Constitutionality of the Digital Personal Data Protection Act, 2023

Case Description

On 7 August 2023, The Digital Data Protection (DPDP) Bill was passed in the Lok Sabha. Subsequently, the Bill was passed in the Rajya Sabha and received the President’s assent. The Bill was enacted on 11 August 2023.The Act brought about several provisions to regulate and penalise unauthorised use of personal data by companies and big firms.

On 2 February 2026, Venkatesh Nayak, an RTI activist filed a writ petition under Article 32 of the Constitution, challenging Sections 17(1)(c), 17(2), 33(1), 36 and 44(3) of the DPDP Act 2023 and Rules 17 and 23(2) of the Digital Personal Data Protection Rules, 2025 (DPDP Rules). The petition argues that the provisions violate Article 14, 19(1)(a) and 21 of the Constitution. Two other petitions—by Nitin Sethi and The Reporters Collective–were filed subsequently.

Section 44(3) of the DPDP Act amended Section 8(1)(j) of the Right to Information Act, 2005 which exempts the disclosure of any information “which relates to personal information”. The petitioners claim that this amendment creates a “blanket ban on the obligation to disclose personal information”. This will allow the executive to deny information to citizens by citing the “personal nature of the information”. Petitioners argue that this will violate the right to information and the right to know, which is traced to Article 19(1)(a)—the fundamental right to speech and expression. Previously, the Supreme Court in CPIO, Supreme Court v Subhash Aggarwal (2019) had held that there is no bar under the RTI Act on disclosure of personal information, given that the information does not cause invasion of privacy and has a reasonable nexus with public activity and public interest.

Petitioners have also challenged Section 17(1)(c), which allows the processing of data in the “interest of prevention, detection, investigation or prosecution of any offence or contravention of any law for the time being in force in India”. Section 17(2) states that the Act will not be applicable when data is processed by the Union government, or any authority it may notify, in the “interests of sovereignty and integrity of India, security of the State, friendly relations with foreign States, maintenance of public order or preventing incitement to any cognizable offence relating to any of these”. The petitioners are apprehensive that the provisions will result in a “surveillance regime”, with no safeguards or review mechanism. This, according to them, is manifestly arbitrary and violates Article 14.

Section 36 of the law also states that any intermediary or data fiduciary should furnish information which is required by the Union government. This, the petitioners claim, allows the Union to call information without any “statutory guidance”. Further, Rule 23(2) compels the fiduciary or intermediary to not disclose to the data principal that such information was furnished to the Union government if it is likely to “affect the sovereignty and integrity of India or security of the State”.

Section 18 of the DPDP Act calls for the establishment of a Data Protection Board of India. Rules 17(1) and 17(2) of the DPDP Rules provide for a search cum selection committee for the appointment of the Chairperson and other members of the Board. Petitioners claim that the “executive dominance” in the formation of the Committee violates the doctrine of the separation of powers.

Lastly, Section 33(1) imposes penalties for “significant” data breaches. The petitioners claim that the wording of the provision is vague as there is no statutory guidance to determine what constitutes a “significant” breach. .

On 16 February 2026, the Bench of Chief Justice Surya Kant and Justices Joymalya Bagchi and V.M. Pancholi heard the matter and issued notice to parties. The Bench refused to grant an interim stay on the DPDP Act. Further, the Court referred the matter to a larger bench to be heard in March 2026.

The matter will be heard next on 23 March 2026.