RTI Act for Bankers: The Latest Position After the DPDP Amendment
A customer walks into a public sector bank branch and files an application asking for the internal note on why his loan was declined. The clerk is baffled, the manager forwards it upward, and somewhere in the chain a thirty-day clock has already started running. This is the sharp end of the RTI Act, and most bankers meet it without ever having read the statute.
RTI Act - latest update for CAIIB · Watch on YouTube
There is also a live change worth knowing about, because the exemption bankers rely on most - the one covering personal information - was rewritten by a later statute. Study the position as it stands, not as the older textbooks describe it.
Who the Act binds
The Right to Information Act, 2005 applies to public authorities: bodies established by the Constitution, by law made by Parliament or a state legislature, or by a government notification, and bodies owned, controlled or substantially financed by government. Public sector banks fall squarely inside that definition. The Reserve Bank of India is a public authority too.
Private sector banks are not public authorities and do not answer applications directly. That does not put their records permanently out of reach - information held by a regulator about a private bank can, in principle, be sought from the regulator, subject to the exemptions. This distinction is a standard exam question, and the trap is assuming the RTI Act reaches every bank equally.

The timelines that actually matter
| Situation | Time limit |
|---|---|
| Ordinary application | 30 days from receipt by the Public Information Officer |
| Application routed through an Assistant PIO | 35 days |
| Information concerning life or liberty of a person | 48 hours |
| Third-party information - notice to the third party | Within 5 days; decision within 40 days |
| First appeal | Within 30 days of the decision, to the First Appellate Authority |
| Second appeal | Within 90 days, to the Central or State Information Commission |
Missing the deadline is not a paperwork failure. If information is not provided within the period, it must be supplied free of charge, and the Information Commission can impose a penalty on the Public Information Officer personally for unreasonable delay or malafide refusal. That personal liability is the reason banks take designations under the RTI Act seriously.
Section 8 - where refusals live
Not everything is disclosable. Section 8 lists exemptions, and the ones bankers meet most often are commercial confidence, trade secrets and intellectual property; information held in a fiduciary relationship; information that would impede an investigation; and cabinet papers. Section 8(2) carries an override - disclosure may still be directed if the public interest outweighs the protected harm.
The banking application of the fiduciary limb is well settled in practice: a bank holds customer account details in trust, so one customer generally cannot obtain another customer's statements through an application. The commercial confidence limb covers things like internal credit models and negotiated pricing.
The change to the personal information exemption

Section 8(1)(j) of the RTI Act originally exempted personal information having no relationship to public activity or interest, or which would cause an unwarranted invasion of privacy - unless the larger public interest justified disclosure. Section 44(3) of the Digital Personal Data Protection Act, 2023 substituted that clause with a simpler formulation exempting information which relates to personal information.
The practical effect, as the provision reads, is a broader shield for personal data and the loss of the express public-interest override that previously sat inside the clause. The change has been contested publicly and is the subject of litigation, so treat it as the current text of the statute rather than a settled final position, and check the status before relying on it in any real matter.
For an exam, the safe answer states the substitution, names the amending statute and notes the debate. For a branch, the safe course is to route anything touching personal data through the designated officer rather than answering informally at the counter.
What a branch should actually do
Most branches never see an application directly. They receive an internal reference from the designated officer asking for records within a few days, and the delay that gets penalised is usually an internal one. Keep a note of who the Public Information Officer and the First Appellate Authority are for your circle, and treat any such reference as time-critical rather than routine correspondence.
Two habits prevent most trouble. Never answer an application at the counter, however simple it looks, because the reply is a formal act under the RTI Act with appeal consequences. And never destroy a record because a request has arrived. Retention schedules exist independently, and a convenient gap in the file is the one thing an Information Commission will notice.
Making it stick
Legal chapters reward pattern recognition more than reading volume. Learn the six timelines as a block, the Section 8 heads as a list, and the appellate ladder as a sequence - then test yourself until recall is instant. Full-length legal papers on the mock test platform mix these with Banking Regulation Act and negotiable instruments questions the way the real paper does. The CAIIB course sequences the legal module properly, the ABM section pairs well with it for a promotion push, and the study planner keeps the revision honest.
Whatever else you carry away, carry this: the RTI Act is one of the few laws a banker may have to apply on the spot, in front of the applicant, with a clock already running. Knowing the thirty days, the forty-eight hours and the name of your own Public Information Officer is worth more on a Monday morning than any amount of theory.
Frequently asked questions
Does the RTI Act apply to private sector banks?
No. Only public authorities are covered, which includes public sector banks and the Reserve Bank of India. Information about private banks may sometimes be sought from the regulator, subject to the exemptions.
What is the normal time limit for a reply?
Thirty days from receipt by the Public Information Officer, thirty-five if routed through an Assistant PIO, and forty-eight hours where the life or liberty of a person is involved.
What changed in Section 8(1)(j)?
Section 44(3) of the Digital Personal Data Protection Act, 2023 substituted the clause with a wider exemption for information relating to personal information, removing the express larger-public-interest override that previously sat within it. The change is contested and under litigation.
Can a Public Information Officer be penalised personally?
Yes. The Information Commission can impose a penalty on the officer for unreasonable delay or malafide refusal, and information not supplied in time must be provided free of cost.
Quick quiz on this topic
5 exam-style questions from our free test bank — check yourself before you move on.
Practice this topic
Take a free mock test, download chapter PDFs, or watch a video class — all included on iibf.store.