Honourable Supreme Court is set to hear the challenge against the constitutionality of DPDPA on May 13 2026.
The Court is hearing five PILs filed in this regard some of which asking for complete scrapping of DPDPA 2023 and DPDPA Rules of November 2025.
FDPPI has requested for intervention to assist the Court to place the views of the practicing professionals while defending DPDPA 2023.
Naavi.org has discussed the issues in detail in the past.
All these articles can be accessed here.
Naavi
When an RTI activist picks up information about a Government Scheme for Journalistic Research or Social Audit, it ay acquire sensitive personal information of a large number of public who have given permission to the Government to use the personal information for a specific purpose.
Releasing the information to the journalist my therefore require an assessment
a) Does the release harm the individuals.
b) If so, is the harm outweighs the probable public good.
c) At the time of release, Probable public good is speculative but the harm is definitive and the PIO will take a decision , that can hurt the data principals, for which he is not equipped with.
After the Puttaswamy judgement this is not permitted under law. Hence the need to modify Section 8(1)(j) was mandatory.
Naavi
For decades, India’s transparency landscape operated on a relatively simple axis: the citizen’s right to know versus the state’s duty to disclose.
That era ended in 2017.
With the landmark Puttaswamy judgment, the Supreme Court elevated privacy to a fundamental right, sparking a high-stakes tension between the Right to Information (RTI) Act and the new Digital Personal Data Protection (DPDP) Act, 2023.
In the ongoing legal challenge before the Supreme Court, the Foundation of Data Protection Professionals in India (FDPPI) has stepped in as a crucial “middle-ground” expert.
Moving beyond the binary narrative of “Government vs. Petitioners,” this body of scholars and technologists argues that the DPDP Act isn’t an attack on transparency, but a necessary recalibration for a digital-first society.
Critics have been quick to label the amendment to Section 8(1)(j) of the RTI Act as a “blanket bar” on the disclosure of personal info.
But a closer look at the FDPPI’s argument suggests a “relocation of decisional responsibility” rather than a shutdown.
The core of the issue is “institutional suitability.
” After Puttaswamy , weighing privacy against transparency requires a complex “proportionality test”—a task for which a mid-level bureaucrat was never equipped.
By moving this decision to higher public authorities under Section 8(2), the law recognizes that balancing two fundamental rights is no longer a routine administrative checkbox .”The unamended Section 8(1)(j) required a Public Information Officer—typically a mid-level administrative functionary… to determine, at first instance, whether disclosure of personal information would cause ‘unwarranted invasion’ of privacy…
After Puttaswamy Juggement, this is constitutional adjudication of the highest order.”
The debate often focuses on the “right to know” about public officials, but it overlooks the “Collateral Third-Party Data Problem.”
When an RTI request targets welfare scheme records, it often inadvertently exposes the sensitive data of thousands of innocent citizens who never consented to being in the spotlight.
FDPPI argues that exposing this data is “constitutionally untenable” under the principle of informational self-determination. These citizens aren’t wrongdoers; they are simply beneficiaries whose data is caught in the crossfire.
The data at risk includes:
One of the most persistent fears is that the DPDP Act will serve as a shield for corrupt officials.
However, the FDPPI’s “interpretive suggestion” draws a sharp line between “personal info” and “functional info.
“The law is designed to protect the private lives of individuals, not the “Governance Contact Information” of public functionaries.
Official identities—names, designations, and work emails—are functional, not personal.
Under Section 3(c)(ii), the DPDP Act does not apply to personal data that is made or required to be made publicly available by the individual themselves or under any other law. Since official identities of public servants are already public via gazettes and appointment orders, they remain disclosable.
Is the DPDP Act a muzzle for the press?
Not necessarily.
While the Act lacks a categorical “journalist” identity exemption, the FDPPI points out that Section 17(2)(b) creates a “purpose-based” framework.
Processing data for “research, archival, and statistical purposes” is permitted, provided it doesn’t lead to a specific decision about the individual. This covers the “research loop” of investigative and data-driven journalism.
Furthermore, the FDPPI notes that journalists remain accountable through existing safeguards: the law of defamation and professional standards of accuracy and fair comment.
“The Intervener respectfully suggests… the development… of a framework for the registration of accredited journalists—including digital journalists, bloggers and online publishers—with conditional permissions for purpose-specific processing.”
The threat of a ₹250 crore penalty has sent shivers through many organizations, but the phrasing of Section 33(1) contains a built-in constraint.
The Data Protection Board can only impose penalties if a breach is “significant.” This term acts as a legal shield, preventing the Board from weaponizing the Act over trivial or technical errors.
Interestingly, despite the headlines, India’s penalty cap is actually more conservative than global benchmarks. For instance, the GDPR allows for fines up to 4% of a company’s global turnover, which can dwarf a fixed ₹250 crore limit.
To ensure fairness, the Board must legally consider these four factors before setting a price tag:
As we look toward full operationalization by May 2027, the DPDP Act provides a “safety valve” in Section 17(5).
This five-year transitional flexibility allows the government to course-correct based on real-world friction.
However, one nuance remains: the controversial deletion of the “proviso” to Section 8(1)(j)—the rule that information shouldn’t be denied to a citizen if it can’t be denied to Parliament.
While the FDPPI defends the privacy recalibration, they notably do not defend the loss of this “informational symmetry” between the electorate and their representatives, suggesting it could be restored without compromising the core privacy framework.
Final Thought: As we move into a future where our digital identities are our primary identities, we cannot afford a transparency regime that doesn’t respect the right to be left alone?
Naavi
The petition of Mr Venkatesh Nayak Vs Union of India (WP-C-177/2026) along with the following writ petitions will come up for hearing on 13th May 2026 at the Honourable Supreme Court.
Additionally IA No.85635/2026 filed on behalf of FDPPI will also be considered. In the last hearing on 23rd March 2026, the Government was asked to file it’s reply to the petitions so that counters could be filed by other parties.
The four petitions together have serious prayers including scrapping of DPDPA and DPDPA Rule and are argued by a battery of well known advocates including the following:
For the Intervention petition of FDPPI, (IA No.85635/2026), following advocates will appear.
The Bench headed by the honourable Chief Justice along with JUSTICE JOYMALYA BAGCHI HON’BLE MR. JUSTICE VIPUL M. PANCHOLI will hear the case.
The prayers in the three petitions filed by Mr Venkatesh Nayak, Reporter’s Guild and Geeta Seshu are as follows:
Venkatesh Nayak Prayers
In light of the facts and circumstances stated hereinabove, it is most humbly prayed that this Hon’ble Court may be pleased to:
Reporter’s Guild Prayers
It is respectfully prayed that this Hon’ble Court may kindly be pleased to:
Prayers of Geeta Seshu
It is prayed that this Hon’ble Court may be pleased:
FDPPI has already filed an initial request for intervention
Naavi’s views on this regard which is in public domain is available here.
Naavi has also provided a list of suggestions to make DPDPA acceptable to all including the petitioners.
In a nutshell Naavi has expressed the view
a) That the objections raised are borne out of mis-reading of the Act and the Rules
b) That the objections raised are not tenable and do not indicate any constitutional crisis.
c) That some clarifications can be issued by the Government to ally the disproportionate fears expressed by the petitioners.
Under no circumstances, we feel that the Act and the Rules should be scrapped.
Naavi has also indicated that DPDPA 2023 does not claim to protect the Privacy Right and only provides a scheme for enforcement of protection of Personal Data along with an administrative penalty. It leaves ITA 2000 and other laws to work along with DPDPA 2023 to provide relief to the data principals. It also leaves the right to enforce the constitutional right to Privacy outside the reliefs granted by DPDPA 2023 (Which is only related to disciplinary action against Data Fiduciaries in tact. Naavi has also indicated that this is the same principle adopted by GDPR also for the EU region.
We await the further developments.
Naavi
