Supreme Court to look into what constitutes ‘personal data’ in DPDP laws

The Supreme Court of India on Thursday (March 12, 2026) agreed to examine what constitutes ‘personal data’ under India’s new digital personal data law, which is being accused of cynically using data privacy to block the right to information.

A three-judge Bench headed by Chief Justice of India Surya Kant said the need to define ‘public data’ and ‘personal data’ has arisen following the implementation of the Digital Personal Data Protection (DPDP) Act, 2023 and its corresponding Digital Personal Data Protection Rules, 2025.

The court issued formal notice to the Union government on a petition jointly filed by journalist Geeta Seshu and the Software Freedom Law Center, represented by senior advocate Indira Jaising and advocate Paras Nath Singh, who said the DPDP laws effectively stall journalists from accessing data of public interest concerning those who hold public offices.

“While enacted under the ostensible objective of protecting personal data, the DPDP laws in effect legalise disproportionate state surveillance, create a compensation vacuum for citizens, dilute the Right to Information, erode the ability of journalists to practice their profession and establish a data protection regulator that is structurally dependent upon the Executive,” the petition said.

For one, the petition said, Section 44(3) of the Act imposes a “blanket ban” on Right to Information (RTI) applications seeking disclosure of ‘personal information’.

Too little, much later: on the Digital Personal Data Protection Rules, 2025

“The term ‘public interest’ has been deleted from the DPDP Act. Journalists cannot access data which is in public interest. A journalist need not have personal data, but needs information which is in the public interest to satisfy the public’s right to information and knowledge. They are the fourth pillar of democracy,” Ms. Jaising submitted.

She said the Act does not clearly define terms like ‘information’ and ‘personal’. On the other hand, the State could mount sweeping surveillance on anyone. The State has exempted itself from the restrictions regarding personal data in the Act. Its prowess to glean personal information from the web has not been curtailed by the data protection law. Besides, the Act gave overbroad and undefined categories, including ‘public order’, under which the State could demand personal data, Ms. Jaising said.

Ms. Jaising also highlighted how the Act allowed compensation for illegally accessing personal data to go directly to the government and not the injured person.

“While the DPDP Act introduces a penalty-centric framework with fines running into hundreds of crores, such penalties are payable exclusively to the Consolidated Fund of India. The data principal whose privacy is violated receives no compensation, restitution or restoration, even in cases involving identity theft, financial fraud, reputational harm or dignitary injury,” the petition said.

The Chief Justice said a balance had to be struck between privacy and the right to information. One right should not compromise the other, the court said.

“At what point should data regarding a respectable person holding public office be treated as public and when should it be seen as personal?” the CJI mused.

The Chief Justice pointed out that an individual’s data privacy has to be protected against sweeping provisions of law.

“Entire personal data of the citizenry from a substantial part of the globe are flowing into bigwig private entities. Data has become the true wealth of the day,” Chief Justice Kant said.

Ms. Jaising responded that the court, by bringing up the issue, had touched upon the subject of ‘data sovereignty’, which involved the protection of sensitive and personal data by the domestic laws of the country in which the information had originated and was stored.

The court asked Ms. Jaising to frame questions of law and scheduled the case for detailed hearing on March 23. The petition would be heard along with a series of others also challenging various provisions of the DPDP Act.