Petitions Challenging DPDP Act in SC : Data, The New Wealth; Its Protection, A New Battleground

As the Supreme Court weighs the Digital Personal Data Protection Act against the right to information, activists warn of a ‘death knell’ for government transparency, says Ritika Jain.

New Delhi: The Supreme Court is all set to examine five petitions challenging the constitutionality of the Digital Personal Data Protection (DPDP) Act, 2023, its rules that were notified in 2025 and crucial amendments to the Right to Information (RTI) Act, 2005 necessitated as a direct result of the former.

On March 12, the bench of Chief Justice of India Surya Kant, Justice Joymalya Bagchi and Justice Vipul M Pancholi at the Supreme Court of India issued notice in a Public Interest Litigation (PIL) challenging key provisions of the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025.

The petition filed by senior journalist Geeta Seshu* and the Software Freedom Law Center, India (SFLC.in), is the fifth petition filed to challenge provisions of the DPDP Act and Rules and raises significant constitutional concerns relating to privacy, surveillance, press freedom, and the independence of India’s data protection regulator.

The five petitions essentially plead that, in one fell swoop, the Centre’s law—meant to protect digital personal information— introduces a “chilling effect” on the free press and has become a “death knell” for the right to seek government accountability. The petitions maintain that the new law dilutes provisions of the more than two-decade-old RTI Act and limits the freedom of the press.

They will be collectively heard on March 23. Other petitions have been filed by RTI activists Venkatesh Nayak, Anjali Bharadwaj, and Amrita Johri, the National Campaign for People’s Right to Information (NCPRI) and journalist Nitin Sethi and The Reporter’s Collective.

Discussions over data privacy and regulation in India were initiated nearly a decade ago, when the Supreme Court in its 2017 Puttaswamy judgment declared privacy a fundamental right under Article 21. The Srikrishna Committee report on data protection and various iterations of the digital data protection legislation ultimately culminated in the passage of the DPDP Act in 2023 and the rules in 2025.

In an increasingly digitised state, access to official information has become more and more circumscribed. While activists have consistently flagged how the right to information act is being whittled down, privacy violations of citizens’ data occur across the board.

Public vs. Private: The Court’s Core Query

At its core, the DPDP Act raises conflicts between two fundamental rights: the right to privacy and the right to information.

On March 12, the Supreme Court raised a query that touches the heart of the conflict. Senior advocate Indira Jaising, appearing for petitioners Geeta Seshu and SFLC, said that the Act “does not define what is public and what is private data and this needs judicial intervention.”

Chief Justice of India Surya Kant observed: “…Interesting question that we will have to determine, that is, what is public data and what is personal data?” The bench wondered at what point data regarding a person holding public office should be treated as public, and when it should be seen as personal.

In an earlier February hearing, the court, while hearing one of the first pleas filed on this issue, pointed out that the complexity of the matter would require a balancing act between the two fundamental rights. Referring to the broader legal landscape, the CJI noted that “data is becoming the real true wealth as of date.”

The “death knell” for the RTI Act

In his plea, RTI activist Venkatesh Nayak submits that the new digital personal data protection law undoes 20 years of RTI jurisprudence and overturns the transparency framework when privacy is prioritised over the public’s right to know.

Previously, one could seek personal information on government officials if there was an “overriding public interest”. However, under the new laws, there is a near complete blanket-ban on seeking personal information of any kind.

Nayak’s plea suggests that the DPDP Act creates a blanket ban on access to personal information, which makes it virtually impossible to expose wrongdoing and corrupt officials in public office. “It allows the executive to deny information to citizens by citing the personal nature of the information, even for public functionaries entrusted with public duties,” the petition read.

“Instead of using a chisel, it has used a hammer and has thus rendered a body blow,” senior advocate Vrinda Grover, appearing for Nayak, had argued in the first hearing on February 16.

Advocate Prashant Bhushan, appearing for NCPRI, said the new data protection law prevents citizens from accessing information under RTI on matters relating to public office, audit reports and the utilisation of public funds.

In its petition, the NCPRI raises the question whether Parliament can, by deleting the statutory public-interest override in the amended RTI Act, convert a carefully calibrated privacy exemption into an absolute bar to disclosure, thereby extinguishing the operational safeguard that sustained the constitutionality of the RTI framework under Articles 14 and 19(1)a().

“It is a death knell for participatory democracy, and ruinous to ideas of open governance, which must guide the Indian polity in consonance with the Constitutionally recognised fundamental right of the citizen to know and be informed,” one petition reads.

In their plea, RTI activists Anjali Bharadwaj and Amrita Johri suggest that the amendments to the RTI Act, as a direct result of the DPDP laws go beyond their purpose and mandate. For example, the DPDP Act, which is limited to governing the processing of personal data in digital form, directly conflicts with amendments to the RTI Act where it affects disclosure of personal information held in all forms and not merely that held in digital form.

“By subordinating the public’s right to know to an overbroad and undefined exemption on the disclosure of personal information, the amendments erode the basic framework of open governance that the RTI Act operationalises, and consequently, the amendments fail the tests of reasonableness, proportionality, and constitutional necessity and are manifestly arbitrary, their petition read.

Bharadwaj and Johri further submit that the deletion of the “public interest” clause within Section 8(l)(j) of the RTI Act through the impugned amendment, transforms what was a justiciable, mandatory adjudicatory safeguard embedded at the point of decision-making by the PIO or appellate authority (in unamended section8(l)a)) into a diffused, post-facto discretionary power vesting in an undefined “public authority” which no citizen can enforce (public interest clause contained in Section 8(2)), thereby inverting the very architecture of the RTI Act.

“Chilling Effect” on free press

Petitions by Journalists Geeta Seshu and Nitin Sethi highlight the dangers to the free press and the ability to report without fear or favour in their pleas challenging provisions of the DPDP Act. The DPDP Act, 2023, read with the DPDP Rules 2025 prevent “journalists from carrying out their work in an independent manner and erodes the fourth pillar of democracy”.

The plea sought direction or declaration quashing and setting aside Sections 7, 17(2)(a), 19(3) 24, 36, 44(2)(a), and 44(3) of the Digital Personal Data Protection Act, 2023, for being unconstitutional, void and inoperative, and violative of Articles 14, 19(1)(a), 19(1)(g), 21 and 21A of the Constitution.

Section 44(3) of the Digital Personal Data Protection Act (DPDP Act) amended Section 8(1)(j) of RTI Act thereby exempting all personal information from disclosure. Exceptions earlier available in the RTI Act, whereby personal information could be denied only if it had no relationship to any public activity or public interest, or would cause unwarranted invasion of privacy, were scrapped.

Petitioners maintained that journalism is essential for “democratic accountability,” and this is only possible because of journalists who, with those helping in the endeavour, expose the truth. Those who participate in such endeavours need to be exempt from providing “notice and obtaining consent from persons on whom the journalistic report is based”.

Otherwise, this law would be “counter-productive to the interests of keeping the Government and its officials accountable to citizens because it thwarts the ability of citizens to expose wrongdoing of persons in positions of authority,” the petition read.

The Act and its rules,“impose a chilling effect on investigative journalism by deterring the lawful collection, processing, and publication of information”. This chilling effect operates with “particular severity” upon journalistic expression that is necessarily collaborative in nature and fundamentally dependent on the assistance of on-ground reporters, citizens, researchers, whistleblowers, RTI activists, civil society organisations, and others, who legally try to collect information regarding the functioning of public authorities, the petition said.

In her plea, journalist Geeta Seshu pointed this out when she said the Parliament was aware of this when framing the earlier avatars of the DPDP Act. The previous drafts of the DPDP laws— Personal Data Protection Bill, 2018, and the Personal Data Protection Bill, 2019—along with the Joint Parliamentary Committee’s Report, 2021, had created “carve-outs” for data processing requirements for information used for journalistic purposes.

This exemption is missing in the final Act.

State surveillance without safeguards

The DPDP laws provide unchecked powers to the State to process personal data bypassing accountability. It provides unchecked exemptions for the State and permits indefinite retention of data.

The laws further mandate Data Fiduciaries – which includes anyone seeking information under the amended RTI Act, to retain data and detailed records of all “information retrieval” for one year, even after the purpose of the information is complete.

This creates several unnecessary risks of harm to the data principal, as the log itself becomes a target for hackers and state surveillance, without any clear proportionality. It also forces those seeking information to maintain repositories of data that would otherwise be erased, increasing the surface area for potential breaches.

The DPDP laws also allow the State to demand data from fiduciaries (including newsrooms) potentially compromising anonymous sources and whistleblowers speaking against those in power.

Compensation Vacuum – What happens to the fines collected?

The DPDP laws not only impact the RTI Act, but it also directly conflicts with certain provisions of the Information and Technology (IT) Act, 2000. Under the IT Act, the Government could penalise (up to ₹250 crore) corporates for failure to implement reasonable security practices and entitled affected individuals to compensation for wrongful loss or wrongful gain.

However, the DPDP laws “dismantle” an aspect of this provision preventing citizens from claiming compensation for data breaches.

While the DPDP Act introduces a penalty-centric framework with fines running into hundreds of crores, such penalties are payable exclusively to the Consolidated Fund of India. “The data principal whose privacy is violated receives no compensation, restitution, or restoration, even in cases involving identity theft, financial fraud, reputational harm, or dignitary injury,” the plea read.

“The absence of compensation particularly undermines the enforcement of privacy rights against both private and State actors, weakens deterrence, and prioritises State’s fiscal considerations over individual dignity,” it added.

This also means citizens are left with “injury without remedy,” while the state enriches itself through fines.

Ultimately, the legal challenges to the DPDP Act throw up crucial questions about the owners, custodians and protectors of data as well as the public’s right to know and be informed.

*Journalist Geeta Seshu is co-founder editor of the Free Speech Collective. She has filed the petition challenging provisions of the DPDP Act along with SFLC.in in her personal capacity.

(Ritika Jain covers the Indian judiciary and hopes to simplify the law and decode the judiciary. Based in Delhi, Ritika is a writer, part-time dreamer & full-time K-drama addict. In an earlier avatar, she was a photojournalist in Mumbai).