Module 04 — DPDP × RTI interplay — for both PIOs and citizens

anonymous@undisclosed.example.com (Anonymous) — Fri, 24 Apr 2026 20:07:45 +0000

2026/05/03 12:07	current
Line 1:	Line 1:
	+	{{htmlmetatags>metatag-keywords=(dpdp module 04, dpdp × rti interplay — for both pios and citizens)&metatag-description=(DPDP Act 2023 + Rules 2026 Crash Course — Module 04: DPDP × RTI interplay — for both PIOs and citizens. Apply the right standard at the §8(1)(j) boundary.)}}
	+
	+	====== Module 04 — DPDP × RTI interplay — for both PIOs and citizens ======
	+
	+	{{ :social:auto:dpdp-module-04.png?direct&1200 \|DPDP Act 2023 + Rules 2026 Crash Course Module 04}}
	+
	+	<WRAP center round info 95%>
	+	Goal: Apply the right standard at the §8(1)(j) boundary.
	+	</WRAP>
	+
	+	===== §8(1)(j) of RTI vs DPDP =====
	+
	+	§8(1)(j) RTI exempts personal information unless disclosure is in larger public interest OR the information would have been disclosed to Parliament/Legislature.
	+
	+	DPDP doesn't override RTI but adds a consent factor:
	+	- Living individual + sensitive personal data → DPDP Rule 4: PIO should consider data principal consent
	+	- Deceased/historical data → DPDP largely doesn't apply; pure §8(1)(j) test
	+	- Public-servant 'public activity' → §8(1)(j) doesn't shield (per Karnataka HC 9-Feb-2026)
	+
	+	===== PIO workflow under combined regime =====
	+
	+	For each personal-information RTI:
	+	- Is the data subject a public servant in their public-activity capacity? → §8(1)(j) doesn't apply; disclose.
	+	- Is the data subject deceased? → DPDP doesn't apply; pure §8(1)(j) test.
	+	- Is the data subject a private individual? → §11 third-party notice (RTI) + consider DPDP consent factor.
	+	- Is the request large-public-interest? → §8(2) override applies; disclose with redaction.
	+
	+	===== §7(b) state function + DPDP =====
	+
	+	DPDP §7(b) allows the State to process personal data for benefit/subsidy/license without consent. This means:
	+	- Govt can collect Aadhaar-linked subsidy data without separate consent under DPDP
	+	- But the data can still be requested under RTI as 'records held by public authority'
	+	- Combination: data was lawfully processed under DPDP + can be requested under RTI subject to §8 / §10
	+
	+	===== Citizen actions =====
	+
	+	For citizens whose personal data is held by govt:
	+	- DPDP §11 right to information: ask the Fiduciary what data is held + how processed
	+	- RTI §6(1): ask the public authority for records about you
	+	- These overlap — but DPDP gives you the right to correction + erasure; RTI doesn't.
	+	- For breach by govt: file with DPB under §34
	+
	+	===== Penalties + Data Protection Board =====
	+
	+	Data Protection Board of India (DPB) — 4-7 members appointed by Central Govt, 2-year terms.
	+
	+	Penalties (Schedule):
	+	- Failure to take security safeguards: up to ₹250 crore
	+	- Failure to notify breach: up to ₹200 crore
	+	- Failure to fulfill child-data obligations: up to ₹200 crore
	+	- Other obligations: up to ₹50 crore
	+
	+	DPB appeals → Telecom Disputes Settlement and Appellate Tribunal (TDSAT) → Supreme Court.
	+
	+	===== ✅ Quiz =====
	+
	+	Quiz available from your [[:courses:dpdp:app\|course dashboard]].
	+
	+	===== Next =====
	+
	+	* [[:courses:dpdp:start\|← Course overview]]
	+	* Next: [[:courses:dpdp:final]]
	+
	+	//Last reviewed: 24 April 2026.//
	+
	+	{{tag>course dpdp module-04}}

Right to Information Wiki

Module 04 — DPDP × RTI interplay — for both PIOs and citizens