SC asks Centre to respond to petition challenging provisions of 2023 data protection law

The Supreme Court on Thursday issued notice to the Centre on a petition challenging the validity of several provisions of the Digital Personal Data Protection Act, 2023.

A three-judge Bench led by Chief Justice of India Surya Kant agreed to hear the petition filed by Geeta Seshu and asked the Centre to respond to her plea by March 23.

The petitioner sought a direction to the Centre to incorporate and notify a specific and proportionate exemption under the 2023 Act and the Digital Personal Data Protection Rules, 2025, for processing of personal data for journalistic, editorial, investigative and public interest reporting purposes, including protection of journalistic sources.

The Bench ordered tagging Seshu’s petition with other petitions filed by the Reporters’ Collective and journalist Nitin Sethi, RTI activist Venkatesh Nayak and the National Campaign for People’s Right to Information (NCPRI) challenging Section 36 of the DPDP Act read with Rule 23 of the DPDP Rules which empowered the Central Government to call for information from data fiduciaries and intermediaries.

The Supreme Court had on February 16 issued notice to the Centre on these petitions challenging the constitutional validity of several provisions of the Digital Personal Data Protection (DPDP) Act, 2023, and the DPDP Rules, 2025, even as it refused to stay the provisions under challenge.

Noting that the issue was “complex but interesting” and touching upon the “fundamental rights of both sides,” the CJI said “some ironing out of the creases might be needed to strike a balance.”

The Central Government notified the Digital Personal Data Protection (DPDP) Rules, 2025, on November 14, 2025, marking the full operationalisation of the Digital Personal Data Protection Act, 2023.

Alleging that the Digital Personal Data Protection Act, 2023, and the DPDP Rules, 2025, substantially weakened the transparency framework under the Right to Information Act, 2005, by creating a ‘blanket exemption’ for disclosure of personal information, the petitioners contended that the new data regime severely diluted the RTI Act and granted the Centre “sweeping powers” over personal data.

The amendment introduced by Section 44(3) of the DPDP Act to Section 8(1)(j) of the RTI Act removed the earlier balancing test that allowed disclosure of personal information if it was related to public activity or public interest, they said.

“There’s an element of sensitivity...both sides will have arguable points...sometimes the bench is so conscious of such things...” the CJI said.

On behalf of Nayak, advocate Vrinda Grover raised the issue of proportionality, saying “instead of using a chisel, they have used a sledgehammer”.

Advocate Prashant Bhushan, representing the NCPRI, had said the original provision had a balance, as held in the Subhash Chandra Agarwal case even as the Bench pointed out that Agarwal’s case did not directly consider Section 8(1)(j) of the Act.

Senior counsel AM Singhvi had represented The Reporters Collective.

Contending that these provisions authorised unreasonable digital searches and enabled the gathering and storage of personal data without adequate safeguards, the petitioners said it violated Article 21.

Terming Section 36 as vague and arbitrary, they said it also violated Article 14 (right to equality and Article 19 (right to various freedoms including the freedom of speech and expression) as the intrusions were not demonstrably justified in a free and democratic society.

The new regime effectively barred disclosure of personal information altogether, regardless of whether larger public interest justifies such disclosure, the petitioner said, adding it undermined citizens’ right to information and transparency in public administration.

Pointing out that journalists and transparency activists frequently relied on access to personal information in limited, public-interest context to expose wrongdoing, corruption, or conflicts of interest, the petitioners alleged that by eliminating the public interest override, the amended provision tilted the balance decisively in favour of privacy at the cost of accountability.