India’s expanding use of facial recognition technology across public spaces lacks a dedicated legal framework, raising concerns over privacy, accuracy, and state surveillance ambitions amid evolving regulations.
Facial recognition has already moved into daily life across India, from airport terminals and office entrances to retail outlets and policing. The result is a technology that can identify people in seconds, often without any visible interaction on their part, while the law governing it still relies on rules drafted for more conventional forms of personal data. The gap matters because facial recognition is not just another database tool: it can be used covertly, at scale and in public spaces, with consequences for privacy, liberty and due process.
India’s Digital Personal Data Protection Act, 2023 treats facial images as personal data and allows processing on ordinary grounds such as consent and stated purpose. But, unlike the older IT rules that treated biometric information as sensitive and subject to extra safeguards, the new law does not create a special category for face data itself. That means the main legal lens is general data protection, not a framework built around the particular risks of biometric surveillance. As the Cyber Blog India article argues, that is a poor fit for a system that can capture a face in public and match it instantly against large databases.
The sharpest concern lies with state use. Section 17 of the Act relaxes many obligations when processing is done for preventing, detecting, investigating or prosecuting offences, and that has left room for police deployments of facial recognition systems across several states. According to the Cyber Blog India analysis, these systems are often used without a dedicated statute or a judicial warrant-like authorisation. Outlook India likewise reports that India has seen widespread deployment in airports, offices, shops and law enforcement, yet still lacks a dedicated legal regime that addresses transparency, storage and sharing of biometric data. The result is a framework that regulates private companies more clearly than it does the state.
That imbalance has become more visible as the technology has been used in sensitive settings. India Today reported in July 2026 on the use of the Ikshana facial recognition van at a protest in Jantar Mantar, Delhi, prompting renewed questions about privacy, oversight and the handling of personal data. The episode underlined a recurring problem: the people scanned may never know it happened, while the law offers little clarity on collection, retention or remedy.
Accuracy is another unresolved issue. Research cited in the supplied material notes that facial recognition can perform unevenly across demographic groups, with higher error rates for women, darker-skinned people and older adults. That matters less in low-stakes settings, such as attendance systems, than in policing, where a false match can lead to wrongful suspicion, detention or worse. The point is not merely that systems can fail, but that their failures are not distributed evenly.
Legal commentators and policy work have therefore converged on a familiar set of safeguards. They include independent authorisation for law-enforcement use, strict limits on real-time identification in public spaces, enforceable retention rules and a clear compensation route for those harmed by error. For businesses, the compliance burden is already substantial: they must secure facial templates, give itemised notice, offer alternatives where needed and, in higher-risk cases, carry out formal impact assessments. But the central problem remains that the state’s own use of facial recognition, arguably the most consequential deployment of all, sits largely outside a law written for ordinary personal data.
India now has facial recognition at scale, but not a statute designed for its distinctive risks. Until Parliament creates one, the law will continue to trail a technology that can watch first and explain itself later.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
