EMERGING TECHNOLOGY COMPLIANCE

A DETAILED LEGAL ANALYSIS WITH SEVEN LANDMARK CASE LAWS, INDIAN LEGISLATION AND INTERNATIONAL REGULATORY FRAMEWORKS

1. INTRODUCTION

Emerging technology refers to newly developed or rapidly advancing technologies that have the potential to transform society, industries, business operations, governance and human life. These technologies include Artificial Intelligence (AI), Machine Learning (ML), Blockchain, Cryptocurrency, Robotics, Internet of Things (IoT), Big Data Analytics, Cloud Computing, Biotechnology, Genetic Engineering, Autonomous Vehicles, Drones, Quantum Computing and Cybersecurity technologies.

The rapid development of emerging technologies has created significant opportunities for economic growth, scientific research, innovation, digital governance and industrial development. Technology has improved communication, healthcare, education, transportation, financial services, business administration and public service delivery.

However, technological advancement also creates serious legal, ethical and regulatory challenges. These include violations of privacy, cybercrime, misuse of personal information, algorithmic discrimination, intellectual property infringement, digital surveillance, identity theft, unauthorised access to computer systems and threats to national security.

Consequently, Emerging Technology Compliance has become an important area of modern law and governance.

Emerging Technology Compliance refers to the process of ensuring that the development, deployment, operation and use of new technologies comply with applicable laws, regulations, government policies, ethical standards, cybersecurity requirements and international obligations.

The main objective of emerging technology compliance is to ensure that technological innovation takes place in a lawful, transparent, accountable, secure and socially responsible manner.

In India, emerging technologies are governed by various legal frameworks, including the Information Technology Act, 2000, Digital Personal Data Protection Act, 2023, Copyright Act, 1957, Patents Act, 1970, Consumer Protection Act, 2019, Bharatiya Nyaya Sanhita, 2023 and other sector-specific legislation.

At the international level, frameworks such as the European Union Artificial Intelligence Act, General Data Protection Regulation, OECD AI Principles and UNESCO Recommendation on the Ethics of Artificial Intelligence provide important standards for responsible technological development.

Therefore, emerging technology compliance is essential for protecting individual rights, ensuring public safety, preventing misuse of technology and promoting sustainable technological innovation.

2. MEANING AND DEFINITION OF EMERGING TECHNOLOGY COMPLIANCE

Emerging Technology Compliance means adherence to the legal, regulatory, ethical, technical and institutional requirements applicable to new and developing technologies.

It involves ensuring that technological systems are designed, developed, tested, marketed and operated in accordance with applicable laws and regulatory standards.

For example:

• An artificial intelligence company must ensure that its technology does not unlawfully discriminate against individuals or misuse personal information.
• A social media platform must comply with applicable intermediary obligations under the Information Technology Act and related rules.
• A drone operator must follow the applicable Drone Rules and aviation safety requirements.
• A biotechnology company must comply with applicable biosafety, environmental and research regulations.
• A company using biometric identification must respect applicable privacy and data protection requirements.
• A manufacturer of connected devices must consider cybersecurity, product safety and consumer protection requirements.

Thus, emerging technology compliance establishes a relationship between technological innovation and legal responsibility.

2.1 Objectives of Emerging Technology Compliance

The major objectives are:

1. Legal compliance: To ensure that technological activities comply with existing laws and regulations.
2. Protection of privacy: To protect individuals against unlawful collection, processing and disclosure of personal information.
3. Cybersecurity: To prevent hacking, cyberattacks, identity theft and unauthorised access.
4. Consumer protection: To protect consumers from unsafe products, misleading advertisements and unfair technological practices.
5. Ethical development: To ensure that emerging technologies are developed and used responsibly.
6. Intellectual property protection: To protect inventions, software, creative works and technological innovations.
7. Accountability: To establish responsibility for harm caused by technological systems.
8. National security: To prevent the misuse of advanced technologies for criminal activities, terrorism and threats to critical infrastructure.
9. International cooperation: To promote common regulatory principles and international standards.
10. Sustainable development: To encourage technological development that benefits society without causing unnecessary harm to the environment or human rights.

3. MAJOR TYPES OF EMERGING TECHNOLOGIES REQUIRING COMPLIANCE

3.1 Artificial Intelligence (AI)

Artificial Intelligence refers to computer systems capable of performing tasks that normally require human intelligence, such as learning, reasoning, decision-making, language processing and problem-solving.

Examples include ChatGPT, facial recognition systems, automated recruitment systems, medical diagnostic software and autonomous vehicles.

AI technology creates several compliance challenges:

• Algorithmic discrimination.
• Lack of transparency.
• Inaccurate automated decisions.
• Misuse of personal information.
• Deepfake creation.
• Copyright infringement.
• Unauthorised surveillance.
• Unclear allocation of legal responsibility.

For example, an organisation using AI for recruitment must ensure that its system does not unlawfully discriminate against candidates on the basis of protected characteristics.

Similarly, an AI-based healthcare system should be tested for accuracy, safety and reliability.

Compliance requirements include data protection, transparency, risk assessment, cybersecurity, human oversight and accountability.

3.2 Blockchain Technology

Blockchain is a distributed digital ledger technology in which information is recorded across multiple computers or network participants.

It is used in digital transactions, supply chain management, identity verification, smart contracts and digital asset systems.

The major compliance issues include:

• Legal recognition of electronic transactions.
• Data privacy.
• Intellectual property.
• Cybersecurity.
• Fraud prevention.
• Jurisdictional disputes.
• Smart contract enforceability.
• Regulatory treatment of digital assets.

Blockchain systems may create privacy challenges because certain transaction information can remain accessible for long periods.

Organisations using blockchain must ensure compliance with applicable data protection, cybersecurity, contractual and sector-specific regulations.

3.3 Internet of Things (IoT)

The Internet of Things refers to interconnected physical devices that collect and exchange data through the internet.

Examples include smart watches, connected vehicles, industrial sensors, smart home appliances and medical monitoring devices.

IoT compliance concerns include:

1. Protection of personal data.
2. Secure device authentication.
3. Prevention of unauthorised access.
4. Protection against cyberattacks.
5. Consumer safety.
6. Secure software updates.
7. Responsible handling of location information.

For example, a smart home device that continuously collects audio or location information must operate with appropriate privacy and security safeguards.

3.4 Robotics and Autonomous Systems

Robotics involves the development and use of machines capable of performing physical tasks.

Autonomous systems can operate with limited human intervention.

They are increasingly used in manufacturing, healthcare, transportation, defence and logistics.

Major compliance issues include:

• Product safety.
• Physical injury and negligence.
• Machine accountability.
• Employment and labour law.
• Cybersecurity.
• Environmental safety.
• Human supervision.

For example, if an industrial robot causes injury because of a defective safety mechanism, questions of product liability, negligence and workplace safety may arise.

3.5 Biotechnology and Genetic Engineering

Biotechnology involves the application of biological processes and scientific techniques to develop products and improve human, animal and plant life.

Examples include genetic engineering, gene editing, genetically modified organisms, stem cell research and biotechnology-based medicines.

Compliance issues include:

• Biosafety.
• Human health protection.
• Environmental protection.
• Ethical research.
• Informed consent.
• Genetic privacy.
• Laboratory safety.
• Regulation of genetically modified organisms.

In India, biotechnology activities are governed by applicable environmental, biological diversity, pharmaceutical and biosafety legislation.

3.6 Big Data Analytics

Big Data refers to extremely large and complex datasets that are analysed to identify patterns, trends and relationships.

It is used in healthcare, banking, insurance, marketing, government administration and scientific research.

Compliance concerns include data minimisation, lawful processing, privacy, security, accuracy and prevention of discriminatory profiling.

3.7 Cloud Computing

Cloud computing allows organisations to store, manage and process data through remote computing infrastructure.

It provides flexibility and reduces infrastructure costs.

However, cloud computing creates legal concerns involving:

• Data security.
• Cross-border data transfers.
• Outsourcing arrangements.
• Contractual responsibility.
• Data retention.
• Business continuity.
• Cybersecurity incidents.
• Regulatory access to records.

3.8 Drone Technology

Drones are unmanned aircraft systems used for photography, agriculture, surveillance, delivery, mapping, research and industrial inspection.

Drone technology creates compliance issues relating to aviation safety, privacy, airspace restrictions, national security and unauthorised surveillance.

In India, drone operations are primarily governed by the Drone Rules, 2021, as amended and supplemented by applicable directions.

3.9 Quantum Computing

Quantum computing uses principles of quantum mechanics to perform certain computational tasks.

It has potential applications in scientific research, cryptography, medicine and advanced computing.

However, it creates significant cybersecurity concerns because sufficiently powerful quantum computers could threaten some existing cryptographic systems.

Organisations must consider future encryption risks, data security and the development of quantum-resistant cryptographic systems.

4. IMPORTANCE OF EMERGING TECHNOLOGY COMPLIANCE

Emerging technology compliance is important for several reasons.

4.1 Protection of Fundamental Rights

Technology can affect fundamental rights, particularly privacy, freedom of speech, equality and personal liberty.

Compliance ensures that technological systems do not operate in violation of constitutional protections.

4.2 Prevention of Cybercrime

Advanced technologies can be misused for phishing, ransomware attacks, identity theft, online fraud and digital impersonation.

Cybersecurity compliance helps prevent these activities.

4.3 Protection of Personal Data

Technology companies collect and process large amounts of personal information.

Data protection compliance helps prevent unlawful disclosure, unauthorised processing and misuse of information.

4.4 Consumer Safety

Emerging technologies may expose consumers to unsafe products, defective devices and misleading digital services.

Compliance promotes product safety, transparency and consumer protection.

4.5 Promotion of Innovation

A clear legal framework provides certainty to businesses, researchers, investors and technology developers.

It encourages innovation while reducing legal risks.

4.6 Intellectual Property Protection

Technological innovation depends on the protection of inventions, software, artistic works, trademarks and confidential information.

Intellectual property compliance protects the interests of innovators and creators.

4.7 Accountability and Transparency

Compliance ensures that organisations remain responsible for their technological decisions and the consequences of their systems.

5. INDIAN LEGAL FRAMEWORK GOVERNING EMERGING TECHNOLOGIES

India does not have one comprehensive legislation regulating every emerging technology. Instead, different statutes and regulatory frameworks govern specific technological activities.

The following are the major Indian laws.

5.1 Constitution of India, 1950

The Constitution of India provides the fundamental legal foundation for regulating emerging technologies.

Important constitutional provisions include:

Article 14 – Right to Equality

It guarantees equality before the law and equal protection of the laws.

It is relevant to AI-based decision-making because automated systems must not result in arbitrary or unlawful discrimination by the State.

Article 19(1)(a) – Freedom of Speech and Expression

It protects freedom of speech and expression, including expression through digital platforms.

Article 19(2) permits reasonable restrictions on this freedom on specified constitutional grounds.

Article 21 – Right to Life and Personal Liberty

It protects life and personal liberty and has been interpreted to include the right to privacy.

Article 32 – Constitutional Remedies

It allows individuals to approach the Supreme Court for enforcement of fundamental rights.

These constitutional provisions establish important safeguards for technology governance.

5.2 Information Technology Act, 2000

The Information Technology Act, 2000 is the principal legislation governing electronic records, electronic signatures, cyber offences and intermediary liability in India.

It provides legal recognition to electronic transactions and establishes legal consequences for certain unlawful activities involving computer systems.

Important provisions include:

Section 3: Authentication of electronic records through digital signatures.

Section 3A: Electronic signatures.

Section 4: Legal recognition of electronic records.

Section 5: Legal recognition of electronic signatures.

Section 10A: Validity of contracts formed through electronic means.

Section 43: Compensation for specified unauthorised acts involving computer systems.

Section 65: Tampering with computer source documents.

Section 66: Computer-related offences.

Section 66C: Identity theft.

Section 66D: Cheating by personation using computer resources.

Section 66E: Violation of privacy.

Section 67: Publishing or transmitting obscene material in electronic form.

Section 69: Powers concerning interception, monitoring or decryption, subject to statutory conditions.

Section 69A: Power to issue directions for blocking public access to information through computer resources, subject to statutory requirements.

Section 70: Protected systems.

Section 70A: National nodal agency for protection of critical information infrastructure.

Section 70B: Indian Computer Emergency Response Team (CERT-In).

Section 72: Breach of confidentiality and privacy.

Section 79: Conditional exemption from liability for intermediaries.

The Act is relevant to AI platforms, social media, e-commerce, cloud services, digital communication and cybersecurity.

5.3 Digital Personal Data Protection Act, 2023

The Digital Personal Data Protection Act, 2023 establishes a framework for the processing of digital personal data in India.

It is particularly important for AI systems, social media platforms, IoT devices, cloud computing services and digital businesses.

The Act addresses:

• Lawful processing of personal data.
• Consent and other recognised grounds for processing.
• Notice requirements.
• Obligations of Data Fiduciaries.
• Rights of Data Principals.
• Security safeguards.
• Personal data breach obligations.
• Significant Data Fiduciaries.
• Penalties for non-compliance.

The Digital Personal Data Protection Rules, 2025 were notified on 14 November 2025.

The Act and Rules have a phased commencement structure. Therefore, organisations must determine which provisions are in force on the relevant date rather than assuming that every substantive obligation commenced simultaneously.

The legislation is important because emerging technologies frequently depend on personal data for their functioning.

5.4 Copyright Act, 1957

The Copyright Act, 1957 protects original literary, dramatic, musical and artistic works, cinematograph films and sound recordings.

It is relevant to emerging technologies because AI systems, software applications and digital platforms may involve the creation, reproduction, distribution and modification of copyrighted material.

Important provisions include:

• Section 13: Works in which copyright subsists.
• Section 14: Meaning of copyright.
• Section 17: First ownership of copyright.
• Section 51: Infringement of copyright.
• Section 52: Certain acts not constituting infringement.

AI-generated works create difficult questions concerning authorship, ownership, training datasets and reproduction of protected material.

Indian copyright law does not yet provide a complete, technology-specific solution to every question arising from generative AI.

5.5 Patents Act, 1970

The Patents Act, 1970 regulates the grant and protection of patents in India.

It is important for emerging technologies involving inventions, scientific discoveries, engineering developments and technological processes.

Important provisions include:

Section 2(1)(j): Definition of invention.

Section 3: Inventions that are not patentable.

Section 3(k): Excludes mathematical methods, business methods, computer programmes per se and algorithms from patentability.

Section 6: Persons entitled to apply for patents.

Section 48: Rights of patentees.

The Act plays an important role in protecting technological inventions while maintaining statutory limits on patentability.

5.6 Consumer Protection Act, 2019

The Consumer Protection Act, 2019 protects consumers against unfair trade practices, misleading advertisements and defective goods or deficient services.

It is relevant to artificial intelligence products, connected devices, online platforms and digital services.

The Act also establishes a framework for product liability.

Manufacturers, service providers and sellers may face liability where statutory conditions concerning defective products or deficient services are satisfied.

5.7 Bharatiya Nyaya Sanhita, 2023

The Bharatiya Nyaya Sanhita, 2023 replaced the Indian Penal Code, 1860 with effect from 1 July 2024.

Its provisions may apply to technology-related criminal conduct, including cheating, forgery, criminal intimidation, fraud and other offences involving digital systems.

For example, technology-enabled impersonation and fraudulent communications may attract relevant criminal provisions depending on the facts.

5.8 Bharatiya Sakshya Adhiniyam, 2023

The Bharatiya Sakshya Adhiniyam, 2023 governs the admissibility and proof of evidence in judicial proceedings.

It replaced the Indian Evidence Act, 1872 with effect from 1 July 2024.

Sections 61 to 63 are particularly relevant to electronic and digital records.

The legislation is important for disputes involving:

• Emails.
• Digital contracts.
• CCTV recordings.
• Computer-generated records.
• Electronic communications.
• Social media records.
• Digital photographs.
• Server logs.

Organisations must preserve electronic records in a reliable and legally admissible manner.

5.9 Consumer Protection (E-Commerce) Rules, 2020

These Rules regulate relevant e-commerce activities and impose obligations on covered e-commerce entities.

They address transparency, grievance redressal, disclosures and consumer protection.

They are relevant to digital marketplaces, online service providers and technology-based businesses.

5.10 Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021

These Rules establish due diligence obligations for intermediaries and prescribe additional requirements for certain categories of intermediaries and digital media publishers.

Important compliance areas include:

• Publication of rules and privacy policies.
• Grievance redressal.
• Due diligence.
• Cooperation with lawful government directions.
• Compliance with applicable takedown requirements.
• Additional obligations for significant social media intermediaries.

The Rules have been amended from time to time and must be read in their currently applicable form.

5.11 CERT-In Directions, 2022

CERT-In issued directions under Section 70B of the Information Technology Act in April 2022.

These directions address important cybersecurity requirements.

They include obligations concerning:

• Reporting specified cyber incidents within the prescribed time.
• Maintenance of specified ICT system logs.
• Time synchronisation.
• Designation of a point of contact.
• Retention of specified records by covered service providers, data centres, virtual private server providers, cloud service providers and virtual private network service providers.

These requirements are particularly important for technology companies and digital service providers.

5.12 Digital India and AI Governance Framework

India has been developing policy and governance approaches for responsible artificial intelligence.

The India AI Governance Guidelines, 2025 provide policy guidance on responsible AI development and deployment.

They emphasise accountability, safety, transparency, fairness, risk mitigation and responsible innovation.

These guidelines should be distinguished from a comprehensive AI-specific Act. India does not have a single comprehensive statute regulating all artificial intelligence activities.

Existing laws, including the IT Act, DPDP Act, Copyright Act, Consumer Protection Act and applicable sectoral regulations, may apply to AI-related activities depending on the circumstances.

5.13 Drone Rules, 2021

The Drone Rules, 2021 establish the regulatory framework for unmanned aircraft systems in India.

They address matters including:

• Drone registration and identification.
• Classification of drones.
• Operational requirements.
• Airspace restrictions.
• Safety requirements.
• Permissions and regulatory compliance.

The rules are relevant to commercial, agricultural, industrial and research-related drone activities.

5.14 Telecommunications Act, 2023

The Telecommunications Act, 2023 establishes a modern legal framework for telecommunications services and networks in India.

It is relevant to 5G, communication infrastructure, connected devices, network security and digital connectivity.

The Act contains provisions relating to authorisation, spectrum, right of way, interception and search, suspension of telecommunications services and other regulatory matters, subject to statutory conditions.

6. SEVEN LANDMARK INDIAN JUDICIAL DECISIONS RELATING TO EMERGING TECHNOLOGY COMPLIANCE

Indian courts have played an important role in developing legal principles concerning digital privacy, internet freedom, cybersecurity, electronic evidence and the regulation of technological platforms.

The following seven judicial decisions are particularly relevant.

CASE LAW 1: JUSTICE K.S. PUTTASWAMY (RETD.) V. UNION OF INDIA (2017)

Citation: (2017) 10 SCC 1.

Court: Supreme Court of India.

Date of Judgment: 24 August 2017.

Facts of the Case

The case concerned the constitutional validity of the Aadhaar identification framework and whether the right to privacy was protected as a fundamental right under the Constitution of India.

The petitioners raised concerns about the collection and use of personal information, including biometric data, by the State.

Legal Issues

1. Whether the right to privacy is a fundamental right.
2. Whether informational privacy is protected under the Constitution.
3. Whether the State can collect and process personal information without constitutional safeguards.

Judgment

The Supreme Court unanimously recognised the right to privacy as a fundamental right protected under Article 21 and other freedoms guaranteed by Part III of the Constitution.

The Court recognised that privacy includes informational privacy and the individual's ability to exercise control over personal information.

Relevance to Emerging Technology Compliance

This judgment is one of the most important decisions in Indian technology law.

Modern technologies such as AI, facial recognition, biometric identification, digital surveillance and Big Data depend heavily on personal information.

The judgment establishes that technological advancement cannot be used as a justification for disregarding fundamental privacy rights.

Technology companies and public authorities must ensure that the collection and processing of personal information respect constitutional protections.

Legal Principle

The right to privacy is a fundamental right, and technological systems involving personal data must operate consistently with constitutional safeguards.

CASE LAW 2: SHREYA SINGHAL V. UNION OF INDIA (2015)

Citation: (2015) 5 SCC 1.

Court: Supreme Court of India.

Date of Judgment: 24 March 2015.

Facts of the Case

The case involved a constitutional challenge to Section 66A of the Information Technology Act, 2000.

Section 66A criminalised certain categories of online communications.

The petitioners argued that the provision was vague, arbitrary and violated freedom of speech and expression under Article 19(1)(a).

The case also considered the legal responsibilities of intermediaries under Section 79 of the IT Act.

Legal Issues

1. Whether Section 66A violated freedom of speech and expression.
2. Whether vague restrictions on online communication were constitutionally valid.
3. What obligations applied to intermediaries concerning unlawful online content.

Judgment

The Supreme Court struck down Section 66A of the Information Technology Act as unconstitutional.

The Court held that the provision was vague and had a chilling effect on freedom of expression.

The Court also interpreted intermediary liability under Section 79 in the context of legally valid court orders and appropriate government notifications.

Relevance to Emerging Technology Compliance

The decision is important for social media platforms, digital communication companies, AI-powered content platforms and online intermediaries.

It demonstrates that technology regulation must respect constitutional freedoms.

Government authorities and technology companies must ensure that content moderation and regulatory restrictions comply with applicable law.

Legal Principle

Restrictions on online expression must satisfy constitutional requirements. Digital technology cannot be regulated through vague and arbitrary legal provisions.

CASE LAW 3: ANURADHA BHASIN V. UNION OF INDIA (2020)

Citation: (2020) 3 SCC 637.

Court: Supreme Court of India.

Date of Judgment: 10 January 2020.

Facts of the Case

The case arose from restrictions imposed on internet services and communication facilities in Jammu and Kashmir following the constitutional changes in August 2019.

The petitioner challenged the restrictions and argued that they affected freedom of speech, expression and the ability to conduct professional activities.

Legal Issues

1. Whether freedom of speech and expression through the internet is protected under Article 19(1)(a).
2. Whether the right to carry on trade and profession through the internet is constitutionally protected under Article 19(1)(g).
3. Whether indefinite internet shutdowns are legally permissible.
4. Whether internet restrictions must satisfy proportionality and procedural safeguards.

Judgment

The Supreme Court recognised that freedom of speech and expression through the internet is protected under Article 19(1)(a).

It also recognised that the freedom to carry on trade and profession through the internet is protected under Article 19(1)(g).

The Court held that indefinite suspension of internet services is impermissible and that suspension orders must be temporary, proportionate and subject to judicial review.

The Court directed publication of relevant suspension orders to facilitate legal challenges.

Relevance to Emerging Technology Compliance

The judgment is significant for digital governance, telecommunications, online businesses and internet-based public services.

It establishes that internet access and digital communication are closely connected with constitutional freedoms.

Authorities must ensure that restrictions on digital infrastructure are legally justified and proportionate.

Legal Principle

Internet-based expression and professional activity receive constitutional protection, and restrictions on internet services must satisfy legal and proportionality requirements.

CASE LAW 4: INTERNET AND MOBILE ASSOCIATION OF INDIA V. RESERVE BANK OF INDIA (2020)

Citation: 2020 SCC OnLine SC 275; AIR 2021 SC 2720.

Court: Supreme Court of India.

Date of Judgment: 4 March 2020.

Facts of the Case

The Reserve Bank of India issued a circular in April 2018 directing entities regulated by it not to deal with or provide banking services to individuals or businesses dealing in virtual currencies.

The circular affected cryptocurrency exchanges and other businesses operating in the virtual currency sector.

The Internet and Mobile Association of India challenged the circular before the Supreme Court.

Legal Issues

1. Whether the RBI had authority to regulate activities involving virtual currencies.
2. Whether the circular was proportionate.
3. Whether restricting banking access to cryptocurrency businesses violated constitutional rights.
4. Whether the restriction was justified by the risks to regulated entities.

Judgment

The Supreme Court recognised the broad regulatory powers of the RBI over activities falling within its statutory jurisdiction.

However, it set aside the 2018 circular on the ground of proportionality.

The Court considered that the restriction imposed was not adequately supported by the evidence of the adverse impact on regulated entities.

Relevance to Emerging Technology Compliance

This case is highly relevant to cryptocurrency, blockchain and digital asset businesses.

It establishes that regulators can exercise their statutory powers over emerging technologies but must act within constitutional limits.

It also demonstrates the importance of balancing innovation with financial stability and public interest.

The decision did not declare cryptocurrency to be legal tender or provide a general licence for cryptocurrency businesses.

Legal Principle

Regulatory restrictions on emerging technologies must be supported by statutory authority and must satisfy constitutional proportionality requirements.

CASE LAW 5: ANVAR P.V. V. P.K. BASHEER (2014)

Citation: (2014) 10 SCC 473.

Court: Supreme Court of India.

Date of Judgment: 18 September 2014.

Facts of the Case

The dispute concerned the admissibility of electronic records in election proceedings.

The parties sought to rely on electronic material, including compact discs and recorded information.

The Supreme Court considered the requirements of Section 65B of the Indian Evidence Act, 1872.

Legal Issues

1. Whether electronic records could be admitted without compliance with Section 65B.
2. Whether ordinary secondary evidence provisions could replace the special requirements for electronic records.
3. Whether a statutory certificate was required for computer-generated electronic evidence.

Judgment

The Supreme Court held that Section 65B provided a special legal procedure for admitting electronic records produced through computer output.

It emphasised compliance with the statutory certificate requirement under Section 65B(4), where applicable.

Relevance to Emerging Technology Compliance

The decision is important for organisations that generate and preserve digital records.

For example:

• AI-generated reports.
• Electronic contracts.
• Digital photographs.
• Computer logs.
• Emails.
• Online communications.
• CCTV footage.
• Electronic business records.

Organisations must ensure that digital records are properly preserved and can satisfy applicable evidentiary requirements.

The Bharatiya Sakshya Adhiniyam, 2023 now governs electronic evidence in proceedings to which it applies.

Legal Principle

Electronic records must comply with applicable statutory requirements concerning authenticity and admissibility.

CASE LAW 6: ARJUN PANDITRAO KHOTKAR V. KAILASH KUSHANRAO GORANTYAL (2020)

Citation: (2020) 7 SCC 1.

Court: Supreme Court of India.

Date of Judgment: 14 July 2020.

Facts of the Case

The case concerned the admissibility of electronic records in an election dispute.

The parties relied upon video recordings and other electronic material.

The principal issue was the requirement of a certificate under Section 65B(4) of the Indian Evidence Act, 1872.

Legal Issues

1. Whether a certificate under Section 65B was mandatory for computer-generated electronic records.
2. Whether oral evidence could substitute for the certificate.
3. What procedure could be followed where the relevant electronic device was not under the control of the party producing the evidence.

Judgment

The Supreme Court reaffirmed that the requirements of Section 65B were mandatory for computer-output electronic records.

It explained the circumstances in which the certificate must be produced and the procedure available when the relevant device is controlled by another person.

The Court also clarified the earlier legal position concerning the certificate requirement.

Relevance to Emerging Technology Compliance

This judgment is important for digital evidence management and technological record-keeping.

Organisations using AI, cloud computing, IoT, digital communication systems and electronic databases must maintain reliable records.

Such records may become important in litigation, regulatory investigations and criminal proceedings.

The present evidentiary framework is governed by the Bharatiya Sakshya Adhiniyam, 2023, which must be applied to current proceedings.

Legal Principle

Digital records must be preserved, authenticated and produced in accordance with the applicable statutory requirements for electronic evidence.

CASE LAW 7: FAHEEMA SHIRIN R.K. V. STATE OF KERALA (2019)

Citation: 2019 SCC OnLine Ker 2976.

Court: Kerala High Court.

Date of Judgment: 19 September 2019.

Facts of the Case

The case involved a student who challenged restrictions imposed by her educational institution concerning the use of mobile phones in the hostel.

The petitioner argued that the restrictions affected her access to the internet and educational resources.

The matter raised questions concerning privacy, education and access to digital technology.

Legal Issues

1. Whether access to the internet is connected with fundamental rights.
2. Whether restrictions on internet access can affect the right to education.
3. Whether unreasonable restrictions on students' use of digital technology are legally sustainable.

Judgment

The Kerala High Court recognised the importance of internet access in modern education.

The Court observed that the right to access the internet is closely connected with the right to education and the right to privacy.

It held that unreasonable restrictions imposed by the institution were not justified in the circumstances.

Relevance to Emerging Technology Compliance

This judgment is relevant to digital education, online learning platforms, educational technology and access to information.

It demonstrates that technological development must be accompanied by policies that protect individual rights and facilitate access to educational opportunities.

Educational institutions and technology providers should ensure that digital policies are reasonable, proportionate and consistent with applicable legal protections.

Legal Principle

Access to digital technology and the internet is closely connected with education, privacy and the effective enjoyment of constitutional rights.

7. INTERNATIONAL REGULATORY FRAMEWORK GOVERNING EMERGING TECHNOLOGIES

Emerging technologies operate across international borders. Therefore, technology companies may be subject to several foreign regulatory frameworks depending on their operations and the individuals whose data they process.

The following international laws and frameworks are particularly important.

7.1 GENERAL DATA PROTECTION REGULATION (GDPR), EUROPEAN UNION

The General Data Protection Regulation (GDPR), Regulation (EU) 2016/679, establishes a comprehensive framework for protecting personal data in the European Union.

It became applicable on 25 May 2018.

The GDPR applies to relevant organisations established within the EU and may also apply to certain organisations outside the EU that offer goods or services to individuals in the EU or monitor their behaviour.

Major principles include:

1. Lawfulness, fairness and transparency.
2. Purpose limitation.
3. Data minimisation.
4. Accuracy.
5. Storage limitation.
6. Integrity and confidentiality.
7. Accountability.

The GDPR provides rights concerning access, rectification, erasure, restriction of processing and data portability, subject to statutory conditions.

Importance for Emerging Technology:

AI companies, cloud computing providers, social media platforms and IoT businesses processing personal data within its scope must comply with the GDPR.

7.2 EUROPEAN UNION ARTIFICIAL INTELLIGENCE ACT

The European Union Artificial Intelligence Act, Regulation (EU) 2024/1689, establishes a harmonised regulatory framework for artificial intelligence.

It entered into force on 1 August 2024 and has a phased implementation structure.

The legislation adopts a risk-based approach to AI regulation.

It broadly classifies AI applications according to their level of risk.

Main Categories

1. Unacceptable Risk

Certain AI practices that threaten fundamental rights and safety are prohibited, subject to the specific statutory provisions and exceptions.

2. High Risk

High-risk AI systems are subject to stricter requirements relating to risk management, data governance, documentation, transparency, human oversight and accuracy.

3. Limited Risk

Certain AI applications are subject to transparency requirements, including obligations concerning interaction with AI systems and certain AI-generated content.

4. Minimal Risk

Many low-risk AI applications are not subject to the same extensive mandatory requirements.

The Act also establishes obligations for certain general-purpose AI models.

Importance:

The EU AI Act is particularly significant for AI developers, providers, deployers and businesses operating in or accessing the EU market.

It promotes safe, transparent and accountable artificial intelligence.

7.3 UNESCO RECOMMENDATION ON THE ETHICS OF ARTIFICIAL INTELLIGENCE, 2021

UNESCO adopted the Recommendation on the Ethics of Artificial Intelligence in November 2021.

It provides an international ethical framework for responsible AI development.

Its major principles include:

• Human rights and dignity.
• Fairness and non-discrimination.
• Transparency.
• Accountability.
• Human oversight.
• Environmental sustainability.
• Privacy and data protection.
• Inclusion and diversity.

Importance:

The Recommendation encourages governments, researchers and technology companies to develop AI systems that respect human rights and ethical standards.

It is an international normative framework rather than a directly enforceable treaty.

7.4 OECD AI PRINCIPLES

The Organisation for Economic Co-operation and Development adopted its AI Principles in 2019 and updated them in 2024.

These principles promote trustworthy AI systems that respect human rights and democratic values.

Important principles include:

1. Inclusive growth and sustainable development.
2. Human rights and democratic values.
3. Transparency and explainability.
4. Robustness, security and safety.
5. Accountability.

Importance:

The OECD principles guide governments and businesses in developing responsible AI governance systems.

7.5 NIS2 DIRECTIVE, EUROPEAN UNION

The Network and Information Security Directive 2, Directive (EU) 2022/2555, establishes cybersecurity obligations for covered entities in important and essential sectors.

It addresses:

• Cybersecurity risk management.
• Incident reporting.
• Supply chain security.
• Business continuity.
• Management accountability.
• Supervisory and enforcement measures.

Importance:

NIS2 is relevant to organisations providing essential and important services that fall within its scope, including certain digital infrastructure and technology service providers.

7.6 DIGITAL OPERATIONAL RESILIENCE ACT (DORA), EUROPEAN UNION

The Digital Operational Resilience Act, Regulation (EU) 2022/2554, became applicable on 17 January 2025.

It establishes requirements for digital operational resilience in the financial sector.

It covers:

• ICT risk management.
• Cyber incident reporting.
• Digital operational resilience testing.
• Third-party ICT risk.
• Information sharing.
• Business continuity and recovery.

Importance:

DORA is relevant to covered financial entities using cloud computing, AI, digital platforms and other technological infrastructure.

7.7 CALIFORNIA CONSUMER PRIVACY ACT (CCPA), UNITED STATES

The California Consumer Privacy Act, 2018, as amended by the California Privacy Rights Act, establishes privacy rights for consumers in California and obligations for covered businesses.

It provides rights concerning:

• Access to personal information.
• Deletion.
• Correction.
• Opt-out of certain sales or sharing.
• Limiting certain uses of sensitive personal information.
• Protection against unlawful discrimination for exercising privacy rights.

Importance:

Technology companies processing personal information of California residents may be subject to the legislation if the statutory applicability requirements are met.

7.8 NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY (NIST) AI RISK MANAGEMENT FRAMEWORK, UNITED STATES

The NIST AI Risk Management Framework provides guidance for managing risks associated with artificial intelligence.

It focuses on four principal functions:

1. Govern.
2. Map.
3. Measure.
4. Manage.

The framework encourages organisations to identify AI-related risks, assess their impact and establish appropriate risk management systems.

Importance:

It provides a practical approach for organisations seeking to improve AI governance, accountability and reliability.

It is a voluntary framework unless incorporated into binding requirements through applicable contracts or regulations.

7.9 COUNCIL OF EUROPE FRAMEWORK CONVENTION ON ARTIFICIAL INTELLIGENCE

The Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law was adopted in 2024.

It is an international treaty framework addressing the implications of AI for human rights, democracy and the rule of law.

It seeks to ensure that AI activities are consistent with fundamental rights and democratic principles.

Its binding obligations apply to parties according to the Convention's terms and their respective implementation arrangements.

7.10 WIPO AND INTERNATIONAL INTELLECTUAL PROPERTY FRAMEWORKS

The World Intellectual Property Organization (WIPO) promotes international cooperation in intellectual property protection.

Its work is important for emerging technologies involving:

• AI-generated content.
• Software.
• Patents.
• Digital copyright.
• Technological inventions.
• Industrial designs.
• Trade secrets.

International intellectual property instruments, including the Berne Convention and the TRIPS Agreement, provide important legal foundations for protecting intellectual property across jurisdictions.

8. COMPARISON BETWEEN INDIAN AND INTERNATIONAL EMERGING TECHNOLOGY REGULATIONS

The comparison demonstrates that emerging technology compliance requires a combination of domestic legal compliance and international regulatory awareness.

9. MAJOR CHALLENGES IN EMERGING TECHNOLOGY COMPLIANCE

9.1 Rapid Technological Development

Technology develops much faster than traditional legislative processes.

Artificial intelligence, quantum computing and blockchain create new legal questions that existing laws may not fully address.

9.2 Lack of Comprehensive Legislation

India does not have a single comprehensive statute governing all emerging technologies.

Different technologies are regulated under different laws, resulting in regulatory complexity.

9.3 Data Privacy and Security

Technology companies collect significant amounts of personal and sensitive information.

Data breaches and unlawful processing may affect individuals and create legal liability.

9.4 Artificial Intelligence Bias

AI systems may produce discriminatory results because of biased training data or defective algorithms.

This creates concerns regarding equality, transparency and accountability.

9.5 Cybersecurity Threats

Hacking, ransomware, malware, phishing and unauthorised access remain significant threats to digital infrastructure.

9.6 Cross-Border Jurisdiction

Technology companies frequently operate across multiple countries.

Determining which country's laws apply to a particular activity can become complicated.

9.7 Intellectual Property Issues

Generative AI raises questions concerning the ownership of AI-generated works and the use of copyrighted material in training datasets.

9.8 Ethical Challenges

Emerging technologies may affect human dignity, autonomy, privacy, employment and social equality.

9.9 Regulatory Costs

Small businesses and startups may face difficulties in maintaining compliance teams, conducting audits and implementing expensive cybersecurity measures.

9.10 Lack of Technical Expertise

Regulatory authorities may face difficulties in assessing complex technologies due to a shortage of specialised technical expertise.

10. ROLE OF REGULATORY AUTHORITIES IN INDIA

Several Indian authorities are responsible for regulating different aspects of emerging technologies.

1. Ministry of Electronics and Information Technology (MeitY)

Responsible for important areas of digital governance, information technology policy and data protection.

2. Indian Computer Emergency Response Team (CERT-In)

Responsible for cybersecurity incident response and related functions under the IT Act.

3. National Critical Information Infrastructure Protection Centre (NCIIPC)

Responsible for protecting critical information infrastructure.

4. Telecom Regulatory Authority of India (TRAI)

Regulates relevant telecommunications activities and advises the Government on telecom-related matters.

5. Reserve Bank of India (RBI)

Regulates technology-related activities within the banking and payment sectors.

6. Securities and Exchange Board of India (SEBI)

Regulates technological developments affecting securities markets and market intermediaries.

7. Insurance Regulatory and Development Authority of India (IRDAI)

Regulates technology-enabled insurance activities within its statutory jurisdiction.

8. Central Pollution Control Board (CPCB)

Plays a role in environmental regulation, including applicable electronic waste requirements.

9. Genetic Engineering Appraisal Committee (GEAC)

Performs regulatory functions concerning specified activities involving genetically engineered organisms under applicable environmental legislation.

10. Data Protection Board of India

Performs statutory functions under the Digital Personal Data Protection Act, 2023.

11. COMPLIANCE REQUIREMENTS FOR ORGANISATIONS USING EMERGING TECHNOLOGIES

Organisations adopting emerging technologies should establish a comprehensive compliance programme.

The major requirements include:

11.1 Legal Risk Assessment

Organisations should identify the laws and regulations applicable to their technological activities.

11.2 Data Protection and Privacy

They should establish lawful data collection, processing, storage and disclosure practices.

11.3 Cybersecurity Management

Appropriate security systems should be established to prevent unauthorised access and cyberattacks.

11.4 AI Governance

Organisations should assess algorithmic risks, accuracy, fairness and transparency.

11.5 Intellectual Property Compliance

They should ensure that their technology does not unlawfully infringe patents, copyrights, trademarks or trade secrets.

11.6 Consumer Protection

Organisations should provide accurate information about their products and services and establish effective grievance redressal systems.

11.7 Regulatory Reporting

They should submit all required regulatory information and incident reports within the prescribed timelines.

11.8 Third-Party Risk Management

Organisations should assess the legal and cybersecurity risks associated with outsourced technology providers.

11.9 Internal Auditing

Regular compliance audits should be conducted to identify violations and improve internal controls.

11.10 Employee Training

Employees should receive appropriate training concerning cybersecurity, data protection, ethical technology use and regulatory requirements.