Civil society groups to mount legal challenge to parts of data protection law

For long, transparency advocates have decried the Digital Personal Data Protection Act’s dilution of the Right to Information Act, executed by a reduction to Section 8(1)(j), which previously allowed disclosure of personal information with safeguards; that allowance became a full exemption after the DPDP Act was notified in November. Now, civil society groups are considering the next steps, including a legal challenge, to continue their fight against the dilution.

The groups include the National Campaign for People’s Right to Information (NCPRI), the Right to Food Campaign, the National Campaign for Dalit Human Rights, the National Federation of Indian Women, the Right to Education Campaign, the National Alliance of Peoples’ Movements, People’s Union for Civil Liberties, Internet Freedom Foundation, Jan Swasthya Abhiyan, Common Cause, and Constitutional Conduct Group.

Editorial | Too little, much later: on the Digital Personal Data Protection Rules, 2025

In a meeting in the capital on Wednesday (December 10, 2025), the groups discussed the way forward, and committed to a legal challenge. “It was resolved that the campaign will continue its efforts to raise awareness about the implications of the law and also approach courts to challenge the provisions of the law,” a statement by the Roll Back RTI Amendments Campaign said.

Retired Supreme Court judge and chairman of the United Nations Internal Justice Council Madan B. Lokur assailed the amendments, saying that a full restriction on sharing personal information under the RTI Act would impede public accountability. Citing the example of the blaze in a Goa nightclub on December 6, Mr. Lokur said that government departments could refuse to identify key public officials in responsible positions due to this exemption.

Beyond the RTI Act amendment, the groups discussed other concerns about the DPDP Act. “The chilling impact on activists, journalists, lawyers, political parties, groups and organisations who collect, analyse and disseminate critical information as they will become ‘data fiduciaries’ under the law was discussed,” the statement said. “The excessive centralisation of power in the central government, including the constitution of a government-controlled Data Protection Board with powers to levy penalties of up to ₹250 crore (which can be doubled up to ₹500 crore), raises concerns about the weaponisation of this law against those seeking accountability.”