petitioners highlight that its appointment process is dominated by government secretaries and nominees, potentially undermining the principle of separation of powers. Given that the State is the largest data collector, such executive control over a quasi-judicial body raises doubts about the Board’s independence and impartiality.

About the Digital Personal Data Protection (DPDP) Act, 2023:

The Digital Personal Data Protection (DPDP) Act, 2023 is India’s first comprehensive law designed to protect digital personal data and safeguard the privacy of individuals (Data Principals), while allowing businesses (Data Fiduciaries) to process data for lawful purposes. Enacted on August 11, 2023, and fully operationalised with the DPDP Rules, 2025 on November 14, 2025, the Act seeks to balance individual privacy, business utility, and national security.

Conclusion:

While the DPDP Act aims to strengthen digital privacy protections, the constitutional challenge highlights its potential tensions with transparency, press freedom, and checks on state power. The Supreme Court will examine whether the Act strikes an appropriate balance between privacy, public interest, and democratic accountability.