The Supreme Court today issued notice in a petition challenging the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, observing that protection of data privacy has now become a global issue. The Court will also examine the critical question of what constitutes public data and private data.
A bench comprising Chief Justice of India Surya Kant, Justice Joymalya Bagchi and Justice Vipul Pancholi was hearing the writ petition filed by journalist Geeta Seshu and the NGO Software Freedom Law Centre. The plea tags with three other pending petitions filed by Venkatesh Nayak, The Reporters Collective and journalist Nitin Sethi, and the National Campaign for People’s Right to Information (NCPRI).
Senior Advocate Indira Jaisingh, appearing for the petitioners, submitted that the impugned Act and Rules in effect legalise disproportionate State surveillance, create a compensation vacuum for citizens, dilute the Right to Information, erode the ability of journalists to practise their profession, and establish a Data Protection Board that is structurally dependent upon the Executive.
Jaisingh pointed out that the DPDP Act amended the RTI Act by omitting the “public interest” ground to disclose personal data of a public servant. Thus, the personal data of a public servant has been totally exempted from disclosure. As a result, if a journalist is writing about a public servant, they would not be able to have access to data relating to the officer.
At this juncture, the Chief Justice of India remarked that this issue also raises an “interesting question that we will have to determine, that is, what is public data and what is personal data?”
Jaisingh explained that under the RTI Act, an exception was carved out where information of “public interest” could have been accessed; this aspect is not there in the impugned Act. She added, “That’s what is causing the trouble; otherwise, there would have been no other problem.”
She further submitted that the Act gives powers to the Centre to acquire data on anything on the ground of “public order”, a term that has a wide and broad interpretation.
The CJI weighed in, stating that sweeping provisions in the Act raise concerns for individuals’ right to privacy. He observed:
“If there are sweeping provisions in the Act and where right to privacy and this conflict comes, then how do we protect some individuals? What can be the measures that can be taken without affecting the right to privacy?”
Referring to the pending case of Meta Platforms Inc v. CCI, the CJI remarked that data privacy has now become a global issue. He added, “data is becoming the real true wealth as of date.”
Jaisingh also highlighted that the Act repeals and omits Section 43A of the Information Technology Act, 2000. The impugned Act fails to provide any equivalent or effective civil remedy to individuals whose personal data is unlawfully processed or breached. Under the new regime, any compensation, if awarded, goes to the Data Protection Board and not to the affected individual.
The bench issued notice and tagged the petition with the other pending matters. Earlier, while hearing similar pleas, the CJI had orally observed that there were “some creases which required to be ironed out.”
The present plea specifically challenges Sections 7, 17(2)(a), 19(3), 24, 36, 44(2)(a) and 44(3) of the DPDP Act, 2023 and several provisions of the DPDP Rules, 2025, including Rules 5, 6, 17, 18, 21 and 23 and the Second, Fifth, Sixth and Seventh Schedules. It also seeks to strike down the exemption granted to Central Government instrumentalities under Section 17(2) and the dilution of the Right to Information under Section 44(3).
The petitioners have prayed for a direction to the Union to frame a constitutionally compliant mechanism for the appointment, tenure and service conditions of the Data Protection Board to ensure its independence from executive control. They have also sought a specific exemption for journalistic, editorial, investigative and public interest reporting purposes.
The matter has been tagged with the other writ petitions raising identical challenges to Section 44(3) of the DPDP Act which amended Section 8(1)(j) of the RTI Act, granting a blanket exemption to disclosure of personal information without the earlier overriding public interest test.
Case Title: GEETA SESHU AND ANR. Versus UNION OF INDIA AND ORS. | W.P.(C) No. 275/2026
Click HERE to access the order
Lawcutor 