'Interesting Question Is What's Public Data & Personal Data?' : Supreme Court On Challenge To DPDP Act

The Supreme Court today, while issuing notice in a plea challenging the Digital Personal Data Protection Act, 2023 and Rules, expressed that protection of data privacy has now become a global issue. The Court will also examine the issue of what would be considered as public data and private data. 

The bench comprising Chief Justice of India Surya Kant, Justice Joymalya Bagchi and Justice Vipul Pancholi was hearing the petition filed by journalist Geeta Seshu and NGO Software Freedom Law Centre challenging the Digital Personal Data Protection Act, 2023 (DPDP Act) and DPDP Rules 2025. 

Sr Advocate Indira Jaisingh, appearing for the petitioner, stressed that the impugned Act and Rules in effect legalise disproportionate State surveillance, create a compensation vacuum for citizens, dilute the Right to Information, erode the ability of journalists to practice their profession, and establish a data protection regulator that is structurally dependent upon the Executive.

Jaisingh submitted that the DPDP ACt amended the RTI Act, omitting the 'public interest' ground to disclose the personal data of a public servant.  Thus, the personal data of a public servant has been totally exempted from disclosure. As a result, if a journalist is writing about a public servant, they would not be able to have access to data relating to the officer. 

At this juncture, the CJI remarked that this issue also raises an "interesting question that we will have to determine, that is, what is public data and what is personal data?" 

Taking the example of the RTI Act, Jaisingh explained that in the RTI Act, an exception was carved out where information of 'public interest' could have been accessed; this aspect is not there in the impugned Act. She added, "That's what is causing the trouble; otherwise, there would have been no other problem."

Secondly, she pointed out that the impugned Act gives powers to the Centre to acquire data on anything on the ground of 'Public order', a term that Jaisingh stressed to have a wide and broad interpretation. 

The CJI weighed in to add that this will raise concerns for individuals' right to privacy. He said: 

"If there are sweeping provisions in the Act and where right to privacy and this conflict comes, then how do we protect some individuals? What can be the measures can be taken without affecting the right to privacy?" 

The CJI, referring to the pending case of Meta Platforms Inc v. CCI, remarked that data privacy has now become a global issue. He added, "data is becoming the real true wealth as of date." 

Jaisingh further submitted that the impugned act repeals and omits Section 43A of the Information Technology Act, 2000. The Impugned Act fails to provide any equivalent or effective civil remedy to individuals whose personal data is unlawfully processed or breached. 

As per the new Act, the compensation, if any, will go to the Data Protection Board and not the individual affected. 

The bench issued notice in the matter and tagged it with other pending petitions. While hearing the previous petitions, the CJI had orally commented that there were "some creases which required to be ironed out."

Notably, the Court is presently seized with three other writ petitions - one filed by Venkatesh Nayak, another by digital news platform The Reporters Collective and journalist Nitin Sethi, and the third one filed by the National Campaign for People's Right to Information (NCPRI). The petitioners have essentially challenged Section 44(3) of the DPDP Act, amending Section 8(1)(j) of the RTI Act, giving a blanket exemption to the disclosure of personal information. Before the amendment, personal information could have been disclosed if there was an overriding public interest.

The present plea seeks the following reliefs : 

a) Issue an appropriate writ, order or direction or declaration quashing and setting aside Sections 7, 17(2)(a), 19(3) 24, 36, 44(2)(a), and 44(3) of the Digital Personal Data Protection Act, 2023, to the extent challenged herein, as being unconstitutional, void and inoperative, and violative of Articles 14, 19(1)(a), 19(1)(g), 21 and 21A of the Constitution of India. 

b) Issue an appropriate writ, order or direction, or declaration quashing and setting aside Rules 5, 6, 17, 18, 21 and 23, and the Second Schedule, Fifth Schedule, Sixth Schedule and Seventh Schedule of the Digital Personal Data Protection Rules, 2025, to the extent challenged herein, as being unconstitutional, void and inoperative, and violative of Articles 14, 19(1)(a), 19(1)(g), 21 and 21A of the Constitution of India. 

c) Issue an appropriate writ, order or direction, or declaration quashing and setting aside Section 17(2) of the Digital Personal Data Protection Act, 2023, insofar as it empowers the Central Government to exempt any of its instrumentalities from the application of the provisions of the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025.

d) Issue an appropriate writ, order or direction, or declaration quashing and setting aside the Second Schedule of the Digital Personal Data Protection Rules, 2025.

e) Issue an appropriate writ, order or direction, or declaration quashing and setting aside Section 44(2)(a) of the Digital Personal Data Protection Act, 2023, insofar as it extinguishes the right of affected persons to seek compensation or civil remedy for unlawful processing of personal data and/or data breach.

f) Issue an appropriate writ, order or direction, or declaration quashing and setting aside Section 44(3) of the Digital Personal Data Protection Act, 2023 insofar as it dilutes the right to information of the citizens of India.  

g) Issue an appropriate writ, order or direction, or declaration quashing and setting aside Section 19(3) and Section 24 of the Digital Personal Data Protection Act, 2023 read with Rules 17, 18 and 21 and the Fifth and Sixth Schedules of the Digital Personal Data Protection Rules, 2025, insofar as they relate to the constitution, appointment, service conditions and functioning of the Data Protection Board of India. 

h) Issue an appropriate writ, order or direction, or declaration directing the Respondent No. 1 to frame a constitutionally compliant mechanism for appointment, tenure and service conditions of the Data Protection Board of India, ensuring its independence from executive control.

i) Issue an appropriate writ, order or direction, or declaration quashing and setting aside Section 36 of the Digital Personal Data Protection Act, 2023 read with Rule 23 and the Serial No. 1 of the Seventh Schedule of the Digital Personal Data Protection Rules, 2025. 

j) Issue an appropriate writ, order or direction, or declaration directing the Respondent No. 1 to incorporate and notify a specific and proportionate exemption under the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 for processing of personal data for journalistic, editorial, investigative and public interest reporting purposes, including protection of journalistic sources. Alternatively, issue an appropriate writ, order or direction, or declaration quashing and setting aside Section 7 of the Digital Personal Data Protection Act, 2023, insofar as it fails to provide an exemption for processing of personal data for journalistic purposes. 

The plea was filed through Advocate-on-Record Paras Nath Singh.

Case Details: GEETA SESHU AND ANR. Versus UNION OF INDIA AND ORS| W.P.(C) No. 275/2026