Author: Arya Purohit
Introduction
India’s governance framework is increasingly transitioning into a digital ecosystem where government services, public records, welfare distribution, and administrative processes rely heavily on the collection and processing of personal data. This shift toward digital governance has improved efficiency, accessibility, and public service delivery while also generating vast amounts of citizen information within governmental systems. As governance becomes more data-driven, an important constitutional question emerges: how should the law balance transparency in public administration with protection of individual privacy?
This debate becomes particularly significant in the context of the Digital Personal Data Protection Act, 2023 and its interaction with the Right to Information framework. On one hand, citizens possess a democratic right to access information and hold public authorities accountable through transparency mechanisms. On the other hand, individuals have a legitimate expectation that their personal information will remain protected from unnecessary disclosure.
In India’s constitutional framework, neither privacy nor transparency enjoys absolute status. The right to privacy forms part of the broader guarantee of life and personal liberty under Article 21, while the right to information has been recognised as flowing from freedom of speech and expression under Article 19(1)(a).
Before proceeding further, it is important to clarify that this discussion does not attempt to evaluate the Digital Personal Data Protection Act, 2023 in its entirety. The Act performs multiple regulatory functions relating to digital personal data governance and raises broader questions extending beyond transparency and access to information.This article examines only those aspects of the framework that interact with the Right to Information regime and influence the balance between informational privacy and democratic transparency.
Also at the same time, it is important to acknowledge the legislative objective behind the Digital Personal Data Protection Act, 2023. The framework was not introduced with the stated purpose of limiting transparency but to establish a dedicated formal regime for protecting personal data in an increasingly digital society. Supporters of the legislation argued that, following constitutional recognition of privacy as a fundamental right, stronger safeguards were necessary to prevent unjustified disclosure and misuse of personal information. From this perspective, the interaction with transparency laws was presented as an effort to align access to information with evolving privacy standards rather than replace public accountability altogether. The real constitutional question therefore is not whether privacy deserves protection, but whether the present balance adequately preserves transparency where public interest requires disclosure.
Understanding the two rights
Privacy refers to an individual’s ability to control access to personal information, make autonomous choices, and maintain dignity without unnecessary interference from the State or other entities. In the digital era, privacy extends beyond physical space and includes protection of personal data generated through online interactions, government databases, and digital services.
The constitutional recognition of privacy in India was firmly established through the landmark judgment of Justice K. S. Puttaswamy (Retd.) v. Union of India (2017). In this case, the Supreme Court unanimously held that the right to privacy is a fundamental right protected under Article 21 of the Constitution as an intrinsic part of life and personal liberty. The judgment acknowledged that privacy includes informational privacy, which refers to an individual’s right to exercise control over the collection, storage, use, and disclosure of personal data.
At the same time, transparency remains a foundational principle of democratic governance. The Right to Information (RTI) regime was introduced to promote openness, strengthen accountability, and enable citizens to scrutinize governmental actions and decision-making. The objective of transparency is not merely public access to records but ensuring responsible governance and reducing arbitrariness in public administration.
What Changed under the DPDP Act?
The Digital Personal Data Protection Act, 2023 (DPDP Act) represents India’s first comprehensive legislation dedicated specifically to regulating the processing of digital personal data. The primary objective of the Act is to create a legal framework that protects individuals’ personal information while allowing data to be processed for legitimate and lawful purposes. It establishes obligations for entities handling data, recognises rights of individuals over their personal information, and seeks to increase accountability in the digital ecosystem.
Under the Act, individuals are granted greater control over how their personal data is collected, stored, used, corrected, and erased. Organisations and public authorities processing such data are expected to follow principles of lawful use and adopt measures to prevent misuse or data breaches.
However, the enactment of the DPDP framework has also generated debate regarding its possible impact on transparency and access to information. One major concern relates to broader protection being extended to personal information, particularly in situations involving disclosure requests under public information mechanisms. Critics argue that if authorities interpret personal data exemptions too broadly, information that was previously accessible in the public interest may become difficult to obtain.
The Conflict: Privacy versus Transparency. The emergence of digital governance has intensified the constitutional tension between privacy and transparency. While both values serve public interest, balancing them has become increasingly complex in an environment where large volumes of personal information are collected, processed, and stored electronically.
One perspective argues that privacy now requires stronger legal protection than ever before. Government departments, public institutions, and private entities routinely handle sensitive personal information including identity details, financial records, health-related data, and digital activity. In such circumstances, unrestricted disclosure may expose individuals to risks such as identity theft, profiling, harassment, surveillance, or misuse of personal data.
At the same time, Access to information enables citizens to evaluate governmental decisions, monitor public expenditure, and ensure that public authorities remain accountable. Excessive protection of information under the label of privacy may reduce institutional openness and create barriers to legitimate public scrutiny. Transparency mechanisms were designed not merely to provide documents but to strengthen trust between citizens and the State.
Therefore, the debate should not be viewed as privacy versus transparency in absolute terms.
A balanced legal approach requires distinguishing genuinely personal information from information whose disclosure serves a larger public interest. Effective governance in the digital era depends upon protecting individual privacy without weakening democratic accountability.
Possible Solutions The legal framework should adopt mechanisms that protect personal data while preserving democratic accountability.
One possible approach is strengthening the principle of public interest override. Information containing personal elements should not automatically become inaccessible if disclosure serves a larger public purpose, such as exposing corruption, ensuring accountability, or protecting public welfare. Public interest should remain an important factor while evaluating requests for information.
Another solution lies in adopting a narrow interpretation of disclosure exemptions. Authorities should avoid treating all personal data as exempt and instead assess whether disclosure would genuinely violate privacy rights. Overbroad interpretations may unnecessarily restrict access to information. Judiciary might also help in interpreting let’s say a nuanced definition of what’s private and what’s personal.
The system may also benefit from independent review mechanisms that allow contested disclosure decisions to be examined by impartial bodies. Such review can reduce arbitrary decision-making and promote consistency.
Legislature and executive should develop clear disclosure guidelines to help public authorities distinguish between sensitive personal information and information that ought to remain publicly accessible.
An additional safeguard could be the development of a clearer distinction between personal information and private information while deciding disclosure requests. Not all information relating to an individual necessarily deserves complete confidentiality. Certain information connected with public functions, official decision-making, or use of public resources may contain personal elements but may not qualify as genuinely private in nature. Authorities should therefore assess whether disclosure would cause a real invasion of privacy rather than rejecting access merely because the information relates to an identifiable person. Such an approach would help prevent excessive secrecy while continuing to protect sensitive personal data.
Another important safeguard is preserving the principle that transparency obligations should not automatically be displaced by data protection concerns. Information that is ordinarily subject to disclosure to Parliament or a State Legislature should not become inaccessible merely because it contains elements of personal data. Data protection laws are intended to prevent misuse of personal information, not to create a blanket shield against public scrutiny. Where information relates to public functions, official accountability, expenditure of public resources, or governmental decision-making, authorities should adopt a harmonised interpretation that respects both privacy protections and transparency commitments.
Another important reform may involve introducing greater precision in exemptions relating to State access to personal data on grounds such as national security and public order. While the State must retain the ability to process and access information for legitimate security objectives, broad and undefined language may create uncertainty regarding the limits of such power. A constitutionally balanced framework should incorporate clearer standards regarding scope, necessity, duration, procedural safeguards, and oversight mechanisms.
Constitutional Analysis The debate surrounding privacy and transparency under the Digital Personal Data Protection Act, 2023 ultimately raises a constitutional question rather than a purely administrative one.
The right to privacy has been recognised as a fundamental right under Article 21 of the Constitution, which guarantees protection of life and personal liberty. Through constitutional interpretation, privacy has come to include informational privacy—the right of individuals to exercise reasonable control over their personal data and prevent unjustified disclosure. Protection of personal information therefore serves broader constitutional goals of dignity, autonomy, and individual freedom.
At the same time, the right to information has been judicially connected with Article 19(1)(a), which guarantees freedom of speech and expression. Access to information enables meaningful public participation, informed decision-making, and governmental accountability. Transparency therefore operates as a constitutional tool for strengthening democracy rather than merely an administrative mechanism.
When these rights appear to conflict, constitutional adjudication generally follows a proportionality and balancing approach. Restrictions on transparency should not exceed what is necessary to protect legitimate privacy interests, and privacy protections should not be interpreted so broadly that they undermine public accountability. This balancing exercise may also require distinguishing personal information from genuinely private information and preserving disclosure where larger public interest justifies access. In this way, constitutional values are harmonised rather than treated as competing absolutes.
Conclusion. The Digital Personal Data Protection Act, 2023 marks an important step in recognising privacy as a significant concern in India’s rapidly expanding digital governance framework. However, the protection of personal data should not unintentionally weaken the principles of transparency and public accountability that support democratic functioning.
The constitutional challenge, therefore, is not to choose one value at the expense of the other but to design institutions and interpret laws in a manner that preserves both. Measures such as public interest review, clearer distinctions between personal and genuinely private information, narrowly interpreted exemptions, and more precise standards for State access to data can contribute to this balance.
Ultimately, privacy and transparency are not competing rights but complementary constitutional values requiring careful institutional balance.
As of now, certain provisions of the Digital Personal Data Protection Act, 2023 and related rules have been challenged before the Supreme Court of India, and the Court has issued notice and is examining the constitutional issues. The matter remains pending; there has not been a final decision on merits yet.
