DPDP Act 2023 × RTI Act: Complete Guide — citizen series 2026

The Digital Personal Data Protection Act, 2023 (No. 22 of 2023) received Presidential assent on 11 August 2023 and came into force progressively from that date. While the Act is primarily about data fiduciaries and consent frameworks, its Section 44(3) contains a surgical amendment that every RTI applicant, PIO, and information commissioner must understand: it rewrote the personal-information exemption in the Right to Information Act, 2005.

Until the DPDP amendment, Section 8(1)(j) of the RTI Act had protected information from disclosure if it “relates to personal information the disclosure of which has no relationship to any public activity or interest, or which would cause unwarranted invasion of the privacy of the individual unless the … authority is satisfied that the larger public interest justifies the disclosure.” That language was broad, subjective, and routinely mis-used by PIOs to refuse basic service-delivery information.

The DPDP Act substituted a tighter, rights-language formulation. The result is a narrower exemption — harder for PIOs to invoke mechanically — combined with a clearer public-interest override in Section 8(2).

This is a live and evolving legal area. CIC benches began deciding cases under the new Section 8(1)(j) text from late 2023 onward. The Data Protection Board of India, once constituted under DPDP, will add a parallel redressal channel.

Before DPDP, a common PIO tactic was to refuse any request mentioning a named individual — government employee salaries, contractor tie-ups, beneficiary lists — by invoking S.8(1)(j) without analysis. Courts had to consistently reverse these refusals (see Girish Ramchandra Deshpande v CIC, (2013) 1 SCC 212; Central Board of Secondary Education v Aditya Bandopadhyay, (2011) 8 SCC 497). The new text forces PIOs to apply a narrower, more rigorous test.

If you are an RTI applicant:

• You now have a stronger textual basis to challenge any S.8(1)(j) refusal that does not specifically engage with the public-interest override.
• Personal data of public servants in their official capacity remains disclosable — the DPDP Act did not change that principle.
• You can cite DPDP S.44(3) in your first appeal to highlight the amended text.

If you are a PIO:

• You must apply the amended two-limb test — the old DOPT model reply citing “personal information” without analysis is inadequate.
• Failure to follow the new test can attract S.20 penalty proceedings.

• RTI Act 2005, S.8(1)(j) — as amended by DPDP Act 2023, S.44(3): the personal-information exemption.
• RTI Act 2005, S.8(2) — public-interest override that applies notwithstanding S.8(1)(j).
• DPDP Act 2023, S.44(3) — the amending provision; substitutes the old S.8(1)(j) text.
• RTI Act 2005, S.11 — third-party notice; required before disclosing a third party's personal data.
• RTI Act 2005, S.10 — severability; a PIO must disclose non-exempt portions even if S.8(1)(j) applies to one part.

• 2005 — RTI Act enacted; S.8(1)(j) original text.
• 2013 — Girish Deshpande and Canara Bank v C S Shyam cases establish key precedents.
• 11 Aug 2023 — DPDP Act receives assent; S.44(3) substitutes S.8(1)(j).
• Late 2023–2024 — CIC begins applying new text.
• 2025 — DPDP Rules, 2025 notified; further amendment context added.
• 2026 — Data Protection Board constitution still pending; RTI route remains primary channel.

Use these RTI Wiki tools alongside this series:

• AI RTI Drafter: Draft your RTI →
• First Appeal Builder: Build your appeal →
• PIO Reply Checker: Check a refusal →
• AwaazRTI (voice interface): File by voice →

The amendment to S.8(1)(j) makes the personal-information exemption harder for PIOs to invoke loosely. The new text is narrower and contains a clearer public-interest override. For well-framed RTI applications seeking information about public functions, DPDP has marginally strengthened applicants' position.

No. The DPDP Act is not a ground for refusal under RTI Section 8. A PIO refusing on privacy grounds must cite Section 8(1)(j) of the RTI Act — the amended version. Citing “DPDP Act” as a standalone refusal ground is legally incorrect and challengeable in first appeal.

No. The Data Protection Board under DPDP handles complaints about data fiduciaries — companies, government bodies — who misuse personal data. RTI appeals go to the FAA and then to CIC (for Central PA) or the State Information Commission. The two systems are parallel, not competing.

The official gazette notification is at the Ministry of Law and Justice e-Gazette, and India Code at indiacode.nic.in. The PRS India summary is at prsindia.org.

1. Digital Personal Data Protection Act 2023 (No. 22 of 2023), Ministry of Electronics and Information Technology.
2. Right to Information Act 2005 (No. 22 of 2005), DoPT.
3. Girish Ramchandra Deshpande v Central Information Commission, (2013) 1 SCC 212, Supreme Court of India.
4. Central Board of Secondary Education v Aditya Bandopadhyay, (2011) 8 SCC 497, Supreme Court of India.
5. Canara Bank v C S Shyam, (2018) 11 SCC 426, Supreme Court of India.
6. PRS India, Bill Summary: Digital Personal Data Protection Bill 2023.
7. CIC Annual Report 2022-23, Central Information Commission.

• All 10 RTI exemptions explained
• RTI Act Section 8 full text with commentary
• DPDP Act 2023 — complete citizen guide
• RTI Act 2005 — complete citizen guide
• PIO checklist: Section 8(1)(j)