Privacy or Power? Executive Control under the Digital Personal Data Protection Act 2023

Authored By: P V Visruth

Samrat Vikramaditya University

I. Introduction

In February 2026, the Supreme Court of India admitted three writ petitions challenging the constitutional validity of the Digital Personal Data Protection Act, 2023 (DPDP Act), and referred the matter to a larger bench, acknowledging that the case raises complex questions concerning the relationship between privacy and transparency.

The DPDP Act was enacted as India’s first comprehensive data protection legislation, following the Supreme Court’s recognition of privacy as a fundamental right in Justice K.S. Puttaswamy v. Union of India. It is submitted that the Act does more than regulate personal data held by private and public entities. This article argues that certain provisions of the Act, namely Sections 17, 36, and 44(3), and Rule 5 of the Digital Personal Data Protection Rules, 2025 (DPDP Rules), collectively expand executive discretion over information, reduce institutional transparency, and weaken checks upon the State.

While the Act seeks to protect informational privacy, certain provisions simultaneously expand executive authority over information. This raises an important constitutional question concerning the relationship between privacy, transparency, and democratic accountability. The discussion proceeds by examining privacy as a constitutional right, the tension between privacy and transparency under § 44(3), the cumulative expansion of executive control under § 17 and 36 and Rule 5, and a constitutional assessment grounded in the proportionality standard.

II. Privacy as a Constitutional Right

The constitutional foundation of the DPDP Act lies in Puttaswamy, where a nine-judge bench unanimously held that the right to privacy is intrinsic to the right to life and personal liberty guaranteed under Article 21 of the Constitution. The Court held that informational privacy, understood as an individual’s ability to control the dissemination of personal information, forms a core facet of this right.

Crucially, the Court also held that privacy is not an absolute right and may be restricted by a law that satisfies the three-fold requirement of legality, legitimate State aim, and proportionality. This proportionality standard was subsequently developed in Modern Dental College & Research Centre v. State of Madhya Pradesh, which formulated a structured four-stage test for assessing restrictions upon fundamental rights.⁵ It is submitted that any provision of the DPDP Act that confers executive discretion over personal information must be tested against this constitutional standard, rather than assessed merely as a matter of statutory policy.

III. Privacy versus Transparency

44(3) of the DPDP Act amends § 8(1)(j) of the Right to Information Act, 2005, and constitutes the most consequential erosion of transparency introduced by the Act. Prior to the amendment, § 8(1)(j) permitted a public authority to withhold personal information only where disclosure bore no relationship to public activity or would cause an unwarranted invasion of privacy, and even then, disclosure remained mandatory where a larger public interest justified it. The amended provision removes the public interest overrides altogether and exempts all “personal information” from disclosure as a matter of course. It is submitted that this is not a mere procedural adjustment. The Supreme Court had earlier held, in CPIO, Supreme Court of India v. Subhash Chandra Agarwal that personal information relating to public officials could be disclosed where a reasonable nexus existed with public activity and interest outweighed the invasion of privacy. § 44(3) foreclose this judicially evolved balancing exercise by treating the personal character of information as dispositive, regardless of its relevance to public accountability. Petitioners before the Supreme Court have argued that the amendment converts a calibrated privacy exemption into absolute bar, thereby enabling authorities to withhold information concerning asset declarations, welfare disbursement records, and allegations of official misconduct. This article argues that the effect of Section 44(3) is asymmetric. It does not merely protect the informational privacy of ordinary citizens; it also insulates the conduct of public officials from scrutiny, since information about a public functionary’s exercise of public duty is itself “personal information” under the wide definition in Section 2 of the DPDP Act. The RTI Act was designed to enable citizens to hold public institutions accountable, and it is submitted that removing the public interest test undermines the very rationale for which the RTI Act was enacted, namely the citizen’s right to know under Article 19(1)(a) of the Constitution.

IV. Executive Control over Information

Beyond the RTI amendment, three further provisions, examined together rather than in isolation, illustrate a consistent pattern of expanding executive discretion over the flow of information. First, Section 17 of the DPDP Act empowers the Central Government to exempt any government agency from virtually all obligations under the Act where processing is undertaken in the interests of sovereignty, integrity, security of the State, or public order, and it further empowers the Government to exempt any data fiduciary or class of data fiduciaries from any provision for a period of up to five years. These exemptions are granted by executive notification, without a statutorily prescribed standard of review or a sunset mechanism tied to demonstrated necessity. Second, Section 36 authorizes the Central Government to call for information from the Data Protection Board or any data fiduciary as it may require, without any accompanying procedure for prior authorisation, independent oversight, or a right of appeal against such a demand. Petitioners have described this provision as vague, overbroad, and arbitrary, since it permits the Government to obtain personal data without the consent of the data principal and without any statutory guidance limiting its exercise. Third, Rule 5 of the DPDP Rules permits the State and its instrumentalities to process personal data for the provision of subsidies, benefits, services, licenses, certificates, or permits, subject only to standards framed by the Central Government itself under the Second Schedule, rather than judicially or independently supervised safeguards. It is submitted that the cumulative effect of these three provisions is significant. Section 17 permits the executive to exit the data protection framework altogether for its own agencies, Section 36 allows it to extract information from every other actor within that framework, and Rule 5 relaxes the consent architecture for the State’s own welfare-linked processing. Read together, these provisions place the executive in a structurally privileged position: exempt from the Act’s core obligations where inconvenient, empowered to demand data from others where useful, and released from strict consent requirements where administratively efficient. This article argues that this is not incidental to the statutory scheme but a structural feature of it.

V. Constitutional Assessment

The cumulative executive discretion identified above raises concerns under Articles 14, 19, and 21 of the Constitution. Article 14 prohibits arbitrary State action and requires that classification and discretion be structured by intelligible, non-arbitrary standards. Sections 17 and 36 confer discretion without publication requirements, reasoned orders, or independent review, and it is submitted that such unstructured discretion is difficult to reconcile with the standard against arbitrariness. Article 19(1)(a) protects the right to receive information as an incident of the freedom of speech and expression, a right the Supreme Court has consistently protected against vague and overbroad restrictions. Section 44(3), by removing the public interest override without a narrowly tailored alternative, arguably fails the least-restrictive-means requirement central to the proportionality test. Applying that test to Sections 17, 36, and 44(3) together, each may satisfy the requirement of a legitimate aim, such as national security or administrative efficiency, and each is traceable to a law. However, the absence of procedural safeguards, independent oversight, or a demonstrated necessity for the breadth of discretion conferred suggests that the measures may not satisfy the necessity and balancing limbs of the proportionality standard laid down in Puttaswamy and refined in Anuradha Bhasin v. Union of India. It is submitted that Article 21, having been the constitutional source of the privacy right the Act purports to protect, is put in an unusual position: the same provision of the Constitution that justifies the DPDP Act’s existence may also be the basis for challenging its executive-facing provisions.

VI. Conclusion

This article has examined four provisions of the DPDP framework, Sections 17, 36, and 44(3) of the Act, and Rule 5 of the Rules, and has argued that their cumulative effect is to expand executive discretion over information while narrowing the transparency obligations that ordinarily constrain the State. Section 44(3) removes the public interest override that once permitted disclosure of personal information bearing upon public accountability. Sections 17 and 36, read with Rule 5, together allow the executive to exempt itself from the Act’s obligations, extract data from others, and process welfare-linked personal data under self-prescribed standards. It is submitted that a coherent reform would restore a structured public interest test to Section 44(3), impose procedural safeguards and a right of appeal upon exercises of power under Sections 17 and 36, and subject Rule 5 to independently supervised standards rather than standards framed by the Government alone. The Supreme Court’s pending reference to a larger bench presents an opportunity to settle these questions authoritatively. Yet the deeper question the DPDP Act poses may outlast that litigation: has privacy, under this statute, become a constitutional shield that citizens may raise against the State, or has it become an administrative justification that the State may raise against its citizens?

VII. Reference(S):

Govt Evades Parliament Question on Whether DPDP Act Could Compel Journalists to Disclose Confidential Information, THE WIRE (Feb. 14, 2026)

https://thewire.in/media/government-parliament-question-dpdp-act-john-brittas-journalist\

DPDP Act v. RTI Act, LEGASIS (Mar. 2, 2026)

https://legasis.in/dpdp-act-v-rti-act/

Delhi HC Issues Notice on Plea against State Exemptions, Blocking Powers Under DPDP Act, LAWBEAT (Feb. 19, 2026)

https://lawbeat.in/news-updates/delhi-hc-issues-notice-on-plea-against-state-exemptions-blocking-powers-under-dpdp-act-1566615\

SC Reviews Privacy, RTI & Press Freedom Under DPDP Act, VAJIRAM & RAVI (Feb. 18, 2026)

https://vajiramandravi.com/current-affairs/dpdp-act-challenge/

P. Royappa v. State of Tamil Nadu, (1974) 4 S.C.C. 3
Shreya Singhal v. Union of India, (2015) 5 S.C.C. 1
Anuradha Bhasin v. Union of India, (2020) 3 S.C.C. 637
Justice K.S. Puttaswamy v. Union of India, (2017) 10 S.C.C. 1
Modern Dental College & Research Centre v. State of Madhya Pradesh, (2016) 7 S.C.C. 353
CPIO, Supreme Court of India v. Subhash Chandra Agarwal, (2020) 5 S.C.C. 481
Maneka Gandhi v. Union of India, (1978) 1 S.C.C. 248
The Reporters Collective Trust v. Union of India, W.P. (C) No. 211 of 2026
Venkatesh Nayak v. Union of India, W.P. (C) No. 177 of 2026
National Campaign for People’s Right to Information v. Union of India, W.P. (C) No. 212 of 2026
Constitutionality of the Digital Personal Data Protection Act, 2023, SUPS CT. OBSERVER (Feb. 20, 2026).