RTI and data protection address two different but interconnected aspects of modern governance.
Protects the citizen's:
Right to access information held by public authorities.
Protects individuals against inappropriate processing and misuse of:
Personal data.
Right to Know + Transparency + Accountability
vs
Personal Data Protection + Privacy + Dignity + Informational Autonomy
Responsible Digital Governance.
Modern governments collect enormous quantities of:
Digitisation → More Information
but also:
Digitisation → More Privacy Risk.
How can government:
disclose information necessary for public accountability without unnecessarily exposing personal data?
Provides the constitutional foundation for freedom of speech and expression, which includes the citizen's right to know.
Protects:
The Supreme Court's K.S. Puttaswamy judgment recognised privacy as a fundamental right and emphasised that it is not absolute.
Article 19(1)(a) → Right to Know
Article 21 → Privacy
RTI and privacy are both constitutionally important values.
Data protection is closely connected with:
Informational privacy.
Informational privacy concerns control over information relating to an individual.
Informational Privacy.
India enacted the:
Digital Personal Data Protection Act, 2023 (DPDP Act).
The Act creates a framework for processing digital personal data while recognising both:
DPDP Act ≠ RTI Act.
They are separate statutes with overlapping governance implications.
The most important direct connection is:
Section 44(3) of the DPDP Act, 2023.
It substituted Section 8(1)(j) of the RTI Act.
The new wording is:
"information which relates to personal information".
The amendment to Section 8 of the RTI Act under Section 44(3) came into force on:
13 November 2025.
The commencement notification expressly brought Section 44(1) and (3) into force on that date. (indiacode.nic.in)
Section 8(1)(j)
→
Information which relates to personal information.
Many older books, notes and coaching materials continue to reproduce the earlier wording.
For current-law questions:
Use the amended wording.
Historical jurisprudence ≠ Current statutory text.
Before the amendment, Section 8(1)(j) used a more detailed test involving:
This wording shaped important Supreme Court RTI cases.
Those judgments remain important for understanding the evolution of privacy jurisprudence, but the old statutory wording should not be presented as the current text.
The amendment changes the statutory relationship between:
Personal Information + Public Activity/Public Interest + Privacy Harm + Larger Public Interest
Personal Information → Statutory exemption.
The current law must be studied separately from the historical RTI privacy jurisprudence.
The DPDP framework seeks to regulate:
Processing of digital personal data.
It recognises the need to:
Trusted Digital Economy.
Two key DPDP concepts are:
The individual to whom personal data relates.
The person who determines:
Individual → Data Principal.
Decision-maker/controller → Data Fiduciary.
Citizen requesting information from a public authority.
Individual whose personal data is being processed.
Example:
A citizen requests access to their own government-held information.
The legal position can differ when a person seeks:
Their own information
versus:
Another person's personal information.
Applicant's own personal information.
Another individual's personal information.
Third-party personal data is particularly relevant to:
A common misconception is:
Government transparency = publication of all government-held datasets.
Wrong.
Government information may include:
Digital government requires:
Data classification before disclosure.
A mature information system can classify data as:
Classification helps determine:
Government databases may contain:
Disclose:
Protect:
Suppose government has a database containing:
Number of beneficiaries + Total amount spent + District-wise performance.
Individual:
Aggregate + Anonymise + Disclose accountability information.
A core principle of privacy-aware governance is:
Use/disclose only the amount of personal data necessary for the legitimate purpose.
To establish:
₹500 crore was distributed to 5 lakh beneficiaries.
There is no general need to disclose:
Privacy-Compatible Transparency.
Anonymisation removes or transforms identifiers so individuals cannot reasonably be identified.
Instead of:
Beneficiary: Ravi, Aadhaar number XXXXX, bank account XXXXX.
Publish:
District: Hyderabad Beneficiaries: 15,000 Total amount: ₹20 crore.
Accountability + Lower Privacy Risk.
Aggregation presents data at a group level rather than individual level.
Can preserve:
Public accountability
without unnecessary:
Individual exposure.
Section 10 of the RTI Act provides for:
Severability.
Government document:
Personal phone number → Redact.
Official decision → Disclose.
Sensitive Portion → Protect.
Public Portion → Disclose.
Data protection should not automatically result in withholding an entire record.
Where information relates to another person and is treated as confidential:
Section 11
may require third-party consultation.
5 days → Notice.
10 days → Representation.
40 days → Decision.
Third-party objection ≠ Automatic veto.
Public officials retain legitimate privacy interests.
Public office ≠ Complete loss of privacy.
Data protection should not become a blanket shield against legitimate accountability.
Information directly relevant to:
may have strong public-interest significance.
Irrelevant personal details may still be protected.
Better Disclosure Decision.
Public interest may be relevant to disclosure decisions.
Public interest ≠ Automatic right to personal data.
Is the personal data necessary for achieving the public objective?
Section 4 requires proactive disclosure.
But proactive disclosure remains subject to lawful exemptions.
Proactive Disclosure + Privacy-by-Design.
Publish:
Protect:
Open data promotes:
But:
Open Dataset → Potential Linkage Risk.
Dataset A: → Name.
Dataset B: → Location.
Dataset C: → Medical condition.
Individually harmless datasets can potentially reveal sensitive information when combined.
Privacy risk can arise through:
Data linkage.
Removing names does not always guarantee anonymity.
can potentially identify individuals when combined.
Anonymisation must consider:
Re-identification risk.
Publishing data online creates potentially permanent and widespread dissemination.
Digital disclosure can have a greater privacy impact than controlled physical access.
Data protection also requires:
Transparency systems can themselves become targets for:
Trusted Digital Governance.
Digital RTI portals may process:
Digital RTI systems need policies for:
Transparency requires records.
Privacy requires controlled retention.
Legal Retention + Purpose Limitation + Data Minimisation.
Data collected for one administrative purpose should not automatically be repurposed without legal basis.
Welfare database → Created for subsidy delivery.
Using it for: → Unrelated public publication.
may raise privacy concerns.
Purpose → Authority → Use → Disclosure
Government increasingly shares data across departments.
Responsible data sharing.
Function creep occurs when information collected for one purpose gradually gets used for unrelated purposes.
Data collected for:
welfare delivery
later used for:
unrelated profiling.
Purpose limitation is weakened.
Digital governance requires institutional discipline over secondary data use.
AI can process government datasets at scale.
More analytical power → Greater privacy responsibility.
Data protection is not only about information directly disclosed.
AI can infer:
Even anonymised location + time + occupation data may reveal sensitive information.
Modern privacy protection must address:
Inference
as well as:
Disclosure.
Examples:
Focus on:
Public function
rather than:
Private life.
Privacy-sensitive government data can include:
Sensitive data requires stronger safeguards.
The exact legal treatment depends on the current RTI framework and applicable data-protection law.
The DPDP Act has staggered commencement.
On:
13 November 2025
the Central Government brought into force several provisions including:
Other provisions have later commencement dates.
The entire DPDP Act became operational on one single date.
❌ Wrong.
The:
Digital Personal Data Protection Rules, 2025
were notified on:
14 November 2025.
Their provisions also have staggered commencement.
Act commencement and Rules commencement should not be confused.
The official MeitY material states that the DPDP Rules, 2025 were notified and provides a phased commencement framework.
Therefore, UPSC answers should distinguish:
"Enacted" does not automatically mean:
Every provision is already operative.
| Feature | RTI | Data Protection |
|---|---|---|
| Main objective | Access to information | Protect/govern personal data |
| Primary beneficiary | Citizen/public | Data Principal |
| Main concern | Transparency | Privacy/data governance |
| Core law | RTI Act, 2005 | DPDP Act, 2023 |
| Typical direction | Disclosure | Lawful processing/protection |
| Public authority role | Information holder | May be Data Fiduciary in applicable cases |
Exposes:
Protects:
Trustworthy Digital Governance.
Government information systems should incorporate:
Privacy should be built into the system before disclosure decisions arise.
Likewise, systems should make public information easy to:
Responsible Digital State.
Major challenges include:
Create clear administrative guidance for:
Classify records into:
Use:
Training should include:
Use:
Document:
AI may assist disclosure decisions but should not eliminate legal responsibility.
Article 19(1)(a) → Right to Know.
Article 21 → Privacy.
Section 4 → Proactive disclosure.
Section 8(1)(j) → Current personal-information exemption.
Section 10 → Severability.
Section 11 → Third-party consultation.
Section 19 → Appeals.
DPDP Act → Digital personal-data governance.
DPDP Rules → Operational/implementation framework.
Responsible Digital Governance.
RTI → Know.
DPDP → Protect.
Section 8(1)(j) → Personal Information.
Section 10 → Separate/Redact.
Section 11 → Consult Third Party.
Section 4 → Proactively Disclose.
Article 21 → Privacy.
Article 19(1)(a) → Right to Know.
RTI and DPDP are the same law.
❌ Wrong.
They are separate statutes.
DPDP abolished RTI.
❌ Wrong.
It changed Section 8(1)(j), but did not abolish the RTI Act.
The entire DPDP Act came into force on 13 November 2025.
❌ Wrong.
The Act has staggered commencement. (indiacode.nic.in)
The DPDP Rules came into force exactly together with the entire DPDP Act.
❌ Wrong.
The Rules have their own commencement framework. (meity.gov.in)
Section 8(1)(j) still contains the old public-activity/privacy wording.
❌ Wrong under current law.
It was substituted in 2025.
Every personal-information request must be rejected under RTI.
❌ Avoid such an absolute statement.
The current statutory framework and applicable legal provisions must be applied to the specific information.
Any anonymised dataset is automatically risk-free.
❌ Wrong.
Re-identification and linkage risks can remain.
Public interest automatically defeats data protection.
❌ Wrong.
Public interest must be assessed within the applicable legal framework.
Data protection means government can never disclose personal data.
❌ Wrong.
The relevant laws contain lawful bases, exemptions and different contexts of processing/disclosure.
Open data means all government data should be open.
❌ Wrong.
Personal, confidential and security-sensitive information may require protection.
Third-party consultation makes disclosure impossible without third-party consent.
❌ Wrong.
Section 11 gives the third party an opportunity to make a representation; it does not create an automatic veto.
Removing a person's name always makes data anonymous.
❌ Wrong.
Other identifiers may permit re-identification.
RTI and data protection embody two essential values of democratic digital governance: the citizen's right to know and the individual's right to control and protect personal information. The 2025 amendment to Section 8(1)(j) has made this relationship particularly important by expressly linking the RTI exemption to personal information.
Section 44(3) of DPDP Act → Substituted Section 8(1)(j).
Effective: → 13 November 2025.
The ideal digital-governance model is neither a secretive State nor an unrestricted data State. It is a transparent State that protects citizens' personal data, using RTI, privacy law, data governance and technology together to achieve accountable and trustworthy governance.
