RESEARCH PAPER: Privacy Rights to Regulatory Compliance - A Critical Study, AUTHOR: Sridhar Prasad Gollanapalli
India’s digital transformation has intensified the need to reconcile individual privacy, secure processing of digital personal data, cyber resilience and public access to information. The Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025 establish a phased framework for processing digital personal data. Their operation intersects with the Information Technology Act, 2000 (IT Act), Cybersecurity Directions issued by the Indian Computer Emergency Response Team (CERT-In), and the Right to Information Act, 2005 (RTI Act). EU General Data Protection Regulation (GDPR) is a useful comparative model but it is not automatically applicable to every Indian organisation. Its territorial scope depends on the criteria specified in Article 3 , including relevant European Union establishments and certain processing activities involving individuals in the European Union.
RESEARCH PAPER
Abstract
India’s digital transformation has intensified the need to reconcile individual privacy, secure processing of digital personal data, cyber resilience and public access to information. The Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025 establish a phased framework for processing digital personal data. Their operation intersects with the Information Technology Act, 2000 (IT Act), Cybersecurity Directions issued by the Indian Computer Emergency Response Team (CERT-In), and the Right to Information Act, 2005 (RTI Act). EU General Data Protection Regulation (GDPR) is a useful comparative model but it is not automatically applicable to every Indian organisation. Its territorial scope depends on the criteria specified in Article 3 , including relevant European Union establishments and certain processing activities involving individuals in the European Union.
This paper examines these regimes as connected legal systems rather than isolated ones. It analyses constitutional privacy, statutory overlaps and transitions, personal-data breach response, cyber offences, and the boundary between confidentiality and transparency in public administration. Particular attention is paid to section 44 of the DPDP Act, including the amendment to section 8(1)(j) of the RTI Act and the phased omission of section 43A of the IT Act. It also considers the Digital Personal Data Protection (Removal of Difficulties) Order, 2026 issued on 5th October 2026. The paper argues for coordinated compliance, clear incident-response protocols, reasoned disclosure decisions and accessible remedies.
Keywords
Digital privacy; DPDP Act; IT Act; cyber law; CERT-In; RTI Act; EU-GDPR; personal data breach; transparency; remedies.
1.Introduction
Digital services used by Banks, Insurers, Hospitals, Public Authorities and Private platforms routinely collect and process personal data. A single incident may involve unlawful access to a computer resource, exposure of personal information, identity theft, failure to safeguard data and a public demand for records explaining the incident. Such a situation cannot be analysed adequately through one statute alone.
● The DPDP Act, 2023 provides a framework for processing digital personal data, recognising individual interests while permitting lawful processing.
● The IT Act, 2000 addresses electronic records, computer-related conduct and specified cyber offences.
● CERT-In directions create operational reporting and response duties for specified cyber incidents.
● The RTI Act, 2005 promotes transparency in public authorities, but disclosure obligations may intersect with personal privacy.
The constitutional right to privacy and public interest in an accountable Government inform the public as to the interpretation of these statutes.
The central thesis is that privacy, cybersecurity and transparency should be treated as mutually relevant public-law objectives. Neither a privacy claim nor a transparency claim should operate as an automatic answer without examining the governing text, commencement status, facts and safeguards.
2. Research Problem, Questions, Objectives and Methodology
The principal problem is fragmented compliance: the same facts may trigger duties under data-protection law, cyber-incident directions, the IT Act and the RTI regime, yet the timelines, purposes, decision-makers and remedies differ.
This paper asks:
1. How do the DPDP Act and Rules interact with the IT Act and wider cyber-law framework?
2. How should organisations coordinate data-breach intimation with CERT-In reporting?
3. Does the amended section 8(1)(j) of the RTI Act reconcile privacy and public accountability?
4. What remedies are available when one event involves unlawful processing, a cyber offence and a disputed request for public information?
The objectives are,
● to map statutory overlaps,
● explain the commencement transition,
● evaluate constitutional and Supreme Court principles, and
● recommend a workable compliance model.
The method is doctrinal legal research based on legislation, Gazette notifications, government directions and reported judgments.
It is qualitative and illustrative, not an empirical audit of institutional compliance.
3. Constitutional Foundation : Privacy and Transparency
In Justice K.S. Puttaswamy (Retd.) v Union of India, the Supreme Court recognised privacy as a fundamental right protected by the Constitution, particularly through the guarantees of life and personal liberty and other freedoms. Privacy is not absolute; restrictions must be justified within constitutional limits. The judgment provides the constitutional setting for data minimisation, purpose limitation, safeguards and scrutiny of state action.
The RTI Act expresses a complementary democratic value: access to information held by public authorities supports informed citizenship and accountability. In Central Public Information Officer, Supreme Court of India v Subhash Chandra Agarwal, the Supreme Court examined the interaction between transparency, confidentiality and privacy. Competing interests require contextual analysis under the applicable statutory framework.
The two principles should not be framed as opposites. Publication of personal identifiers, medical details or account numbers may cause disproportionate harm, while disclosure of contracts, expenditure, audit findings or institutional responses to misconduct may serve a substantial public interest. The legal task is to distinguish private details from information needed to scrutinise public power.
4. DPDP Act, 2023 and DPDP Rules, 2025
The DPDP Act regulates processing of digital personal data within its scope. Its framework includes obligations of Data Fiduciaries, rights of Data Principals, duties concerning consent and lawful processing, security safeguards, breach-related intimation, special treatment of children’s data and additional obligations for Significant Data Fiduciaries. The Rules, 2025 supply operational detail, including notices, security safeguards, breach intimation and governance measures.
The Act and Rules have phased commencement. Rules notified as G.S.R. 846(E) on 13 November 2025 provide that Rules 1, 2 and 17–21 commenced on publication; Rule 4 is scheduled one year after publication; and Rules 3, 5–16, 22 and 23 are scheduled eighteen months after publication. The commencement notification for the Act similarly stages provisions. As on date, it would be inaccurate to imply that every substantive obligation is already operative. The relevant Gazette notifications must be checked before advising on a specific compliance date. Under Sections 13 and 14 of the DPDP Act:
● A Data Principal can seek grievance redressal from the Data Fiduciary or Consent Manager.
● The prescribed grievance process must be followed before approaching the Data Protection Board.
● The Data Principal can nominate another individual to exercise their rights in the event of death or incapacity.
The Digital Personal Data Protection (Removal of Difficulties) Order, 2026, S.O. 5458(E), makes textual substitutions in section 9(1) concerning personal data of a child or of a person with disability who has a lawful guardian, and in section 10(2)(c)(ii) by substituting ‘periodic data audit’ for ‘periodic audit’. These changes clarify wording; they do not themselves accelerate the staged commencement of the relevant substantive provisions.
The Act’s exemptions and the treatment of government processing must also be analysed carefully. A public authority is not exempt from every accountability concern merely because it exercises statutory functions. The precise provision, purpose of processing, applicable exemption and safeguards should be identified rather than assuming a blanket exemption.
5. Interaction with the Information Technology Act, 2000
The IT Act remains a central part of India’s cyber-law framework. Section 43 addresses specified unauthorised acts involving computer resources and provides for compensation; section 66 criminalises conduct described in section 43 when done dishonestly or fraudulently. Sections 66C and 66D address identity theft and cheating by personation using computer resources. Sections 72 and 72A concern specified breaches of confidentiality or privacy and disclosure of information in breach of lawful contract. The elements of each provision must be proved; a data breach does not automatically establish every criminal offence.
Section 43A has historically provided for compensation where a body corporate handling sensitive personal data or information is negligent in maintaining reasonable security practices and procedures, causing wrongful loss or wrongful gain. Section 44(2) of the DPDP Act provides for omission of section 43A, but the commencement notification stages that change. On the schedule notified on 13th November 2025, the eighteen-month period runs to 13th May 2027. Therefore, Section 43A should not be described as already omitted. Practitioners should verify the operative Gazette position on the date of the incident or advice.
This transition raises a practical question: How should organisations preserve compliance continuity while the old provision remains operative and the new data-protection framework is introduced in stages? A prudent approach is to maintain security controls, contractual obligations, incident logs and evidence of reasonable practices without assuming that compliance with one statute automatically satisfies every other regime.
The IT Act and DPDP Act serve related but different purposes. The IT Act may address unauthorised access, identity theft or specified disclosures; the DPDP framework addresses the lawfulness and governance of personal-data processing. A single incident may require parallel legal analysis, but overlapping consequences must be assessed under each provision’s own ingredients and commencement date.
6. Cyber Law, Cybersecurity and CERT-In
Cyber law is broader than the IT Act alone. Depending on the facts, it may involve criminal procedure, electronic evidence, sectoral directions, contractual obligations, banking or insurance regulation, and CERT-In’s incident-response framework. The Bharatiya Sakshya Adhiniyam, 2023 is relevant to the admissibility and proof of electronic and digital records, subject to its specific provisions and the facts of the proceeding.
Under section 70B of the IT Act, CERT-In functions as the national agency for specified cyber-security incident response activities. Its directions dated 28 April 2022 require covered entities to report listed cyber incidents within six hours of noticing them or being informed of them, and contain other operational requirements. The directions and their FAQs should be consulted to determine applicability and the information required in a particular case.
CERT-In reporting and DPDP personal-data-breach intimation should not be conflated. They have different legal sources, purposes, recipients and triggering conditions. Where both regimes apply, an organisation should run a coordinated response: contain the incident, preserve logs and evidence, assess the categories of affected systems and individuals, notify the appropriate authority or affected persons as required by each operative rule, and document the basis and timing of decisions.
A response plan should identify an incident lead, legal and technical decision-makers, a secure evidence repository, a decision log, escalation thresholds and communication templates. It should address vendor and cloud-provider cooperation, because an organisation may need facts from a processor or service provider before it can fully assess the incident.
7. Privacy and Transparency under the RTI Act,2005
Section 8(1)(j) of the RTI Act has been a key provision for requests involving personal information. Section 44(3) of the DPDP Act substitutes the wording of section 8(1)(j) with ‘information which relates to personal information’. This amendment commenced on 13 November 2025 under the staged commencement notification. The wording change is significant and should be discussed expressly in contemporary analysis of privacy and RTI.
The amendment creates interpretive and policy questions about how the privacy exception operates alongside the RTI Act’s other provisions, including severability under section 10, appeal mechanisms under section 19 and the Act’s overriding clause in section 22. The amended wording should not be treated as a licence to disclose all personal information, nor should it be assumed without analysis to eliminate every question concerning public accountability. The exact statutory text and any later authoritative interpretation must guide decisions.
A useful analytical distinction is between information that exposes intimate or identifying details without a sufficient public purpose and records needed to scrutinise public expenditure, official decision-making, procurement, regulatory failure or institutional handling of a complaint. In some cases, redaction or severance may permit disclosure of accountability-relevant material while protecting personal identifiers. Whether that solution is legally available in a particular case depends on the governing provisions and the record.
The decision in CPIO, Supreme Court of India v Subhash Chandra Agarwal remains an important background on privacy, confidentiality and transparency under the earlier statutory framework. It must, however, be applied carefully: the legislative change to section 8(1)(j) means the current statutory text must be examined rather than assuming the pre-amendment wording remains unchanged.
8. Integrated Case Study : Cyberattack on a Public-Sector Insurer
Assume a public-sector insurer discovers unauthorised access to a customer database containing names, contact details, policy information and identity documents. Customers begin receiving fraudulent calls. A policyholder seeks redress, while a citizen files an RTI application requesting the incident report, audit findings, expenditure on cyber-security and details of remedial action.
First, the insurer should investigate whether the incident involves unauthorized access or other conduct potentially covered by sections 43 or 66 of the IT Act, and whether identity theft or personation under sections 66C or 66D is implicated. Any criminal allegation must be supported by evidence and the relevant statutory ingredients.
Second, the insurer should assess whether CERT-In reporting is required under the 2022 directions and meet the applicable timeline. Separately, it should assess the DPDP Act and Rules provisions in force on the incident date and determine any required intimation to affected individuals or the Data Protection Board. Filing one report should not be assumed to discharge another obligation.
Third, the RTI request requires a distinct decision. The authority should identify what information it holds, apply the current wording of section 8(1)(j), consider other applicable provisions and assess whether non-sensitive portions can be disclosed through severance. A request for a complete database, customer identifiers or exploitable technical details is materially different from a request for expenditure, governance failures or steps taken to protect policyholders. A reasoned order should explain the statutory basis for disclosure or refusal and inform the applicant of available appeal rights.
Finally, an affected customer may have more than one route, depending on the facts and operative law: internal grievance procedures, a complaint to the competent data-protection authority when the relevant statutory mechanism is operative, police or cybercrime reporting for suspected offences, contractual or consumer remedies where available, and judicial review or other court proceedings. Remedies are not interchangeable; the appropriate forum depends on the relief sought.
9. Findings and Implementation Challenges
The regimes overlap but do not have identical purposes: privacy governance, cyber-incident response, cyber-offence enforcement and public access to information must be analysed separately. Phased commencement creates transition risk, and organisations need a dated register of operative provisions. The amendment to RTI section 8(1)(j) requires updated disclosure procedures. A cyber incident can trigger parallel reporting and evidentiary obligations; failure to coordinate can cause delay, inconsistent statements, lost evidence or incomplete notifications. Individuals need accessible remedies, while Public Authorities need clear protocols for redaction, reasoned decisions and appeals.
Table 1.An overview of Legal Frameworks
Legal Frame work
Principal Objective
Regulatory Compliance
DPDP Act 2023
Protect digital personal data while permitting lawful processing
Individual Rights, Consent, Duties of Data Fiduciaries and Penalities
DPDP Rules 2025
Operationalise DPDPAct 2023
Notices,security safeguards, breach notifications,Consent Management and procedures
Information Technology Act 2000
Regulate electronic transactions and address specified Cyber related offenses and liabilities
Electronic records, unauthorised access, intermediary liability and cybersecurity related provisions
CERT-In Directions 2022
Strengthen cyber security incident Reporting and Response
Specified cyber incidents,reporting timelines,logs and information retention
Right to Information Act 2005
Promote transparency and Accountability in Public Authorities
Access to records, exemptions and Public Interest Disclosure
EU-GDPR 2018
Protect Personal Data and Regulate its processing
Data- subject rights, lawful bases, accountability, Supervisory Authorities and Remedies
10. Recommendations
First, publish an integrated compliance matrix mapping each incident type to the relevant DPDP provisions, IT Act sections, CERT-In requirements, sectoral rules and RTI obligations, including commencement dates.
Second, adopt a single incident-response playbook with separate decision points for CERT-In reporting, personal-data-breach intimation, law-enforcement referral, customer communication and evidence preservation.
Third, maintain data inventories, access controls, encryption where appropriate, tested backups, vendor oversight, staff training and documented incident exercises.
Fourth, train public information officers to apply the amended section 8(1)(j) accurately, consult current legal guidance, consider lawful severance where applicable, and provide reasoned orders with appeal information.
Fifth, develop inter-agency coordination protocols that respect each authority’s statutory remit and avoid assuming that one notification or proceeding resolves all issues.
Sixth, make regulatory guidance accessible to smaller entities and public bodies through practical templates, clear timelines and proportionate implementation support.
Finally, Courts and Regulators should articulate principled approaches to privacy, public interest, cybersecurity and transparency while respecting the current text of each statute.
11. Conclusion
The DPDP Act, IT Act, CERT-In directions and RTI Act form connected components of India’s digital governance framework.
Privacy cannot be protected by data-protection rules alone if systems remain insecure; cybersecurity cannot replace lawful processing and individual rights; and transparency cannot be achieved by indiscriminate disclosure of Digital personal information. The appropriate response depends on the precise statutory provision, facts, remedy sought and commencement status.
Section 44 of the DPDP Act makes the interaction concrete by amending the RTI framework and scheduling changes to the IT Act. The phased transition, together with the 2026 Removal of Difficulties Order, demonstrates why legal analysis must be date-sensitive. The strongest approach is coordinated rather than fragmented: protect data, investigate cyber incidents, preserve evidence, disclose what the law requires, withhold or redact what the law protects, and give individuals meaningful routes to challenge unlawful conduct. Such an approach can advance privacy, security and democratic accountability together.
Footnotes / Endnotes
1. Justice K.S. Puttaswamy (Retd.) v Union of India (2017) 10 SCC 1.
2. Digital Personal Data Protection Act 2023, ss 8–10, 17–22, 43–44.
3. Digital Personal Data Protection Rules 2025, GSR 846(E), Gazette of India, 13 November 2025; corrigendum GSR892(E), 11December2025. Officialtext: https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf
4. Ministry of Electronics and Information Technology, Notification GSR 843(E), 13 November 2025, commencement of provisions of the Digital Personal Data Protection Act 2023.
5. Digital Personal Data Protection (Removal of Difficulties) Order 2026, SO 5458(E), October 2026.
6. Information Technology Act 2000, ss 43, 43A, 66, 66C, 66D, 70B, 72 and 72A.
7. Indian Computer Emergency Response Team, Directions under s 70B(6) of the Information Technology Act 2000, 28 April 2022; CERT-In, FAQs on Cyber Security Directions, May 2022: https://www.cert-in.org.in/Directions70B.jsp
8. Right to Information Act 2005, ss 6, 8(1)(j), 10, 19 and 22, read with Digital Personal Data Protection Act 2023, s 44(3).
9. Central Public Information Officer, Supreme Court of India v Subhash Chandra Agarwal (2019) 16 SCC 1.
10. Bharatiya Sakshya Adhiniyam 2023, provisions governing electronic and digital records.
Bibliography
Legislation
Digital Personal Data Protection Act 2023.
Digital Personal Data Protection Rules 2025, GSR 846(E), 13 November 2025, as corrected by GSR 892(E), 11 December 2025.
Digital Personal Data Protection (Removal of Difficulties) Order 2026, SO 5458(E).
Information Technology Act 2000.
Bharatiya Sakshya Adhiniyam 2023.
Right to Information Act 2005.
General Data Protection Regulation - Official EU text
Government and regulatory materials
Indian Computer Emergency Response Team, Directions under section 70B(6) of the Information Technology Act 2000 (28 April 2022).
Indian Computer Emergency Response Team, FAQs on Cyber Security Directions of 28 April 2022 (May 2022).
Ministry of Electronics and Information Technology, Gazette notifications GSR 843(E) and GSR 846(E), 13 November 2025.
Cases
Justice K.S. Puttaswamy (Retd.) v Union of India (2017) 10 SCC 1.
Central Public Information Officer, Supreme Court of India v Subhash Chandra Agarwal (2019) 16 SCC 1.