Introduction
The Ministry of Electronics and Information Technology (“MeitY“) recently notified the Digital Personal Data Protection Rules, 2025, on November 14, 2025. This notification brings into force the Digital Personal Data Protection Act, 2023 (“DPDP Act“). Section 44 of the DPDP Act has amended the laws regarding to personal information and data in various other legislations. One of the legislations impacted is the Right to Information Act, 2005 (“RTI Act“). It is pertinent to point out that this amendment to the RTI Act is effective immediately even though the remaining amendments including to the Telecom Regulatory Authority of India Act, 1997 and the Information Technology Act, 2000, will be made effective in 18 months.
This amendment has been highly debated as a departure from the well-established principle of permitting transparency for public interest. While MeitY has emphasised that the amendment does not restrict the disclosure of personal information but instead ensures a balanced coexistence between privacy rights and the right to information, it is important to analyse the impact of this amendment in consonance with India’s democratic framework of accountability and transparency.
The Amendment to Section 8
Among the most consequential aspects of the DPDP Act is the amendment to Section 8(1)(j) of the RTI Act through section 44(3) of the Act. Prior to the amendment, Section 8 read:
“8. Exemption from disclosure of information.
(1) Notwithstanding anything contained in this Act, there shall be no obligation to give any citizen,
(j) information which relates to personal information the disclosure of which has no relationship to any public activity or interest, or which would cause unwarranted invasion of the privacy of the individual unless the Central Public Information Officer or the State Public Information Officer or the appellate authority, as the case may be, is satisfied that the larger public interest justifies the disclosure of such information:
Provided that the information which cannot be denied to the Parliament or a State Legislature shall not be denied to any person.”
Section 8(1)(j) has now been amended to only read “information which relates to personal information“. This redacts the exception carved out with regard to information that relates to public activity or interest. The unamended Section 8(1)(j) balanced the act of safeguarding an individual’s privacy and personal data while acknowledging the need of public oversight. The disclosure of personal data and information could be denied if either the information was not related to public activity or interest or the information causes an unwarranted invasion of privacy. This Section codified the judicial stance that privacy, while fundamental, is subject to reasonable restrictions. It prevents undue disclosure of personal information but does not impose a blanket prohibition. Instead, it creates a measured balance between privacy protection and the public’s right to know.
It is opined that this amendment addresses the longstanding tension between the right to privacy, recognised by the Supreme Court in Justice K.S. Puttaswamy v. Union of India (2017), and the right to information, which underpins democratic transparency. The “public interest” exception was contrary to the Puttaswamy judgment, which declared privacy to be a fundamental right. Fundamental rights by their very definition are meant to protect the individual against the state.
One could argue that Parliament should have winnowed down the “public interest” exception in Section 8(1)(j) in line with the Supreme Court conclusion in the Puttaswamy case that the right to privacy could be curbed to meet the “legitimate interests” of the state. Illustratively, the court identified the “legitimate interests” of the state as protecting national security, preventing crime, and preventing the dissipation of social welfare benefits. At no point did it advocate for a broad “public interest” exception to the fundamental right to privacy.
Further, even when the conditions are met, the clause included a proviso relating to “Public Interest Override”, which allowed the Public Information Officer (“PIO“) to impart the information if the interest of public at large outweighed the harm to privacy.
The Judicial Anchor
The Provision under RTI Act was the result of the landmark interpretation by the judiciary in the case of CPIO, Supreme Court of India vs. Subhash Chandra Agarwal (2020), where while upholding the disclosure of assets under the RTI Act, affirmed that the Right to Information and the Right to Privacy enshrined as fundamental rights under the case of S. Puttaswamy vs Union of India (2017), shall be dealt with care on a case-to-case basis.
The court laid emphasis on the proportionality test for the PIO. Under this test, transparency was the default and privacy was a valid defence, but one that could be overridden by a compelling public interest. Information, like the disclosure of the assets and communication of public functionaries done officially related to the public activity, would often fail to satisfy the privacy defence test. The balance was embedded such that a person’s medical records are safe, but the disciplinary record of a corrupt public officer was made accessible if it served the greater good.
The removal of the Public Interest Override
The elimination of the PIO is a critical setback for transparency. This implies that PIO is no longer required to performed under the test of Proportionality to balance privacy against accountability. If the information can be termed as “personal”, it is now a clear and absolute exemption from disclosure of such information, no matter its relation to corruption, fraud or misconduct. The DPDP Act itself defines “Personal Data” broadly as ‘data about an individual who is identifiable by or in relation to such data’. When applied in the context of the RTI Act, this allows for public officials to keep an enormous spectrum of documents with themselves which were previously accessible to the citizens.
Choosing Silence Over Disclosure
The argument presented by some proponents is that the public still has the access to such information via Section 8(2) of the RTI Act relating to the public interest since Section 8(2) allows for information disclosure. Section 8(2) states that notwithstanding anything in the Official Secrets Act, 1923 nor any of the exemptions permissible in accordance with sub-section (1), a public authority may allow access to information, if public interest in disclosure outweighs the harm to the protected interests. However, it is important to take note of the penalties imposed under the DPDP Act. The DPDP Act specifies severe monetary penalties for data breaches and non-compliance, which can be up to Rs. 250 Crores for a data fiduciary which includes public authorities and the PIOs. Faced with the threat of penalties, why would a PIO risk a allowing the disclosure of massive file crucial to public data, an asset declaration or a disciplinary record under Section 8(2) when the Section 8(1)(j) provides a clear shield? This liability risk will lead to extreme PIO risk-aversion, making the default decision denial, not disclosure.
Conclusion
The amendment to Section 8 of the RTI Act marks a decisive moment in the ongoing negotiation between a citizen’s right to know and an individual’s right to privacy. Carelessly applied, the amendment could risk hardening into a blanket shield for opacity and executive convenience. The task now lies with information commissions, courts, and vigilant citizens to insist that any restriction on transparency remains narrowly tailored, proportionate and firmly anchored in constitutional values.
English
Chinese (Simplified)
Japanese