PIO Reply after DPDP: Personal Information, Public Interest and File Noting

Use this guide if you are a PIO drafting a reply that touches personal information of a third party, file noting, or service records, and you are uncertain how the DPDP Act 2023 interacts with Section 8(1)(j) of the RTI Act. PIOs across central ministries, state secretariats and public sector undertakings have started invoking the DPDP Act mechanically, often incorrectly. This guide gives you a defensible decision flow.

• Right to Information Act 2005, Section 8(1)(j): exemption for personal information that has no public-interest connection or whose disclosure would unwarrantedly invade privacy.
• Digital Personal Data Protection Act 2023: enacted 11 August 2023; applies to processing of digital personal data; certain provisions including consent, notice and grievance only become operational on the dates notified by the Central Government. Always verify the current commencement notification.
• DPDP Act 2023, Section 36: Central Government may exempt certain processing for “research, archiving or statistical purposes” and other specified categories.
• DPDP Act 2023, Section 17: exemption from various sections in specified circumstances, including legal duty to disclose under another law.
• Article 19(1)(a) of the Constitution read with KS Puttaswamy v UoI (2017): privacy is a fundamental right but is not absolute, and is balanced with right to information.

The Supreme Court in Subhash Chandra Agarwal v Indian National Congress (2013) and Girish Ramchandra Deshpande v CIC (2013) 1 SCC 212 lays down the public-interest test under Section 8(1)(j) of the RTI Act.

A PIO faced with an RTI touching personal data should follow this six-step decision flow.

1. Identify the data principal. Is the requester asking for their own data, a third party's data, or aggregate data? Self-data is freely disclosable; third-party data triggers Section 8(1)(j) and Section 11.
2. Check whether the data is personal. Service records, joint declarations, performance appraisals and bank account particulars are personal. Office addresses, designations and decisions taken on a file are not personal in the same sense.
3. Apply Section 8(1)(j) test. Two limbs: (a) does it relate to personal information without a public activity / public interest connection; (b) would disclosure cause unwarranted invasion of privacy. Both limbs must be addressed.
4. Check whether DPDP Act provisions are in force. If the relevant DPDP provisions are not yet notified, the PIO cannot use the DPDP Act as a free-standing exemption. The DPDP Act does not override RTI; it co-exists.
5. Apply Section 11 if third-party: written notice to the third party within five days of receipt; ten days for representation; decision within 40 days of receipt of the request.
6. Severability under Section 10: redact the genuinely personal limbs and disclose the rest. Record reasons in the noting.

A defensible PIO reply for a request touching personal information.

File no. [number]/[Year]/[Section]
Office of [Public Authority]

Sub: RTI application no. [number] dated [DD/MM/YYYY] from [Applicant name]

Sir / Madam,

With reference to your application above, please find below the point-wise reply.

Point 1: [Repeat applicant's query]
Reply: [Provide the information that is fully disclosable]

Point 2: [Repeat query that touches third-party personal information]
Reply: The information sought constitutes personal information of a third party. After applying the test in Section 8(1)(j) of the RTI Act, 2005 read with the dictum of Girish Ramchandra Deshpande v CIC, (2013) 1 SCC 212, I record the following reasoning:
(a) The information has [no / limited] connection with public activity or public interest, namely [reason].
(b) Disclosure [would / would not] cause unwarranted invasion of privacy, namely [reason].

[Where third-party notice is necessary]
Notice has been issued to the third party under Section 11(1) on [date]. The third party has [responded / not responded]. After hearing the third party, I have decided that:
[Disclose / Redact / Disclose in part with redactions under Section 10], for the reasons recorded above.

Point 3: [Voluminous or vague query]
Reply: [Apply Section 7(9) re: form, or invite the applicant to inspect under Section 2(j)]

Note on the DPDP Act 2023: I have considered the DPDP Act 2023 to the extent that its provisions are notified and in force as on the date of this reply. The DPDP Act and the RTI Act co-exist, and disclosure mandated by the RTI Act is permissible under the DPDP Act framework where applicable.

You may file a First Appeal under Section 19(1) before [FAA name and address] within 30 days from receipt of this reply.

Yours faithfully,
[Signature]
Public Information Officer
[Office name and address]

• Over-applying DPDP Act. Refusing a routine service-record disclosure on a generic DPDP plea is unsustainable. Identify the specific DPDP provision and confirm its commencement.
• Skipping Section 11 notice. Whenever you intend to disclose third-party data treated as confidential, you must give Section 11 notice. Failure invites penalty.
• No reasoned noting. Section 8(1)(j) demands a public-interest analysis. A two-line “personal info, denied” reply is reversed by FAA / CIC.
• Ignoring Section 10 severability. When part of the document is exempt and part is not, redact and disclose the rest with reasons.
• Treating own-data as third-party. When the applicant asks for their own service record, Section 8(1)(j) does not apply.
• Mixing up DPDP grievance route with RTI. DPDP grievance lies to the Data Protection Board (when constituted); RTI grievance to the FAA and CIC. They are parallel but distinct.

• First Appeal under Section 19(1) lies before the FAA. PIO must defend the reasoning recorded.
• Second Appeal to CIC / SIC under Section 19(3).
• DPDP Act: when fully in force, additional grievance to the Data Protection Board for breach of personal data principles.
• Penalty under Section 20 of the RTI Act: PIO who refuses without reasonable cause may face up to ₹25,000 penalty.

The DPDP Act 2023 contains a clause amending Section 8(1)(j) of the RTI Act, but its commencement is governed by the central notification. The PIO must check the gazette before relying on the amended text.

Only if (a) the relevant DPDP provision is in force on the date of your decision, (b) the request actually triggers it, and © the RTI Act itself does not mandate disclosure. Otherwise the standard Section 8(1)(j) and Section 11 framework applies.

Yes. The Department of Personnel and Training has clarified that file notings on the substantive matter of an RTI request are part of the file and disclosable, subject to Section 8 exemptions on a case-by-case basis.

Apply Section 11(3): the PIO is the decision-maker, not the third party. Record reasons for accepting or rejecting the objection. The third party can file a Section 19(2) appeal.

Section 10 severability allows redaction of complainant identity for safety. Disclose the rest of the file.

A larger public good outweighing the privacy interest of the individual. Anti-corruption, public-money expenditure and accountability of public servants are recognised public-interest grounds.

In writing, by Speed Post AD or by email with read receipt, to the third party at the latest known address, within five days of receipt of the request.

• RTI Act 2005: rti.gov.in
• DPDP Act 2023: meity.gov.in
• Department of Personnel and Training (RTI Cell): dopt.gov.in
• Central Information Commission: cic.gov.in
• Press Information Bureau on DPDP commencement: pib.gov.in

Last reviewed: 9 May 2026.

• AI RTI Drafter for inbound applicants.
• Guide hub
• Section 8(1)(j) decision checklist
• Section 11 third-party notice
• Section 10 severability
• PIO file noting format
• Vague or voluminous RTI applications