The RTI Amendment One Year On: Section 8(1)(j) and the DPDP Act

What changed

Since 13 November 2025, s.8(1)(j) of the Right to Information Act, 2005 (the RTI Act) has exempted "information which relates to personal information". The change came from s.44(3) of the Digital Personal Data Protection Act, 2023 (the DPDP Act), one of the few DPDP provisions in force from that date (G.S.R. 843(E)).

The clause it replaced was narrower. It exempted personal information only where disclosure had "no relationship to any public activity or interest" or would cause "unwarranted invasion of the privacy of the individual", and even then the information officer could release it if satisfied that "the larger public interest justifies the disclosure". Those limbs have gone. Information is now exempt simply because it relates to personal information, whether the record is on paper or digital, although the DPDP Act itself covers only digital data (s.3).

What survives

• The public interest override. Section 8(2) was not amended: a public authority may still allow access "if public interest in disclosure outweighs the harm to the protected interests". MeitY's statement to the Lok Sabha of 20 August 2025 relied on it, citing Puttaswamy, and said the amendment "does not restrict the disclosure of personal information".
• Severance. Section 10 still allows release of the non-exempt part of a record.
• The twenty-year rule. Section 8(3) requires information about events at least twenty years old to be provided, subject only to clauses (a), (c) and (i). On its text, clause (j) does not limit it.
• Proactive disclosure. Section 4(1)(b) still requires public authorities to publish a directory of officers and employees, the monthly remuneration of each, and particulars of recipients of concessions, permits or authorisations.
• The Parliament proviso, perhaps. The old clause was followed by a proviso: information that "cannot be denied to the Parliament or a State Legislature shall not be denied to any person". Section 44(3) substitutes clause (j) and says nothing about it, MeitY's statement does not mention it, and government guidance such as the Environment Ministry's RTI note has printed it as part of the personal-information exemption. Whether it fell with the old clause or qualifies all of s.8(1) is unsettled. In our view public authorities should assume it still applies, and requesters should not rely on it alone.

The challenge in the Supreme Court

Petitions by Venkatesh Nayak (W.P.(C) 177/2026), the National Campaign for People's Right to Information (W.P.(C) 212/2026) and the Reporters' Collective Trust (W.P.(C) 211/2026) challenge s.44(3). The Court's record of proceedings of 16 February 2026, before the Chief Justice and Justices Joymalya Bagchi and Vipul M. Pancholi, issues notice returnable on 23 March 2026 and records no interim order.

Reports of that hearing say the Court declined a stay and directed that the matter go before a larger bench. Reports of a hearing on 7 August 2026, before the Chief Justice and Justices Bagchi and V. Mohana, say the Union was given two weeks to respond. We found no primary order after 16 February. Until the Court rules, the amended clause applies.

Who is affected

• Public authorities. Information officers, appellate authorities and the Information Commissions apply the new clause every day. From 13 May 2027 a release of personal data is also processing under the DPDP Act; in our view it rests on s.7(c), a function under law, and the security duty in s.8(5) applies to how it is sent.
• Public sector undertakings. Bodies owned, controlled or substantially financed by government are public authorities (s.2(h)) and receive requests about staff, contractors and customers.
• Businesses whose filings sit with the State. Licence applications, tender bids, inspection reports, employee returns and complaints carry personal data about a company's people and customers. The new clause shields those individuals; commercial confidence still rests on s.8(1)(d). A business is a "third party" (s.2(n)) and is notified under s.11 only for information it supplied and "treated as confidential": the officer must write within five days, the business has ten days to object, and it can appeal under s.19. Trayambic's article on government requests for data covers how to mark filings.
• Businesses that use RTI. Due diligence, tender disputes and litigation often need information about officials or other parties' staff. Expect more refusals.
• People seeking their own records. Trayambic's studies on government bodies and higher education take the view that the exemption protects the person the information is about and should not be used against her own request.

What to do now

1. 1.Public authorities: decide two questions, in writing. Record why the information is personal and, separately, whether s.8(2) justifies release. A refusal that never weighs s.8(2) is the easiest to overturn.
2. 2.Sever before refusing. Mask names and identifiers and release the rest (s.10), and check the twenty-year rule before relying on clause (j).
3. 3.Log refusals under the new clause. If the Court strikes down or reads down s.44(3), you will need to revisit them.
4. 4.PSUs: set one line for staff and vendor data. Keep publishing what s.4(1)(b) requires, and decide in advance which details of officers taking decisions you will release under s.8(2).
5. 5.Businesses filing with authorities: mark what is confidential. Put personal data in separate, marked annexures and diarise the ten-day window to object.
6. 6.Treat RTI material as personal data. A business that receives personal information through RTI uses it as a data fiduciary (the person deciding why and how it is processed). In our view release to one applicant is not publication under a legal obligation, so s.3(c)(ii) does not take it outside the DPDP Act; give it a purpose, a retention period and access controls.
7. 7.Requesters: argue public interest specifically. Explain which public interest under s.8(2) outweighs the privacy harm, and ask for severed copies rather than whole files.
8. 8.Watch the Supreme Court. A ruling could restore a public-interest test inside clause (j) or read the clause down.

Key takeaways

• Since 13 November 2025 RTI s.8(1)(j) exempts 'information which relates to personal information'; the old public-activity, privacy-invasion and larger-public-interest limbs are gone.
• The s.8(2) public-interest override, s.10 severance, the s.8(3) twenty-year rule and s.4(1)(b) proactive disclosure are untouched; whether the Parliament proviso survives is unsettled.
• The Supreme Court's 16 February 2026 record issues notice with no interim order; the reported stay refusal, larger-bench reference and 7 August hearing are not confirmed by any order we found.
• Businesses whose filings sit with public authorities gain protection for their people's data, but get s.11 notice only for information they supplied and treated as confidential.
• In our view personal data a business obtains through RTI stays within the DPDP Act, so it needs a purpose, a retention period and controls.