Smart Cities in India: Legal Challenges of AI, Data Protection and Constitutional Governance

Posted On - 14 July, 2026 • By - Dhruv Kaushal

Introduction

Can a city become “smart” without compromising the constitutional rights of its citizens? 

As Indian cities increasingly rely on artificial intelligence, Internet of Things (IoT) devices, facial recognition systems, predictive analytics and integrated command-and-control centres, urban governance is undergoing an unprecedented digital transformation. The Smart Cities Mission has accelerated the deployment of intelligent infrastructure across transport, utilities, policing, waste management and public administration. While these technologies promise efficiency, sustainability and improved citizen services, they also raise difficult legal questions concerning privacy, surveillance, cybersecurity, algorithmic accountability and democratic governance.1

Unlike traditional municipal infrastructure, smart-city ecosystems continuously collect, process and analyse enormous volumes of personal and non-personal data. Every CCTV camera, smart traffic signal, water sensor, environmental monitor and digital citizen portal contributes to a vast data ecosystem whose governance remains legally fragmented. 

With the enactment of the Digital Personal Data Protection Act, 2023 (DPDPA) and the continuing constitutional influence of the Supreme Court’s landmark judgment in Justice K.S. Puttaswamy v. Union of India2, India now possesses the beginnings of a modern digital governance framework. However, several important legal questions remain unanswered. 

India’s Smart Cities Mission: Technology Meets Urban Governance

Launched in 2015, the Smart Cities Mission seeks to transform one hundred cities through technology-enabled governance and improved urban infrastructure. Rather than focusing solely on physical development, the Mission envisages data-driven administration supported by integrated digital platforms. Most Smart Cities now employ technologies such as: 

  • IoT-enabled utility networks  
  • Intelligent traffic management systems  
  • Integrated Command and Control Centres (ICCCs)  
  • CCTV-based public surveillance  
  • Smart electricity and water meters  
  • GIS-based urban planning  
  • AI-assisted municipal services  
  • Citizen grievance platforms  

These systems depend upon continuous collection and processing of digital information, making data governance central to the legality of smart-city administration. 

Constitutional Dimensions of Smart City Governance

Privacy Under Article 21

The most important constitutional constraint governing smart cities is the fundamental right to privacy recognised by the Supreme Court in Justice K.S. Puttaswamy v. Union of India (2017). The Court held that privacy forms an intrinsic part of Article 21 and that any State action involving collection or processing of personal data must satisfy the tests of: 

  • legality,  
  • legitimate State purpose,  
  • necessity,  
  • proportionality, and  
  • procedural safeguards.  

This framework has profound implications for smart-city technologies. 

Large-scale CCTV networks, facial recognition systems, automatic number plate recognition (ANPR), biometric authentication and geo-location tracking all interfere with informational privacy. Their deployment therefore requires statutory authority, clearly defined purposes, safeguards against misuse and independent oversight. 

At present, India does not have a dedicated surveillance statute governing municipal surveillance infrastructure. Consequently, many smart-city projects continue to rely primarily upon executive notifications or administrative approvals, creating uncertainty regarding constitutional compliance. 

Digital Personal Data Protection Act: A New Compliance Framework

The Digital Personal Data Protection Act, 2023 fundamentally changes how smart-city authorities must handle personal data. Unlike earlier IT Rules, the DPDPA creates a comprehensive framework regulating processing of digital personal data by both public and private entities. 

For Smart City Special Purpose Vehicles (SPVs), municipal corporations and technology vendors, this introduces several important compliance obligations: 

  • lawful processing of personal data;  
  • purpose limitation;  
  • data minimisation;  
  • security safeguards;  
  • breach notification;  
  • grievance redress mechanisms; and  
  • accountability for data fiduciaries.  

While certain governmental exemptions exist, public authorities cannot assume unrestricted powers merely because the data is collected for civic administration. The emerging DPDP Rules are likely to play an increasingly important role in defining operational compliance for municipal digital infrastructure. 

Artificial Intelligence and Algorithmic Governance

The legal challenges associated with AI extend beyond privacy and constitutional law. Increasingly, AI-driven digital ecosystems are also raising concerns relating to market dominance, competition and platform governance. As Aniket Ghosh recently observed while discussing competition law challenges in the age of AI and digital platforms, India’s regulatory framework will need to evolve alongside technological innovation to ensure that automated systems remain transparent, accountable and competitive. These considerations are equally relevant to smart-city ecosystems, where AI increasingly influences public services, infrastructure management and civic decision-making.

  • predictive policing;  
  • traffic optimisation;  
  • emergency response;  
  • resource allocation;  
  • waste management;  
  • environmental monitoring; and  
  • public grievance prioritisation.  

However, India presently lacks dedicated legislation regulating AI deployment. 

This raises several constitutional concerns. Automated decision-making may affect equality under Article 14 if algorithms produce discriminatory outcomes. Similarly, opaque AI systems may violate principles of natural justice where citizens are unable to understand or challenge algorithmic decisions affecting public services. 

Internationally, regulators have begun addressing these concerns through legislation such as the European Union’s AI Act, which classifies high-risk AI systems and imposes extensive governance obligations. India’s future AI framework will likely need to incorporate similar principles of transparency, explainability and human oversight. 

Cybersecurity: The Missing Layer of Smart City Regulation

Smart cities are attractive targets for cyberattacks because they integrate critical infrastructure into interconnected digital networks. Compromise of a municipal command centre could simultaneously affect: 

  • electricity distribution;  
  • water supply;  
  • transport management;  
  • emergency services;  
  • public communications; and  
  • healthcare infrastructure.  

Although the Information Technology Act, CERT-In Directions and sectoral cybersecurity guidelines impose certain obligations, India still lacks a comprehensive statutory cybersecurity regime specifically governing municipal digital infrastructure. 

Questions regarding liability also remain unresolved. If a cyberattack originates through a technology vendor, responsibility may potentially arise for: 

  • municipal corporations,  
  • Smart City SPVs,  
  • software vendors,  
  • cloud service providers,  
  • managed service providers, and  
  • infrastructure operators.  

Greater legislative clarity will become increasingly necessary as cities adopt interconnected digital ecosystems. 

Data Governance and Public Accountability

Perhaps the greatest governance challenge concerns ownership and control of urban data. Smart-city ecosystems continuously generate vast quantities of information concerning traffic movement, energy consumption, public behaviour and civic infrastructure. Important legal questions remain unresolved: 

  • Who owns municipal data?  
  • Can such data be commercially licensed?  
  • What safeguards apply to anonymised datasets?  
  • How should public-private partnerships govern data sharing?  
  • What transparency obligations should apply?  

Without clear statutory answers, data governance risks becoming fragmented across multiple agencies and contractual arrangements. 

Lessons from Pune and Bengaluru

Indian cities already demonstrate contrasting governance experiences. 

Pune’s extensive CCTV deployment illustrates the growing tension between surveillance capability and legal safeguards. While technology has strengthened policing and traffic enforcement, concerns continue regarding data retention, independent oversight and citizen remedies. 

By contrast, Bengaluru’s Integrated Command and Control Centre demonstrates how coordinated digital governance can improve public services through integrated traffic management, emergency response and citizen grievance systems. Nevertheless, even successful implementations require robust legal frameworks governing privacy, procurement, vendor accountability and cybersecurity. 

The Road Ahead

India’s Smart Cities programme represents one of the country’s most ambitious digital governance initiatives. However, technological capability must evolve alongside legal accountability. Future reforms are likely to require: 

  • comprehensive surveillance legislation;  
  • statutory AI governance standards;  
  • stronger municipal cybersecurity obligations;  
  • clearer allocation of liability among public authorities and private vendors;  
  • transparent procurement standards;  
  • interoperable data governance frameworks; and  
  • institutional mechanisms ensuring constitutional oversight.  

Conclusion

The success of India’s Smart Cities Mission will ultimately depend not only upon technological innovation but also upon legal legitimacy. Digital infrastructure capable of transforming urban governance must operate within constitutional boundaries that protect privacy, equality, transparency and accountability. 

The Digital Personal Data Protection Act marks an important beginning, but it cannot by itself resolve the broader governance questions surrounding AI, surveillance, cybersecurity and municipal data management. As cities become increasingly data-driven, India’s legal framework must evolve from enabling technology to regulating it responsibly. 

A truly “smart” city is therefore not merely one equipped with sensors and algorithms—it is one governed by the rule of law. 
 

  1. Ministry of Housing and Urban Affairs, Smart Cities Mission Statement and Guidelines (2015), https://mohua.gov.in. ↩︎
  2. Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1; MANU/SC/1044/2017. Constitution of India, arts. 14, 21. ↩︎

Last Updated on 14 July, 2026