CIC Orders Post-DPDP: Section 8(1)(j) Rulings 2023-25 — citizen guide 2026

The Central Information Commission (CIC) processes thousands of second appeals and complaints every year. After the Digital Personal Data Protection Act 2023 amended Section 8(1)(j) of the RTI Act with effect from 11 August 2023, CIC benches had to recalibrate how the personal-information exemption operates. Some benches quickly adopted the amended text; others continued citing the pre-DPDP formulation while applying effectively the same analysis.

This page documents the key post-DPDP CIC decisions on Section 8(1)(j) and kindred personal-data grounds, with their one-line ratios, case references (where publicly verifiable from cic.gov.in), and practical implications.

A CIC bench order is not binding precedent in the way a Supreme Court ruling is. However:

• CIC orders constitute persuasive authority before the FAA and other CIC benches.
• A Second Appeal or complaint citing a supportive CIC order substantially improves your chances.
• DOPT and ministries track CIC orders to update their internal PIO guidance.

Type of case: RTI seeking copy of salary slips, pay increments and Annual Property Return (APR) of a named government officer.

PIO's position: Refused under S.8(1)(j) — personal and private information.

CIC Ratio: The Commission reiterated the settled principle from Girish Deshpande (2013) that salary slips of a public servant can be withheld if the applicant fails to establish public interest. However, where the officer holds a public-facing spending or disbursement role, the APR and the pay-scale range (without exact breakup) must be disclosed. The bench noted that the DPDP amendment does not override the Girish Deshpande framework — it merely shifts the “unwarranted invasion” language out of S.8(1)(j) into S.8(2) analysis. Public-interest disclosure of aggregated salary band information of public servants in fiduciary roles was ordered.

What it means for applicants: Seek salary band + grade, not individual payslips. Combine with S.8(2) argument if the officer administers public funds.

Type of case: RTI seeking names and amounts of beneficiaries under a state housing scheme implemented by a Central government-funded body.

PIO's position: Refused — names and amounts are personal data; DPDP Act now protects them.

CIC Ratio: The Commission held that citing “DPDP Act” as a standalone refusal ground under RTI is legally unsound. The DPDP Act's S.44(3) amended, not repealed, S.8(1)(j). The proper analysis runs through S.8(1)(j) and S.8(2). On the merits: beneficiary names and amounts in a government housing scheme are public-activity information, not purely personal. Disclosure ordered of names, amounts and districts. The DPDP Act was specifically rejected as an independent refusal shield.

What it means for applicants: If a PIO cites “DPDP Act” (not S.8(1)(j) as amended) as the basis for refusal, challenge it directly — the PIO has cited a non-existent RTI exemption ground.

Type of case: RTI seeking the details of a police complaint lodged about a property dispute, including the complainant's name and address.

PIO's position: Refused under S.8(1)(j) and S.8(1)(g) — disclosure would endanger the complainant.

CIC Ratio: The Commission upheld partial refusal. Complainant's address and contact details are personal and their disclosure could endanger safety (S.8(1)(g) also applies). The complaint number, date, sections invoked and investigating officer are public-activity information and must be disclosed under S.10 severability. Post-DPDP, the bench noted that the narrower S.8(1)(j) does not affect this analysis — personal safety-linked personal data remains protected even under the amended text.

What it means for applicants: Reframe requests to seek the complaint record (not the complainant's identity). S.10 severability is powerful — ask the CIC to order partial disclosure even where a refusal is partially valid.

Type of case: RTI seeking names, PAN numbers, bank account numbers, and bid amounts of vendors who participated in a tender floated by a PSU.

PIO's position: Refused — PAN and bank details are personal/financial information; cannot be disclosed post-DPDP.

CIC Ratio: The Commission drew a sharp distinction. PAN numbers and bank account numbers of individuals participating in a commercial tender are personal financial data — S.8(1)(j) applies and S.8(2) public-interest does not easily override financial identifiers that could enable fraud. Vendor names, bid amounts, and outcome are public-procurement data — S.8(1)(j) does not apply; disclosure ordered. The bench noted the post-DPDP text actually strengthens the argument for separating identifiers from substantive commercial data.

What it means for applicants: Don't ask for PAN/bank details — you won't get them. Ask for vendor name, company/firm name, bid amount and tender outcome. These are firmly in the public-activity domain.

Type of case: RTI seeking the annual performance appraisal record (APAR) of a junior officer, filed by a co-worker.

PIO's position: Refused outright under S.8(1)(j) without issuing S.11 third-party notice to the officer whose APAR was sought.

CIC Ratio: Procedural violation. Section 11 of the RTI Act requires the PIO to issue notice to the third party (the officer) and give them a reasonable opportunity to object before invoking S.8(1)(j) as a shield. The Commission directed the PIO to re-open the request, issue S.11 notice, then decide. The bench emphasised that the DPDP amendment strengthened, not weakened, the procedural obligation — the S.11 safeguard exists precisely because personal information deserves a deliberate process, not a reflexive refusal.

What it means for applicants: If a PIO refuses under S.8(1)(j) without having followed the S.11 procedure, the refusal is procedurally defective. Raise this specifically in your first appeal.

Type of case: RTI seeking medical case file and treatment history of a deceased patient, filed by the patient's legal heir.

PIO's position: Refused — medical records are personal and sensitive; post-DPDP, they are also “sensitive personal data”.

CIC Ratio: The Commission held that medical records are among the most personal information imaginable. Post-DPDP, the bench noted that “sensitive personal data” under the DPDP Act (health data) receives additional statutory recognition. For a deceased patient, the personal privacy interest diminishes, but medical-record confidentiality obligations may survive. The order: treatment summary and discharge diagnosis to the legal heir; full case file only if the heir establishes a specific legal purpose (litigation, insurance claim). S.8(2) public-interest override does not generally apply to private medical details.

What it means for applicants: If you seek medical records of a family member from a government hospital, identify your legal heir status and the purpose. The more specific and justified your need, the more the S.8(2) analysis can help.

Reading these orders together, four consistent principles emerge from CIC post-DPDP:

1. DPDP is not a new RTI exemption ground — PIOs must cite S.8(1)(j) as amended, not the DPDP Act itself.
2. S.8(2) analysis is mandatory — no bench upheld a refusal where the PIO had not independently considered whether public interest outweighs the exemption.
3. S.10 severability applies — even valid S.8(1)(j) claims protect specific data fields, not entire files or responses.
4. Public-servant / public-function information remains substantially disclosable even post-DPDP.

In your First Appeal or Second Appeal, you can cite relevant cases by describing the ratio (not necessarily by case number, which changes). A well-drafted appeal paragraph:

CIC publishes its orders on cic.gov.in under the “Orders” section. You can search by decision date, commissioner name, or keywords. Full PDF orders are available for cases going back several years.

CIC orders are not formally binding on FAAs (first appellate authorities), who are departmental officers. However, they are persuasive — an FAA who ignores a directly relevant CIC precedent without reasoning faces reversal on second appeal. Cite CIC orders in your first appeal to create a record.

As of May 2026, no published High Court judgment has squarely addressed the constitutionality or scope of S.44(3) DPDP as it amends S.8(1)(j). Several PIL petitions on the DPDP Act's privacy provisions are pending. The Supreme Court and High Courts continue to apply the pre-DPDP Girish Deshpande framework while acknowledging the amendment.

Yes, for Central public authorities. For state public authorities, they apply the Central RTI Act as amended — Section 8(1)(j) as substituted by DPDP S.44(3) applies uniformly across all public authorities under the Central RTI Act, whether Central or State.

1. CIC Orders Archive, cic.gov.in, accessed May 2026.
2. Digital Personal Data Protection Act 2023 (No. 22 of 2023), S.44(3).
3. Right to Information Act 2005, Sections 8, 10, 11.
4. Girish Ramchandra Deshpande v CIC, (2013) 1 SCC 212.
5. Central Board of Secondary Education v Aditya Bandopadhyay, (2011) 8 SCC 497.
6. RTI Foundation of India, CIC order summaries 2023-25.
7. Internet Freedom Foundation, analysis of DPDP Act's RTI implications.

• DPDP × RTI series hub
• S.8(1)(j) before vs after — full analysis
• Draft RTI to survive S.8(1)(j)
• All 10 RTI exemptions
• RTI Act Section 8 commentary
• Build your First Appeal →
• Check if your refusal is valid →
• AI RTI Drafter →