The Digital Personal Data Protection Act, 2023 protects privacy at the cost of transparency.

Q. The Digital Personal Data Protection Act, 2023 protects privacy at the cost of transparency. (15 marks, 250-350 words)

The DPDP Act, 2023 is India's first dedicated data protection law, giving statutory form to the privacy right recognised in K.S. Puttaswamy (2017) under Article 21. Its Section 44(3), which rewrote Section 8(1)(j) of the RTI Act, 2005 [1], has however revived the transparency-versus-privacy debate — a trade-off that is real in design but not irreversible.

Where the criticism holds - Loss of the public-interest override: the amended Section 8(1)(j) no longer carries the explicit test allowing disclosure where public interest outweighs privacy harm, narrowing an activist's strongest RTI argument [1]. - Shielding of power-holders: information on public servants' assets, appointments and beneficiary lists can now be refused as "personal information", weakening Article 19(1)(a)'s right to receive information. - Definitional vacuum: the Act nowhere distinguishes "personal data" from "public data" [1]; the Supreme Court agreed in March 2026 to examine exactly this, on a petition by journalists and the Software Freedom Law Center [6]. - Regulatory design: the Data Protection Board of India is constituted by the Central Government [1] — unlike SEBI or TRAI, it lacks structural insulation, limiting its ability to check state processing.

Where the claim overstates - The Government holds that the amendment does not bar disclosure but requires personal data to be assessed with care, and that Section 8(2) of the RTI Act — permitting disclosure on public-interest grounds — remains fully operative [2]. - The DPDP Rules, 2025, notified on 14 November 2025, centre the citizen through consent, notice and grievance rights, curbing unauthorised commercial data use [3]. - A 18-month phased compliance window [4] and a consultation drawing 6,915 public inputs [5] show a calibrated, participative rollout rather than a transparency rollback.

Thus the Act protects privacy at a cost to transparency rather than at the cost of it. Restoring an express public-interest proviso, statutorily defining "public data", and strengthening the Board's independence would let both rights — twin facets of dignified citizenship — advance together, consistent with the Puttaswamy proportionality standard.

(~325 words)

Sources: 1. The Digital Personal Data Protection Act, 2023 (No. 22 of 2023) — full text, PRS Legislative Research — Section 44(3) amending RTI Section 8(1)(j); absence of a "public data" definition; constitution of the Data Protection Board 2. DPDP Act, 2023 Upholds Privacy While Preserving Transparency Under RTI — PIB — Government's position that disclosure is not barred and RTI Section 8(2) remains operative 3. Government notifies DPDP Rules to empower citizens and protect privacy — PIB — notification on 14 November 2025; citizen-centric rights and curbs on unauthorised data use 4. DPDP Rules, 2025 Notified — PIB — phased 18-month compliance window 5. Draft DPDP Rules, 2025 Receive 6,915 Inputs from Citizens and Stakeholders — PIB — scale of public consultation 6. "SC to study what constitutes 'personal data' in DPDP laws" — The Hindu, 13 March 2026 (news report) — Supreme Court notice to the Union on the personal-data vs public-data question