Personal information exemption

Polity & Governance glossary

Also called: Section 8(1)(j) of the RTI Act · Topic: Transparency, Accountability and e-Governance · NCERT: Beyond NCERT

Meaning

The personal information exemption is the ground in Section 8(1)(j) of the RTI Act, 2005 that lets a public authority refuse to give out information about an identifiable person. Since the DPDP Act, 2023 amended it, the clause covers any "information which relates to personal information" [1].

It matters because the 2023 change made a narrow, balanced exemption into a blanket one. Critics say this weakens social audits and checks on officials. The government says it only protects the right to privacy.

Explanation

The original clause (2005–2025)

  • RTI exemption: a type of information that a public authority does not have to give out, even though disclosure is the general rule.
  • The old s.8(1)(j) allowed personal information to be refused only if:
  • releasing it had no relationship to any public activity or interest; or

  • releasing it would cause an unwarranted invasion of the individual's privacy.

  • Built-in balancing test. Even then, the information officer or appellate authority could release it if the larger public interest justified disclosure.

  • Parliament proviso. "Information which cannot be denied to Parliament or a State Legislature shall not be denied to any person."

The 2023 change

  • DPDP Act, 2023, s.44(3) replaced the clause. It now simply reads: "information which relates to personal information" [1].
  • What was removed:
  • The public-activity test and the unwarranted-invasion test. Any personal information is now exempt.
  • The clause's own larger-public-interest test.

  • On the critics' reading, the Parliament proviso is gone too.

  • What is left: s.8(2).

  • The public-interest override (s.8(2)) lets an authority release exempt information if the public interest in disclosure is greater than the harm to the protected interest.
  • So weighing the public interest is no longer a duty inside the clause. It is now an optional override that an officer may choose to use.

When the change took effect

  • The amendment came into force with the DPDP Rules, 2025, notified on 13–14 November 2025 [2].
  • The Rules give data fiduciaries (bodies that process personal data) an 18-month phased compliance timeline [2].

Limits that still apply

  • 20-year rule (s.8(3)). Clause (j) is not one of the clauses kept out of this rule. So personal information about an event 20 years or more old must be given.
  • s.22. The RTI Act has overriding effect over other laws, including the Official Secrets Act, 1923, wherever they conflict.

In the Constitution and practice

  • Legal home. Section 8(1)(j), RTI Act, 2005, as amended by s.44(3) of the DPDP Act, 2023 [1].
  • Constitutional link. The amendment rests on the right to privacy recognised in Justice K.S. Puttaswamy v. Union of India (2017) [1]. In that case privacy was held to be part of the right to life and personal liberty (Article 21).
  • Who uses it. Public Information Officers and appellate authorities when they refuse a request. The CIC and state information commissions hear appeals.
  • Key case: Girish Ramchandra Deshpande v. CIC (2012, SC).
  • An official's service record, assets and income-tax returns are personal information under s.8(1)(j).
  • A third party gets them only if the larger public interest is shown.

  • This caution later shaped the government's case for the 2023 amendment.

  • Contrast cases:

  • CBSE v. Aditya Bandopadhyay (2011, SC): evaluated answer sheets must be shown to students. The fiduciary exemption is read narrowly.
  • RBI v. Jayantilal N. Mistry (2015, SC): the RBI is not a fiduciary of the banks it regulates, so it must disclose inspection findings.

  • Lesson: courts widened disclosure for exams and banking, but narrowed it for officials' personal records.

  • The government's view (PIB, 2025) [1]:

  • The amendment balances RTI with the right to privacy from Puttaswamy.
  • It puts existing court reasoning into law and avoids conflict between the two Acts.
  • It does not ban disclosure. Personal information must be weighed carefully before release.

  • s.8(2) remains fully in force.

  • The critics' view (NCPRI and others):

  • Social audits (checks by villagers of public-scheme records) need beneficiary lists and MGNREGA muster rolls (attendance and wage records). These contain names, so officials could now refuse them.
  • Officials' assets, educational degrees and service conduct may become harder to check.

Don't confuse with

  • Fiduciary exemption, s.8(1)(e): covers information held in a relationship of trust. It still has its own larger-public-interest test. Clause (j) lost that test in 2023.
  • Public-interest override, s.8(2): this is not an exemption. It is the general rule that can release exempt information, even against the Official Secrets Act, 1923. After 2023 it is the main route to personal information.
  • Copyright exemption, s.9: about third-party copyright (someone other than the State), not about personal privacy.
  • Excluded organisations, s.24 + Second Schedule: s.24 keeps whole bodies (such as IB, R&AW and, since 2011, the CBI) out of the Act. Section 8(1)(j) protects a type of information, whichever body holds it.

Prelims Hooks

  • DPDP Act, 2023, s.44(3) amended RTI s.8(1)(j). It came into force with the DPDP Rules, 2025, notified 13–14 November 2025 [2].
  • After 2023, only (d) commercial confidence and (e) fiduciary relationship still carry their own "larger public interest" test inside s.8(1). Trap: (j) no longer does.
  • The exemptions not covered by the 20-year rule (s.8(3)) are (a), (c) and (i). Clause (j) does lapse after 20 years.
  • Girish Deshpande (2012): service records, assets and IT returns are personal information. Aditya Bandopadhyay (2011): answer sheets can be disclosed. Jayantilal Mistry (2015): the RBI is not a fiduciary of banks.
  • The government links the amendment to Puttaswamy (2017) and says s.8(2) remains fully in force [1].
  • s.9 = third-party copyright, not privacy. Do not mix it up with s.8(1)(j).

Mains Points

  • Privacy vs. transparency after the DPDP Act:
  • Government: s.44(3) only codifies Puttaswamy and court reasoning, and s.8(2) still allows disclosure [1].

  • Critics: a blanket exemption shifts the burden onto the person asking. Social audits, muster rolls and officials' asset details now depend on an officer choosing to use s.8(2).

  • Effect on grassroots accountability: RTI grew out of the MKSS movement's demand for village-level records. Making beneficiary lists refusable hits the tool the poor use most. Weighing the public interest is no longer a duty inside the clause; it is an optional override.

  • Middle path (reform):
  • Restore the public-activity test and the Parliament proviso.
  • Apply Puttaswamy's proportionality test case by case. This means asking whether refusal is needed and is the least harmful way to protect privacy.
  • Strengthen s.4 proactive disclosure (publishing information without being asked) so that scheme data is public by default.

Related concepts

Read more

Sources

  1. 1PIB, "DPDP Act, 2023 Upholds Privacy While Preserving Transparency Under RTI" (2025)pib.gov.in · tier 1
  2. 2PIB, "DPDP Rules, 2025 Notified" (November 2025)pib.gov.in · tier 1