The cost of privacy: India’s DPDP rules risk weakening RTI rights

The future of India’s digital governance hinges upon how judiciously we balance two foundational rights—privacy and access to information. These are not adversaries in a zero-sum game. Instead, they are companion principles of a robust democracy. One safeguards the individual’s dignity; the other equips the citizen with the means to question, participate, and hold power to account. Yet, this delicate equilibrium now stands imperilled.

The cause for concern: Section 44(3) of the Digital Personal Data Protection Act (DPDPA), 2023, which amends Section 8(1)(j) of the Right to Information (RTI) Act. This clause removes the vital safeguard of the “public interest test”, which had long allowed disclosure of personal information when such access served a legitimate democratic purpose.

Experts caution that, in its absence, public authorities may now summarily decline access to information merely by classifying it as “personal”—even when the matter may be related to public spending, official appointments, or the delivery of essential services.

Unsurprisingly, the opposition INDIA bloc has called for the immediate repeal of this clause. At a joint press conference in Delhi, its leaders argued that Section 44(3) effectively dilutes the RTI Act, threatens transparency, and risks normalising opacity. Their concerns echo those of several RTI activists and civil society groups. The fear is not simply that access to information will be curtailed, but that such denials may become a matter of administrative routine.

Relying on Exemptions May Not Safeguard Transparency

Responding to a letter from Congress Member of Parliament Jairam Ramesh, India’s Minister for Electronics and IT, Ashwini Vaishnaw, defended Section 44(3) by citing Section 3 of the Act, which exempts publicly available data and disclosures mandated by law. But legal experts find this line of reasoning wanting.

Their contention is simple yet significant: much of the information deemed “public” becomes accessible only through RTI applications. Procurement records, land acquisition details, and names of beneficiaries under government schemes are rarely disclosed proactively. The RTI mechanism often serves as the sole means through which citizens and journalists uncover such details.

If the framework enabling this access is weakened, as critics suggest, exemptions in Section 3 offer little practical reassurance. The amendment risks becoming a broad instrument of refusal—empowering authorities to circumvent scrutiny by invoking the blanket of privacy, even when no sensitive harm is apparent. Moreover, the absence of a clear definition of “personal data” in context adds to the potential for misuse.

A Time for Reflection and Recalibration

The way forward is not to pit privacy against the right to know but to strike a careful and proportionate balance—one that the RTI Act has successfully maintained for nearly two decades. Earlier expert panels, including the AP Shah and Srikrishna Committees, had underscored this balance, recommending narrowly defined exemptions and protections guided by necessity and demonstrable harm. They never envisioned a framework that could obstruct legitimate public inquiry.

At this juncture, it is also essential to remember that the DPDPA, passed by Parliament in August 2023, is not yet operational. The rules are currently being finalised, and the government is expected to notify them shortly. This interregnum presents policymakers with an opportunity—for reflection and for course correction. Reconsidering Section 44(3) at this stage would, in no way, compromise the core principles of data protection. Rather, it would reaffirm that in a democracy, privacy and transparency must not only coexist—they must cohere.

For a law intended to inspire trust, transparency remains its greatest ally. After all, democracy is best served when rights are not ranked, but reconciled—and when power is not insulated, but made answerable.