SECTION 44(3) OF THE DPDP ACT, 2023: THE QUIET REWRITING OF THE RIGHT TO INFORMATION

I. Introduction

The Digital Personal Data Protection Rules, 2025, were notified by the Ministry of Electronics and Information Technology on 14 November 2025, which has brought into force various provisions of the Digital Personal Data Protection Act, 2023[1]. A lot of the commentary since has been on the basic architecture of the statute   consent managers, the obligations of data fiduciaries, the Data Protection Board of India, and penalties to ₹250 crore[2]. A shorter provision which is buried in the last sections of the statute has received far less attention. Section 44(3) of the DPDP Act.

Section 44(3) makes no mention of data fiduciaries or breach notification. It identifies an entirely different statute – the Right to Information Act, 2005[3] (“RTI Act”) – and replaces the text of Section 8(1)(j), the exemption clause that has governed the withholding and disclosure of personal information under the RTI Act for two decades[4]. Because until this amendment, section 8(1)(j) was among the most frequently invoked exemptions in RTI adjudication, this is not a peripheral tweak. The relationship between the citizen’s right to know and the individual’s right to privacy has received a substantial rewriting due to the new data protection statute. Indian courts spent almost a decade calibrating this balance through case law. Parliament has now opted to re-calibrate through data protection law rather than direct amendment of the RTI Act.

The effective notification of the DPDP Rules in November 2025 is what made the operative effect of Section 44(3), which means that its live legal impact on RTI applicants, Public Information Officers (“PIOs”), and Information Commissions is barely few months old. This makes it a genuinely contemporary and under-examined development sitting at the intersection of technology law and constitutional law, warranting close scrutiny before its consequences fully surface in litigation.

II. Legal Analysis

• The Pre-Amendment Section 8(1)(j): A Calibrated Exemption

Before the amendment of the RTI Act, section 8(1)(j) exempted from disclosure, information having no relationship to any public activity or interest or of such nature which would cause unwarranted invasion of the privacy of the individual.  This clause had two types of safeguards.  The first one was a condition that allowed for disclosure if the “larger public interest” justified it. The second one was in the form of a rule which provided that if the information is not denied to Parliament, then the information cannot be denied to a citizen either. The clause contained a provision for proportionality. Resultantly, it mandated the PIO to weigh the privacy interest against the public interest in disclosure. This has to be a conscious assessment and not a blanket bar. This means that a record cannot be barred in or under the term ‘personal detail’ to disclosure as a matter of rule. A harmonious body of law emerged from the judiciary, which directed that asset declarations of public servants, records of official conduct disciplinary action and welfare-scheme beneficiary data shall be routinely disclosed as they relate to public activity, even if named persons are identifiable.

• A blanket substitution in post amendment clause

Clause 44(3) simply states “which relates to personal information” shall be considered exempt. The clause excludes any of the conditions in its qualifying standard there is no “relationship to public activity” qualifier; there is no express “larger public interest” clause; there is no Parliament-equivalence standard. What remains is a bare exemption tied solely to whether information can be labelled “personal.” This has three real effects.

To Start With A Definition The RTI Act itself never defined ‘personal information’ and hence PIOs and Commissions develop contextual meaning through adjudication. The DPDP Act describes “personal data” broadly to mean any data about an identifiable individual by or in relation to such data.

 Because section 44(3) incorporates the DPDP-style reasoning into the RTI exemption, without the concomitant countervailing carve out from the DPDP statute, it creates a perverse incentive for PIOs to treat ever-increasing categories of records as ‘personal’ and thereby swept with the exemption.

Second, erosion of public interest override. The public-interest override applies to all exceptions under Section 8(1) of the RTI Act, which has not been disturbed. Although it may be legally correct, it does not offer practical comfort. Section 8(2) requires an affirmative finding that public interest outweighs harm to protected interests, which is a comparatively demanding threshold that cannot be invoked without specific prompting. The prior Section 8(1)(j) incorporated the balancing exercise directly into the exemption. Deleting the internal clause does not abolish the statutory override. However, it will take away the structural incentive that encouraged PIOs to regularly conduct the balancing test in precisely the category of case where it mattered the most.

Third, an asymmetric penalty incentive. Under the DPDP Act, public authorities will also be classified as fiduciaries and will be liable for penalties of ₹250 crore for security failures and ₹200 crore for certain violations[5]. A Public Information Officer (PIO) places a value on revealing borderline personal information under the Right to Information Act (RTI). The PIO does so in the shadow of a punitive statute. This law treats the very authority that employs the PIO, a fiduciary. Moreover, this creates a situation of legal jeopardy which will not just not stop with the PIO but also impact the institution itself. Sharing information wrongfully has a risk of, at most, some disciplinary action under Section 20 of the RTI Act. However, mishandling “personal data” will attract organisational fines in crores under the DPDP Act.  As a result of rational bureaucratic incentive bias, denial has become the default. This creates a chilling effect and has special relevance for constituencies relying on the RTI to expose leakages in welfare disbursement. An example would be the beneficiaries of employment guarantee schemes.

• Why Is This Also a Question of Constitution?

According to Supreme Court, the RTI Act implements the freedom of speech and expression. This right is under Article 19(1)(a) of Constitution. Moreover, it lists right to know as an integral facet of the fundamental right[6]. In Justice K.S. Puttaswamy v. Union of India, the courts recognized the right to privacy as being inherent to Article 21. The recalibration of the intersection of these two rights through section 44(3) raises a live question whether Parliament may, by law, alter the Constitutionally determined balance between two Part III rights through a law whose primary object – data protection – is not the law that it amends. This question is likely to be tested in constitutional courts in the coming years, independent of its administrative-law consequences for individual RTI applicants.

III. Supporting Authority

Numerous sources of authority directly impact how an amendment is likely to be assessed. The case of Justice K.S. Puttaswamy v. Union of India[7]  established that an individual’s right to privacy is a fundamental right under Article 21. However, it also stated that any restriction on other rights which is justified on the basis of privacy shall be subjected to a proportionality standard. This standard shall involve legality, necessity, proportionality and procedural safeguards. According to government framing of the amendment, Puttaswamy is the justification; critics assert that the amendment fails the proportionality test that Puttaswamy prescribes since it removes rather than calibrates the balancing mechanism.

Girish Ramchandra Deshpande v. Central Information Commissioner[8] ruling states that personal service information, disciplinary record, assets and performance are exempt from RTI disclosure unless there is greater public interest.  This holding worked with an old proviso-based framework and public-interest test as an operative filter. The removal of that textual proviso arguably strips the very hook on which this precedent relied. It creates uncertainty whether its reasoning survives, even where its result non-disclosure is achieved now through categorical exclusion rather than case-by-case balancing.

Central Board of Secondary Education v. Aditya Bandopadhyay[9] later, Central Public Information Officer, Supreme Court of India v. Subhash Chandra Agarwal[10] would harmonize the RTI Act’s transparency mandate with individual privacy by holding that disclosures should take place on a case-to-case proportionality assessment, rather than a categorical exclusion. This reasoning is in tension with a statutory provision that now effectively locks in a no-go decision at the threshold stage for an entire category of information.

The Report of the Group of Experts on Privacy chaired by Justice A.P. Shah[11], also recommended that future privacy legislation should not dilute the RTI disclosure. Moreover, information which is disclosable under the RTI Act should not be treated as a violation of privacy. Section 44(3) directly contradicts this long-standing suggestion. This reflects a shift away from India’s own historical expert position, which sought to balance privacy and transparency legislation. The amendment is framed by the DPDP Rules, 2025 and the explanatory note issued by the PIB, as being consistent with Puttaswamy[12]; this official framing is likely to anchor any governmental defence of the provision if challenged, while petitioners are likely to rely on the Aditya Bandopadhyay–Subhash Chandra Agarwal line to argue that proportionality, not blanket exclusion, is the constitutionally mandated method of reconciliation.

IV. Conclusion and Future Outlook

Section 44(3) of the DPDP Act illustrates a broader legislative technique of some concern: substantive amendment of a rights-protective statute achieved not through direct amendment debated on its own terms, but through a “consequential” clause within an unrelated data-protection law. Because the DPDP Rules, 2025 only brought this provision into operative effect in November 2025, its real-world consequences — increased RTI rejections, Information Commission orders interpreting the new clause, and eventual writ petitions — are only beginning to accumulate. Early commentary and CPIO practice already suggest a discernible shift toward reflexive denial of requests touching identifiable individuals, from welfare-beneficiary data to the disciplinary records of public officials.

Two trajectories appear likely. First, Information Commissions may attempt interpretive harmonisation, reading Section 8(2)’s general public-interest override robustly into personal-information cases so as to restore something resembling the pre-amendment balance, even absent an explicit proviso in clause (j) itself. Second, and more consequentially, the amendment is likely to face direct constitutional challenge on proportionality grounds, given its apparent tension with Puttaswamy, and the Subhash Chandra Agarwal line of RTI-privacy cases, as well as with the A.P. Shah Committee’s foundational recommendation that data protection law must not become a vehicle for diluting transparency. Until Parliament restores an explicit balancing proviso to Section 8(1)(j), or the judiciary reads one back in through Section 8(2), Section 44(3) will remain what it currently is: a structurally significant retreat from two decades of RTI jurisprudence, achieved through the back door of a data protection statute rather than the front door of RTI reform.

V. References

[1] Digital Personal Data Protection Rules, 2025, notified by Ministry of Electronics and Information Technology, Government of India (Nov. 14, 2025).

[2] Digital Personal Data Protection Act, 2023, No. 22 of 2023, §§ 33, 34, Schedule (India).

[3] Right to Information Act, 2005, No. 22 of 2005 (India).

[4] Right to Information Act, 2005, No. 22 of 2005, § 8(1)(j) (India) (as it stood prior to amendment by the Digital Personal Data Protection Act, 2023, § 44(3)).

[5] Digital Personal Data Protection Act, 2023, No. 22 of 2023, Schedule (India).

[6] See CBSE v. Aditya Bandopadhyay, (2011) 8 S.C.C. 497 (India); INDIA CONST. art. 19, cl. 1(a).

[7] Justice K.S. Puttaswamy v. Union of India, (2017) 10 S.C.C. 1 (India).

[8] Girish Ramchandra Deshpande v. Cent. Info. Comm’r, (2013) 1 S.C.C. 212 (India).

[9] CBSE v. Aditya Bandopadhyay, (2011) 8 S.C.C. 497 (India).

[10] CPIO, Supreme Court of India v. Subhash Chandra Agarwal, (2020) 5 S.C.C. 481 (India).

[11] Group of Experts on Privacy, Report of the Group of Experts on Privacy, Planning Commission, Government of India (Justice A.P. Shah, Chair) (2012).

[12] Press Information Bureau, Ministry of Electronics & Information Technology, Government of India, Digital Personal Data Protection Rules, 2025 Notified (Nov. 17, 2025).