img
March 14 , 2026

Supreme Court Issues Notice in Plea Challenging Scope of “Personal Data” Under India’s DPDP Framework

In Geeta Seshu & Anr. v Union of India & Ors., W.P.(C) No. 275/2026, the Supreme Court on 12 March 2026 issued notice in a petition raising concerns over how the Digital Personal Data Protection framework may affect access to information, and directed that the matter be tagged with W.P. (Civil) No. 177 of 2026. The Bench recorded: “Issue notice, returnable on 23.03.2026” and “Tag with W.P. (Civil) No. 177 of 2026.”  As reflected in the contemporaneous newspaper report, the petition contends that the present framework may be used to block access to information of public interest, particularly where journalists seek data concerning persons holding public office. The report notes submissions that the DPDP architecture, especially its treatment of disclosure restrictions, could dilute the Right to Information by casting an unduly wide net around the expression “personal data.” It also records concerns that the law does not clearly distinguish between information that is genuinely private and information that, though linked to an individual, remains relevant to public accountability. In that backdrop, the core legal issue is whether privacy protection can be expanded so broadly that it ends up shielding governance-related information from public scrutiny.The matter is therefore important not because the Court has ruled on the definition already, but because it has now formally seized of a challenge that may shape the boundary between privacy and transparency in India’s data protection law. For the present, the order remains purely procedural.  

FACTS OF THE CASE:
The petitioners filed a Public Interest Litigation (PIL) before the Supreme Court challenging the constitutional validity of certain provisions of the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025.
The petition contended that several provisions of the Act and Rules violate fundamental rights guaranteed under Articles 14, 19(1)(a), 19(1)(g), 21 and 21A of the Constitution of India. 
The challenge was primarily based on concerns that the law:
* Curtails the Right to Information (RTI) by expanding exemptions for disclosure of personal information.
* Allows excessive executive control over the Data Protection Board of India.
* Enables the Central Government to exempt its instrumentalities from the application of the Act.
* Restricts civil remedies for individuals affected by data breaches or unlawful processing of personal data.
The petitioners also argued that the Act could adversely impact journalistic and investigative activities by failing to provide adequate exemptions for processing personal data for journalistic purposes. 

LEGAL ISSUES:

The petition raises several constitutional issues regarding the validity and functioning of the Digital Personal Data Protection Act, 2023. One of the central questions is whether the Act violates the fundamental rights guaranteed under Articles 14, 19, and 21 of the Constitution of India, particularly in relation to equality before law, freedom of speech and expression, and the right to life and personal liberty, including the right to privacy. The petition further challenges whether provisions of the Act that amend the Right to Information Act, 2005, especially those restricting the disclosure of personal information, undermine the principles of transparency, accountability, and the public’s right to know that form the foundation of the RTI framework. Another issue concerns the institutional design of the Data Protection Board of India, particularly whether its structure, composition, and appointment mechanism violate the doctrine of separation of powers and compromise the independence of the adjudicatory body due to executive control. Additionally, the petition questions the constitutionality of provisions that empower the Central Government to exempt its agencies from the application of the Act, arguing that such broad exemption powers may be arbitrary and inconsistent with Article 14, as they could allow government entities to function outside the regulatory safeguards intended to protect citizens’ personal data. Together, these issues require judicial scrutiny of the balance between data protection, privacy rights, transparency, and governmental accountability in India’s digital governance regime.

OBSERVATIONS OF THE COURT
The Supreme Court observed that the matter involves a complex balance between privacy and transparency and concerns fundamental rights on multiple fronts.
The Court noted that determining what constitutes personal data versus information of public interest is a sensitive constitutional issue requiring detailed consideration.

ORDER OF THE COURT:

The Supreme Court issued notice to the Union of India in the writ petition challenging the constitutional validity of provisions of the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025.
The Court declined to grant interim relief at this stage and decided to examine the matter after hearing the parties. 

ACCESS THE OFFICIAL JUDGMENT HERE:

COURT:

Supreme Court of India

CASE TITLE:

Geeta Seshu & Anr. v Union of India & Ors.

CASE NUMBER:
Writ Petition (Civil) No. 275 of 2026

ORDER DATED:

12 March 2026 (Supreme Court of India).

BENCH:

Chief Justice Surya Kant, Justice Joymalya Bagchi, Justice Vipul M. Pancholi.