India’s Digital Personal Data Protection (DPDP) Act, 2023 is under Supreme Court scrutiny over concerns that it may weaken the Fundamental Right to Information (RTI) and freedom of speech by placing state privacy above transparency. The Digital Personal Data Protection is facing several petitions in the Supreme Court on its constitutional validity. Academics and civil society stakeholders have argued that amendments to the Right to Information Act weaken the statutory right to know of citizens, restricting investigative journalism and endangering the independence of the Data Protection Board. Therefore, the Act stands at the centre stage where personal privacy and the demands of transparency and democratic accountability meet.
|
Key Highlights
- Digital Personal Data Protection Rules, 2025 (Overview)
- Amendments to RTI and Constitutional Concerns
- Restriction on Transparency in the Act
- Fundamental rights Dimension of the Act
- Effects of the Act on Investigative Journalism
- Autonomy of the Data Protection Board
|
Digital Personal Data Protection (DPDPA) Act 2023, which has been adopted by Parliament, is currently being subject to a constitutional review. Though the law is aimed at protecting the personal privacy of people in a digital world, there are three petitions that challenged its provisions, with specific references to the alterations to the Right to Information Act. The critics believe that these changes lower the transparency, stifle investigative journalism, and undermine the independence of the Data Protection Board. The ensuing controversy throws to light the very essence of the problem of privacy versus the right to know, which leads to much broader considerations of how India can balance the protection of individual data with constitutional liberties to free speech, press freedoms, and the independence of the institution concerned.
Digital Personal Data Protection Rules, 2025 (Overview)
The Digital Personal Data Protection (DPDP) Rules, 2025, notified by the Ministry of Electronics and Information Technology (MeitY) on November 13, 2025, give effect to the digital personal data protection act 2023 DPDP by laying down a detailed framework for the processing, storage, and protection of digital personal data in India. The rules place strong emphasis on informed user consent, child safety safeguards, and data accuracy standards, while introducing a phased compliance roadmap that grants organizations an 18-month transition period to meet regulatory requirements.
Legal Foundations of the Act
The Rules were notified on 14 November 2025 after public consultations, which resulted in over 6,900 submissions. They are planned to be implemented in a phased manner, between 2025 and 2027, and include regulations of data processing, user rights, and enforcement procedures.
Citizen‑Centric Framework of the Act
The Rules follow a rights-based approach, which guarantees a person the right to access, rectify, and erase his or her personal data. In addition, they ensure that organisations lawfully and transparently process data, and can be consistent with the international norms, including the European Union General Data Protection Regulation (GDPR).
Institutional Mechanisms of the Act
The Rules form the Data Protection Board of India, which is mandated with settling interpersonal disputes and implementing statutory adherence. However, the issue of independence of the Board still exists, especially following the power of the government to make appointments- a fact that has already attracted constitutional contest.
Amendments to RTI and Constitutional Concerns
The 2019 amendments to the RTI Act, along with provisions introduced under the DPDP Act 2023, have sparked constitutional debate over their potential impact on institutional independence and citizens’ right to access information. The implementation of the Digital Personal Data Protection Act (DPDPA) has spawned a substantive constitutional debate, and this is largely due to the modifications it made to the right to information act 2005 (RTI) Act. These changes raise some pertinent questions about transparency and accountability, and the rights of citizens.
Restriction on Transparency in the Act
The amendment extends the exemptions of the RTI, and the disclosure of personal information will not take place even in situations where the public interest can be significant. Petitioners argue that this is weakening the initial aim of the RTI to enable the citizen to review the government operations. The issue has been described as a sensitive one by the Supreme Court, and there is a need to balance the issues relating to privacy with the need to maintain transparency.
Fundamental rights Dimension of the Act
The petitions refer to the case Puttaswamy (2017), which states that any restriction on the fundamental rights must pass the test of proportionality. Critics suggest that the amendment causes unwarranted limits on Article 19(1)(a), which is the freedom of speech and expression, according to which democratic accountability is cut by limiting access to information about public officials.
Hindrance caused by the Amendment
A study carried out by the Centre of Policy Research in 2025 found that around 62 percent of RTI inquiries involved information that related to the actions of public officials. The new exemption can act as a hindrance to most of these disclosures and, therefore, significantly reduce transparency in the governance structures.
Effects of the Act on Investigative Journalism
The Right to Information (RTI) Act, 2005, a cornerstone of Indian democracy, has witnessed major legislative changes through the RTI (Amendment) Act, 2019 and, more significantly, the Digital Personal Data Protection Act (DPDPA), 2023. These amendments have raised serious constitutional concerns, particularly regarding the independence of oversight institutions and the delicate balance between the right to privacy and the principle of transparency. The DPDPA has raised many concerns over its implications for investigative journalism. Although its major aim is to protect privacy, the enforceable terms inadvertently endanger and unintentionally contain press freedom and democratic accountability.
Access to Public Records
Access to official records and disclosures that are made in the RTI Act is one of the power tools of investigative journalists. The DPDPA narrows the freedom of journalists to investigate state authorities and government entities by broadening the many exemptions of personal information. This curtailment is a possible way of keeping corruption and maladministration out of the limelight of the citizens, thus taking away the role of journalism as a watchdog.
Chilling Effect of Reporting
The Act provides severe punitive measures in case of misappropriation or unlicensed disclosure of personal information. The lack of clarity in the definition of what is referred to as personal data is causing a loophole for the government to hide things. According to a 2025 analysis by Frontline, it was seen that such provisions have the effect of locking out public interest information, which would create a chilling effect on investigative practice.
Autonomy of the Data Protection Board
The Data Protection Board of India (DPB), established under the Digital Personal Data Protection Act, 2023, is a central adjudicatory body with limited autonomy due to heavy government control over appointments, tenure, and, according to experts, potential influence. The Digital Personal Data Protection Act (DPDPA) also introduces the Data Protection Board of India as the adjudicating body of centrality. Nevertheless, its autonomy has turned into a constitutional issue.
Structural Autonomy of DPB
Investigation of breaches, imposing penalties, and compliance are intended to serve as a quasi-judicial body by the Board. However, critics complain that this entails that the government interferes with appointments and removals, which undermines the autonomy. The petitioners at the Supreme Court argue that this reliance poses a danger of making the Board seem as an extension of the executive powers instead of an objective regulator.
Checks and Balances of DPB
Independence is vital in a statutory agency that is given the mandate of protecting privacy. Without having a set of structural safeguards in place, all decisions can be politically or bureaucratically controlled, and thus, the proportionality principle, as stated in the Puttaswamy judgment (2017), has to be particularly aware of the autonomy and independence principles by making decisions aimed at limiting fundamental rights.
Conclusion
The constitutional debate over the Digital Personal Data Protection Act 2023 can be heralded by the delicate balance between the privacy of individuals and the upholding of democratic transparency. Re-defining the RTI model, limitations placed on investigative journalism, and fear of the independence of the Data Protection Board are all evidence of the dangers of executive overreach. Supreme Court judicial review will be essential in ensuring that the Act is in line with the constitutional doctrine, and as such, privacy provisions will not compromise the right of the citizens to information, the freedom of the press, or accountability by institutions.