RTI and the Right to Privacy: How the Puttaswamy Judgment Shapes What the Government Can Withhold

There are two ideas at the heart of Indian constitutional democracy that, when brought into contact with each other, produce genuine tension. The first is the right of citizens to know what their government is doing — a right that flows from Article 19(1)(a)'s guarantee of freedom of speech and expression, and that was given statutory form by the Right to Information Act, 2005. The second is the right of individuals to a sphere of personal life that the state — and, in this context, other citizens — cannot peer into: the right to privacy.

These two rights do not always conflict. Most RTI applications ask for information about government decisions, public money, departmental procedures, and official conduct — information that has nothing to do with anyone's private life. But in a meaningful category of cases, the two rights do collide. A citizen files an RTI asking for another individual's medical records held by a government hospital. A journalist files an RTI asking for the financial details of a private person who received a government contract. A litigant files an RTI for the personal correspondence of a third party in the custody of a government department. In these cases, the RTI Act's promise of openness meets another person's legitimate claim to privacy.

Understanding how Indian law currently resolves that tension — particularly after the Supreme Court's transformative 2017 judgment in Justice K.S. Puttaswamy (Retd.) v. Union of India — is essential for any serious RTI applicant. It tells you when to expect a refusal, when to push back against one, and how to frame your request so that it focuses on the publicly accountable dimension of government activity rather than the genuinely private.

The Right to Information: What It Rests On

The RTI Act 2005 gives every Indian citizen the right to request information from public authorities. The constitutional foundation is Article 19(1)(a), which guarantees freedom of speech and expression. Courts have consistently held that the right to receive information is part of free expression — a government that can keep everything secret undermines the very premise of informed democratic participation. The RTI Act operationalises this constitutional principle by creating a specific statutory right with a mandatory response timeline: under Section 7(1) of the RTI Act, a public authority must respond to an RTI application within 30 days (or 48 hours where the information concerns the life or liberty of a person, under the proviso to Section 7(1)).

But the RTI Act has never been a right to all information held by the government. Chapter III of the Act — Section 8 — sets out exemptions. These are categories of information that the government may (and in some cases must) withhold even when a valid RTI application is filed. Understanding the exemptions is as important as understanding the right itself, because a sophisticated RTI applicant frames requests to avoid falling within exemptions rather than simply filing and hoping for the best.

Justice K.S. Puttaswamy (Retd.) v. Union of India (2017): What the Judgment Actually Decided

In August 2017, a nine-judge Constitution Bench of the Supreme Court of India handed down a unanimous judgment in Justice K.S. Puttaswamy (Retd.) v. Union of India. This was one of the most significant constitutional decisions in India's post-independence history, and it is important to understand precisely what it held.

The bench unanimously held that the right to privacy is a fundamental right under Article 21 of the Constitution of India. Article 21 guarantees that no person shall be deprived of their life or personal liberty except according to procedure established by law. The Puttaswamy judgment interpreted "life" and "personal liberty" broadly — consistent with decades of judicial development — to include privacy as an intrinsic, inalienable component of human dignity and personal autonomy.

The judgment overruled two earlier decisions — M.P. Sharma v. Satish Chandra (1954) and Kharak Singh v. State of U.P. (1964) — which had denied or limited the constitutional status of privacy. Nine judges writing nine concurring opinions with nuanced differences in emphasis nonetheless converged on the core holding: privacy is a fundamental right, not a statutory concession.

Critically for RTI applicants, the judgment also held that privacy is not absolute. Like all fundamental rights, the right to privacy can be restricted by the state, but only through a law that satisfies a three-part test:

1. The restriction must have a legal basis — a law must authorise it.
2. The law must pursue a legitimate state aim.
3. The restriction must be proportionate — it must be the minimum infringement necessary to achieve that aim, and the benefit to the public interest must outweigh the harm to privacy.

The third element — proportionality — is the most demanding. It requires that a court or authority genuinely weigh the cost to privacy against the benefit of disclosure, rather than applying a blanket rule in either direction.

The Puttaswamy judgment also specifically recognised informational privacy as a component of the fundamental right. Personal data — information about individuals' health, finances, location, biometric characteristics, personal relationships, and identity — is within the protected sphere. The state's collection, use, and disclosure of personal data about citizens engages constitutional rights, not merely statutory interests.

Section 8(1)(j): The Privacy Exemption That Was Already There

Here is a fact that sometimes surprises people who encounter Puttaswamy in the context of RTI: Parliament had already built a privacy protection into the RTI Act in 2005, twelve years before the Supreme Court recognised privacy as a fundamental right.

Section 8(1)(j) of the RTI Act exempts from mandatory disclosure:

"information which relates to personal information the disclosure of which has no relationship to any public activity or interest, or which would cause unwarranted invasion of the privacy of the individual unless the Central Public Information Officer or the State Public Information Officer or the appellate authority, as the case may be, is satisfied that the larger public interest justifies the disclosure of such information."

This is a carefully constructed provision with two distinct limbs.

The first limb covers personal information that has no relationship to any public activity or interest. If the information has no connection to anything the government is doing in a public capacity — if it is purely about an individual's personal life, held by government by coincidence or necessity rather than because it relates to government's public functions — then it is exempt. Full stop.

The second limb is a qualified exemption: personal information that would cause an "unwarranted invasion of privacy" is exempt unless the larger public interest justifies disclosure. This is a balancing exercise. Privacy can be outweighed by public interest, but the public interest must be real, specific, and substantial — "larger public interest" is not a low threshold.

Before Puttaswamy, Section 8(1)(j) was a statutory privacy protection. After Puttaswamy, it is a statutory privacy protection backed by a constitutional fundamental right. CPIOs, appellate authorities, the CIC, and courts now apply this provision knowing that behind the statutory text stands Article 21 itself.

What Changes After Puttaswamy

The practical effect of Puttaswamy on RTI is not that the right to information disappears or becomes secondary. It is that the balancing exercise demanded by Section 8(1)(j) is now conducted with greater constitutional seriousness on the privacy side of the scale.

Before Puttaswamy, a CPIO or first appellate authority might treat Section 8(1)(j) as one statutory exemption among many — to be applied or waived depending on circumstances. After Puttaswamy, the privacy interest being protected is a fundamental right, which carries a different constitutional weight. When the CIC or a High Court now considers whether the "larger public interest" justifies disclosing genuinely personal information about a private individual, they must take seriously the constitutional dimension of what they are being asked to override.

This matters in several concrete ways:

Requests for private individuals' sensitive personal information receive stronger protection. Medical records held by a government hospital about a patient who never sought any public role, financial information about a private person who has a minor administrative connection to a government file, intimate personal details of a third party held in a government record — these are the clearest cases where Section 8(1)(j) now has constitutional backing. A CPIO who refuses such a request is not just applying a statutory exemption; they are protecting a fundamental right.

The public interest that can override privacy must be concrete and specific. Vague invocations of "transparency" or "public interest" are not sufficient to defeat a genuine privacy claim about a private individual. The interest must be specific: this information, disclosed in this way, would serve this particular public accountability purpose. A general curiosity, even if widespread, does not clear the threshold.

Courts and the CIC apply the proportionality test more rigorously. Even where some public interest exists, the question is whether the specific disclosure is proportionate to that interest — whether it is the minimum necessary, whether less intrusive alternatives exist, whether the benefit outweighs the constitutional harm to privacy.

What Puttaswamy Does NOT Protect

It would be a serious misunderstanding of Puttaswamy — and a misuse of the privacy right — to treat it as a blanket shield for government officials and public institutions against scrutiny.

The Puttaswamy judgment itself was clear: privacy attaches to individuals, and its strength diminishes when individuals act in public roles. A government official, in the exercise of their official functions, cannot claim the same privacy protection that a private citizen has over their personal life. The Supreme Court in Puttaswamy recognised that public figures, and specifically public officials, must accept a higher degree of scrutiny of their public conduct.

This principle maps directly onto RTI practice. The following categories of information remain firmly disclosable even after Puttaswamy:

Salary and service details of public officials. The CIC has consistently held — and courts have affirmed — that a government employee's salary, grade, seniority, appointment process, and service record are information about their official position, not their private life. Their official conduct is public. The salary they draw from public money is public. Their promotion to a particular grade is a public decision. None of this is personal information in the Section 8(1)(j) sense.

Asset declarations made to the government. For classes of officials required to file asset declarations — such as government servants under service rules — those declarations relate to their official position. Where they have been filed with government, they are not exempt as "private information."

Official disciplinary proceedings and misconduct inquiries. A departmental inquiry against a government servant, or the outcome of such an inquiry, relates to their official conduct. It is not private.

Expenditure of public money. Who received a contract, how much was paid, on what terms — this is always public interest information, not private information about the contractor. The contractor's personal medical history or family situation might be private; the amount the contractor received from public funds is not.

Beneficiary lists for public welfare schemes. The names of persons receiving government benefits under a public scheme involve public money and public resources. Section 8(1)(j) does not straightforwardly exempt these lists, particularly where the public interest in detecting fraud and ensuring proper distribution is substantial.

The Category Where Privacy Claims Are Strongest

On the other side of the ledger, there is a genuine category of cases where Section 8(1)(j), as read in light of Puttaswamy, provides — and should provide — real protection.

Medical and health information about private individuals. If a private citizen received treatment at a government hospital, their diagnosis, treatment records, and medical history are deeply personal. They did not seek a public role. The fact that the hospital is government-funded does not turn their private medical information into public information. Unless there is a very specific and substantial public interest — and "I am curious" or "I think this person received preferential treatment" is not sufficient — their medical records are protected.

Financial information of private individuals beyond public transactions. Where a private person has been assessed for tax, or received a subsidy, or is mentioned in a government financial record, the portions of that information that relate to purely private financial affairs — not to the public transaction itself — retain privacy protection.

Biometric and identity data. Aadhaar data, biometric records, unique identifiers linked to individuals — these are at the heart of informational privacy and are among the most sensitive categories of personal data. The Puttaswamy case arose in part from concerns about the Aadhaar scheme. Requests for this kind of data about specific individuals face strong Section 8(1)(j) objections.

Personal correspondence and private communications in government custody. Sometimes private communications end up in government files — letters written to officials, complaint correspondence, personal documents submitted in support of applications. To the extent these contain genuinely private personal information, they are protected.

Information about your own case: the exception to the exception. It is critical to note that if you are asking for information about yourself — your own medical records, your own tax assessment, your own case file — privacy is not a barrier to your own RTI application. The RTI Act gives you the right to your own information. Section 8(1)(j) protects personal information from disclosure to others; it does not prevent you from accessing your own records. If a CPIO denies you your own personal file by citing privacy, that refusal is incorrect.

The Digital Personal Data Protection Act, 2023 and RTI

In August 2023, Parliament enacted the Digital Personal Data Protection Act, 2023 (DPDPA). This legislation creates a comprehensive framework for the protection of digital personal data in India, and it directly intersects with the RTI Act in a significant way.

Section 44(3) of the DPDPA 2023 amends Section 8(1)(j) of the RTI Act. This amendment changes the text of the personal information exemption and affects the scope of what can be withheld under that provision.

The DPDPA amendment is significant, and its full operational effect is still being worked out by courts, the CIC, and practitioners. The intersection of data protection law and RTI law raises complex questions about how personal data requests made through RTI will be handled after the DPDPA framework is fully operational. Citizens filing RTI applications that touch on personal data — their own or others' — should verify the current text of Section 8(1)(j) as amended by the DPDPA, since the pre-amendment text quoted in this post reflects the original RTI Act and may no longer be the operative version.

What is clear is the direction of travel: India now has both a constitutional right to privacy (Puttaswamy, 2017) and a statutory data protection framework (DPDPA, 2023). The RTI Act's personal information exemption sits within this richer legal context. RTI is not being abolished or severely curtailed — the right to access government information about government actions remains strong. But the specific exemption for personal information has been given additional legal texture, and the operational implications will continue to develop as the DPDPA framework is implemented and as courts and the CIC apply it to specific fact situations.

Practical Guidance: Applying This to Your RTI Application

Understanding the Puttaswamy framework and Section 8(1)(j) should shape how you file RTI applications and how you respond to refusals.

If you are asking about your own records: File confidently. Privacy law does not prevent you from accessing your own information. If a CPIO cites Section 8(1)(j) to deny you your own hospital record or your own assessment file, that is a refusal you should challenge in First Appeal. Your right to information about your own case is well-established.

If you are asking about a public official's official conduct: File confidently, but frame the request precisely. Ask about the official's exercise of their official functions — decisions made, files processed, powers exercised, salaries and emoluments drawn. Do not ask about their personal family life, health, or private finances. The more you frame your request as being about the exercise of public power — which is what RTI is for — the stronger your position is against a privacy objection.

If you are asking about a private individual's personal information held by government: Be realistic. Section 8(1)(j), now backed by a constitutional fundamental right and potentially strengthened by the DPDPA, provides real protection here. This is the category where refusals are most likely to be sustained. To have a chance of disclosure, you need to articulate a specific, substantial public interest — and "I think this person did something wrong" or "this is a matter of public curiosity" is not enough. "This person received a government contract worth ₹5 crore and the contract amount and the terms on which it was awarded are public interest information" is a better argument — but even then, you are asking for the public transaction, not the person's private life.

If a CPIO cites Section 8(1)(j) to withhold information about a government decision or public expenditure: Challenge this in First Appeal under Section 19(1) of the RTI Act, which allows you to appeal to the first appellate authority within 30 days of the date of decision or expiry of the 30-day response period, whichever is applicable. A CPIO cannot use privacy as a shield for information about government conduct simply because an individual happens to be named in the record. The question is whether the information is genuinely personal information about the individual's private life, or information about a public matter in which the individual happens to be involved. These are not the same thing.

If the First Appeal fails: File a Second Appeal or complaint with the Central Information Commission (for Central Government bodies) under Section 19(3) of the RTI Act. The CIC has extensive jurisprudence on Section 8(1)(j) and applies the public interest balancing test with considerable care. If a refusal is a misuse of the privacy exemption to protect government from accountability — rather than a genuine protection of an individual's private life — the CIC is the appropriate forum to say so.

The Deeper Point: Privacy and Transparency Are Both Constitutional Values

It would be easy but wrong to frame this as "privacy vs. RTI," with one side winning and the other losing. The more accurate framing is that Indian constitutional law now recognises two fundamental values — transparency in government and privacy for individuals — and requires a thoughtful balance between them.

The Puttaswamy judgment did not undermine the RTI Act. It placed both rights in their proper constitutional context. The right to information is not weakened by acknowledging that individual privacy is also a fundamental right. What both judgments together demand is precision: that RTI be used for what it is actually for — holding government accountable for the exercise of public power — rather than as a tool to pry into the private lives of individuals who happen to appear in government records.

An RTI Act that protected everything would be useless — the government would claim exemptions for all information. An RTI Act that protected nothing would be dangerous — the government could use RTI to expose private citizens' sensitive information under the guise of transparency. The balance that Section 8(1)(j), read in light of Puttaswamy, seeks to achieve is one where government conduct is open and individual privacy is protected. Both values, properly understood, point in the same direction: toward a democracy where power is accountable and people are free.

The tension is real, and individual cases will always require judgment. But the framework for exercising that judgment — proportionality, legitimate aim, minimum necessary infringement, concrete public interest — is now constitutionally grounded in a way it was not before 2017.

If you are filing an RTI application and want to make sure your request is framed to avoid unnecessary privacy objections — or if you have received a Section 8(1)(j) refusal and want to understand whether it is legitimate — RTISathi.com has department-specific guides and sample formats that can help. The right to information is a constitutional right, and understanding its limits is part of using it effectively.