Introduction
India’s Digital Personal Data Protection Act, 2023 (DPDP Act) was enacted to regulate the processing of personal data and strengthen privacy protections in the digital age. However, the law is now under scrutiny before the Supreme Court after multiple petitions challenged its constitutional validity.
The controversy does not oppose privacy protection itself. Instead, it raises a deeper constitutional question: Can a privacy law restrict transparency, journalism, and public accountability?
This legal battle could shape how India balances privacy rights, freedom of speech, and government power in the digital era.
Background: What is the DPDP Act?
The Digital Personal Data Protection Act, 2023 establishes a legal framework governing the collection, storage, and processing of digital personal data in India. The Act aims to protect citizens' personal information while enabling legitimate data processing by businesses and government authorities.
It also creates an enforcement mechanism through the Data Protection Board of India, which can investigate violations and impose penalties.
The Act operationalizes the constitutional recognition of privacy as a fundamental right under Article 21, following the landmark Justice K.S. Puttaswamy v. Union of India (2017) judgment.
However, critics argue that certain provisions of the Act may unintentionally undermine other constitutional values such as transparency, press freedom, and accountability.
Why Has the DPDP Act Been Challenged?
Several petitions filed before the Supreme Court challenge key provisions of the Act on constitutional grounds. The petitioners include transparency advocates and investigative journalists.
They argue that parts of the law violate Articles 14, 19(1)(a), and 21 of the Constitution by being overly broad and disproportionate.
The main areas of concern include:
1. Privacy vs Transparency: Impact on the RTI Act
One of the central controversies arises from Section 44(3) of the DPDP Act, which amends Section 8(1)(j) of the Right to Information Act, 2005.
Earlier, the RTI Act allowed denial of personal information only after balancing privacy interests with larger public interest.
Critics argue that the amendment broadens the privacy exemption and may make certain information inaccessible even when disclosure is necessary for public accountability.
This raises concerns that the amendment may weaken transparency mechanisms that are essential in a democratic system.
2. Impact on Investigative Journalism
Another major criticism relates to the potential effect on journalistic investigations.
Under the DPDP framework, journalists collecting personal data during investigations could be treated as “data fiduciaries.” This would require them to comply with consent and notice obligations, which may be impractical in investigative reporting.
Petitioners argue that:
The law lacks a clear public-interest journalism exemption
Individuals may demand data erasure, affecting future reporting
Heavy penalties may create a chilling effect on media freedom
These concerns raise questions about the compatibility of the law with freedom of speech and expression under Article 19(1)(a).
3. Government Powers to Access Data
Another provision under challenge is Section 36 of the DPDP Act, which allows the Central Government to require data fiduciaries to provide information.
Critics argue that this power could potentially enable broad digital searches without sufficient safeguards, independent authorization, or meaningful oversight.
The petitions claim this could raise surveillance-related concerns and undermine individual privacy protections.
4. Independence of the Data Protection Board
The Act establishes the Data Protection Board of India to enforce compliance and impose penalties.
However, critics argue that the appointment process may create executive dominance, raising concerns about institutional independence—especially because the government itself is a major collector of personal data.
What Has the Supreme Court Done So Far?
The Supreme Court has issued notice to the Union Government but has not stayed the operation of the law.
The case has been listed for further hearings before a larger bench due to the constitutional significance of the issues involved.
The government is expected to defend the law by arguing that the DPDP framework is necessary to:
Protect digital privacy
Harmonize overlapping laws
Prevent misuse of personal data through transparency mechanisms like RTI
Why This Case Matters
The challenge to the DPDP Act represents a critical moment in India’s evolving digital constitutionalism.
The Supreme Court will likely address three fundamental questions:
How should courts balance privacy and transparency?
Can a privacy law restrict journalism and access to information?
What limits should exist on state access to personal data?
The Court’s decision will have far-reaching implications for data governance, press freedom, and digital rights in India.
Conclusion
The DPDP Act aims to strengthen privacy protections in India’s rapidly expanding digital ecosystem. However, the ongoing constitutional challenge highlights the complexity of balancing privacy with democratic values such as transparency and free speech.
The Supreme Court’s eventual ruling will likely define the future relationship between privacy, accountability, and government power in India’s digital age.