Vakil Help Desk News: the constitutional validity of several DPDP Act provisions — on RTI, government exemptions, information demands and the Data Protection Board — is pending before the Supreme Court. We explain what is being argued.
Vakil Help Desk News, DPDP & Data Privacy. The Digital Personal Data Protection Act, 2023 is facing a constitutional challenge before the Supreme Court. The petitions raise important questions about transparency, state power and safeguards that will shape how the law works in practice.
What is being challenged
- Section 44(3): the amendment to the RTI Act's personal-information exemption, said to create a near-blanket bar on disclosure and to affect the right to information.
- Government exemptions (Sections 17(1)(c) and 17(2)): broad exemptions for certain state processing, which petitioners fear could enable surveillance without adequate safeguards or review.
- Information demands (Section 36 and related rules): powers to call for information from data fiduciaries and intermediaries, with limited guidance.
- Data Protection Board (Section 18 and rules): the selection process for Board members, said to give the executive too much control.
- Section 33: penalties for a 'significant' data breach, where the term is said to be vague.
Status
The Court has issued notice, declined to stay the Act at this stage, and the matter is being heard. Until it is decided, the Act and its Rules remain in force and businesses must continue preparing for compliance.
What this means for you
A pending challenge does not pause your compliance obligations — the DPDP Act and Rules are in force and the phased deadlines continue. Track the case for points that may affect you (government data demands, breach penalties, the Board), but build your compliance now. We keep clients updated on DPDP developments and help them stay compliant while the law settles.