A digital right is an existing human right as it applies when people speak, organise, learn, earn, prove who they are or receive welfare through a network. There is no separate catalogue. The right to free expression covers a WhatsApp forward. The right to privacy covers a biometric record. The right to food covers a ration card that depends on an online authentication. What changes online is scale, speed and who sits in the middle: a telecom operator, a platform, a government database.

The Universal Declaration of Human Rights predates the internet by decades, yet two of its articles were drafted broadly enough to travel. Article 19 protects expression through any media and regardless of frontiers, which covers a post read in another country. Article 12 protects privacy and correspondence, which covers messages, call records and location data. Read them side by side, because most digital disputes set one against the other or against a claim of security.

The UN Human Rights Council settled the basic principle in 2012 and has repeated it since. Its resolutions are not treaties, so they do not bind a state the way a Covenant does. They matter because the Council adopted them without a vote, so no member objected to the wording, and because UN experts and national courts cite them when they read the treaties.

Lists of digital rights run long. For field work four families cover almost every case. Each one has a home in the Indian Constitution, which is why later sections keep returning to Articles 14, 19 and 21. The examples are from South Asian practice and each one appears again later in the deck with its source.

Many programmes now deliver through digital channels: payments by direct benefit transfer, attendance by app, grievance by toll-free number and portal, training by WhatsApp. Each channel creates two kinds of exposure. The programme can be harmed by a rights violation it did not cause, such as a shutdown that stops payments. It can also cause harm itself, by collecting more data than it needs or by trusting a score it cannot explain.

Most digital rights may be limited. Speech can be restricted for public order, privacy can yield to criminal investigation. What human rights law and the Indian Supreme Court both require is that a limit pass a test. The wording differs between the Human Rights Committee in Geneva and the Supreme Court in Delhi. The structure is the same, and it is the single most useful idea in this deck.

This deck was written to sit beside three existing decks and to repeat as little of them as possible. It covers the rights side (courts, shutdowns, blocking, surveillance, access) and the society side of AI (bias, welfare automation, labour, elections, governance). The others go deeper on ethics, data protection compliance and day-to-day use of generative AI.

Section 66A of the Information Technology Act 2000 made it an offence to send, by computer or phone, information that was grossly offensive, or that caused annoyance, inconvenience or insult. The Court found its expressions completely open-ended, so almost any critical post could fall within them. On 24 March 2015 the Supreme Court struck it down. The words were too vague for a citizen to know what was forbidden, and the harms they named did not fit any ground in Article 19(2).

The same judgment upheld the two powers that now carry most online content control in India. Practitioners often remember only the first half of the case. The second half explains why blocking orders and takedown requests remain lawful in principle, and what conditions attach to them.

On 24 August 2017 a nine-judge bench of the Supreme Court held unanimously that privacy is protected by the Constitution. The case arose from the challenge to Aadhaar, when the Attorney General argued that two older benches had denied any such right. The Court overruled both. Every later argument about data, surveillance and digital identity in India starts from this order.

Puttaswamy did more than declare a right. The plurality opinion of Justice Chandrachud set out a three-fold requirement that any state intrusion on privacy must meet, and later benches have applied it to Aadhaar, to surveillance and to internet suspension. It is the Indian version of the test on slide 9, and it is the frame to use when a government scheme asks your programme for beneficiaries' data.

A five-judge bench decided the Aadhaar challenge itself on 26 September 2018. The majority upheld the Aadhaar Act for welfare benefits and subsidies, applying the Puttaswamy test. It struck down the part of section 57 that let a body corporate or a private person demand Aadhaar authentication under a contract, which is why a phone company or a bank can no longer make Aadhaar a condition of service on its own say-so.

After the changes to Jammu and Kashmir's status on 5 August 2019, the internet was suspended across the region. Anuradha Bhasin, executive editor of the Kashmir Times, could not publish the Srinagar edition. The Supreme Court decided her petition on 10 January 2020. It did not order the internet restored, which disappointed many. What it did was set rules that now bind every suspension order in India.

Access Now, a digital rights organisation that coordinates the #KeepItOn coalition, has counted shutdowns every year since 2016 from reports by its partners, network measurement and the press. Its count for 2025 was the highest in its records. The Asia Pacific region, which in its classification includes South Asia and Myanmar, accounted for most of them.

A plan written before a shutdown is worth far more than one written during it, when phones are down and staff cannot reach each other. The five steps below fit on one page and can be added to any programme's risk register. Step four uses the publication duty from Anuradha Bhasin: an unpublished order is itself a breach of what the Supreme Court directed.

Section 69A lets the Central Government direct any agency or intermediary to block public access to information when it is satisfied that this is necessary or expedient in the interest of sovereignty and integrity, defence, security of the State, friendly relations with foreign States or public order, or to prevent incitement to a cognizable offence relating to these. The grounds track Article 19(2), which is one reason the Supreme Court upheld the section in 2015.

Section 79 protects an intermediary from liability for content it hosts or carries, provided it does not start or modify the transmission and it observes due diligence. The protection is lost if, on receiving actual knowledge, it fails to remove unlawful content. Shreya Singhal read actual knowledge narrowly: a court order, or a notification from the appropriate government, relating to the grounds in Article 19(2).

The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021 replaced the 2011 guidelines. They set due diligence for all intermediaries and heavier duties for large social media intermediaries, and a code for digital news and streaming. For development organisations the parts that matter most are the grievance route a user can use and the rules on what users may not post.

On 10 February 2026 MeitY notified amendments to the IT Rules that bring synthetically generated information, including deepfakes, inside the rules. They took effect on 20 February 2026, giving platforms ten days to comply. Two changes matter for development organisations, which both make and suffer from synthetic media.

X Corp, formerly Twitter, asked the Karnataka High Court to declare that blocking orders can issue only under section 69A with its procedural safeguards, and that section 79(3)(b) gives no separate power to order takedowns. It also challenged the Sahyog portal, a government system through which many agencies send removal notices to platforms. On 24 September 2025 a single judge of the High Court rejected the petition.

In July 2021 an international media investigation reported that phone numbers of Indian journalists, opposition politicians and activists appeared on a list of possible targets for Pegasus, a spyware product sold to governments. Petitions reached the Supreme Court. The Union government declined to say on affidavit whether it had used the software, citing national security. On 27 October 2021 the Court appointed its own technical committee.

The committee examined phones submitted by people who believed they had been targeted and reported to the Supreme Court in 2022. On 25 August 2022 Chief Justice N.V. Ramana read parts of the report in court. The findings were inconclusive on the question that mattered most, and the Court recorded a finding about the government's conduct during the inquiry.

Delhi Police obtained facial recognition software after the Delhi High Court, in Sadhan Haldar v NCT of Delhi, allowed it to help trace missing children. In a reply to an RTI request in February 2020, the police named that judgment as the legal basis for its use of the technology. By then the same software was being used in other policing, including at protests. Its accuracy, as the police and the government themselves reported, was low.

Surveillance harms people even when no one is arrested. Someone who believes a protest will be filmed and matched to a database may stay home. A health worker who believes her messages are read may stop reporting a supervisor's abuse. Courts call this the chilling effect, and the Supreme Court relied on it in Shreya Singhal. For development work it shows up as silence in exactly the places where voice is the point.

Digital identity is where surveillance and welfare meet. A unique ID makes it easier to stop duplicate claims and to pay people directly. It also links records across systems, and when authentication fails the person carries the cost. The Aadhaar judgment of 2018 upheld its use for subsidies and benefits; it did not decide what happens to the person whose fingerprint will not match on the day the ration is due.

The Unified Payments Interface lets any bank account send money to any other through a phone number or a QR code. It is run by the National Payments Corporation of India, which publishes monthly volumes. By 2026 it carries a large share of small payments in India, including many made by street vendors and self-help groups with whom development programmes work.

Two other rails reach development work directly. DigiLocker holds documents issued by departments, such as mark sheets, driving licences and caste certificates, so that a person can share them without carrying paper. ONDC is a network that lets a seller listed on one app be found by a buyer on another. One is a document wallet, the other a market protocol, and each raises its own rights question.

The GSMA, the mobile industry's association, surveys women and men in low and middle income countries every year. Its 2026 report, published on 10 June 2026, found the gap narrowing slightly in 2025, with South Asia still among the two regions where it is widest. Use the current edition: methods change between reports, so comparing a 2025 figure with a 2026 figure can mislead.

The surveys on the last three slides count whether people have used the internet. A rights approach asks a harder question: can a person use it to claim what they are owed, safely and on their own terms? That depends on device ownership, privacy within the household, language, skills, cost and safety. A woman who must ask her husband to fill her pension form online has access in the survey sense and none in the rights sense.

The National Crime Records Bureau's Crime in India 2024, released on 7 May 2026, recorded more than one lakh cybercrime cases in a year for the first time. These are cases registered by police, so they measure what was reported and recorded, which is a fraction of what happened. Fraud dominates the count. Sexual exploitation is a small share of cases and a large share of the harm to women and children.

The stalking offence is worth reading in full because it names the most common form of digital control in intimate relationships. Many women do not know that a partner who installs tracking software, reads her messages or demands her passwords may be committing an offence. Note the limits too: the section is written for a man stalking a woman, and it carries an exception for lawful crime prevention.

The NCRB count of sexual exploitation cases is small next to the scale of harassment women describe. The gap has known causes. Each cause suggests a design response that a programme can take without waiting for police reform. Taken together, the pairs on this slide amount to a simple referral pathway that most women's groups can set up in a month.

The Committee on the Rights of the Child issued General Comment No. 25 on children's rights in relation to the digital environment, dated 2 March 2021. It reads the Convention on the Rights of the Child, which every South Asian state has ratified, into digital life. The Committee consulted children while drafting it, and its opening paragraph reports that children described digital technologies as vital to their lives.

Most AI systems in public life are prediction machines. They learn patterns from past data and use them to produce an output for a new case: a score, a category, a match or a piece of text. They work by resemblance: they find what past cases with similar features looked like, which is powerful when the past is a good guide and harmful when the past was unfair.

Ziad Obermeyer and colleagues studied a commercial algorithm used by US health systems to pick patients for extra care. It was trained to predict future health care costs, on the reasoning that sicker people cost more. Because less money had been spent on Black patients with the same illness, the algorithm ranked them as lower risk. The paper appeared in Science in October 2019.

Accuracy figures mislead when the thing being detected is rare. Suppose a state uses a model to flag ineligible pension claimants, and suppose only 2% of 1,00,000 claimants are actually ineligible. The model is right 95% of the time for both groups. The numbers below are Illustrative, built to show the arithmetic; they describe no real scheme.

Due process in Indian administrative law requires that a person affected by a decision be told the reason and be heard. Automated systems strain both. The reason may sit in a model nobody in the department can explain, or in a vendor contract marked confidential. A person dropped from a list may not even know that a system was involved. Contestability, the practical ability to challenge an output, has to be designed in.

Samagra Vedika is a data system that links records across Telangana's departments to build a profile of each resident. The state used it to find ineligible welfare claimants, for example people who owned a car. An investigation by Al Jazeera and The Reporters' Collective, supported by the Pulitzer Center's AI Accountability Network, found that it wrongly matched poor people to assets they did not own, and that officials trusted the system over the person.

AI systems learn from data that people have labelled: this image shows a pedestrian, this text is abusive, this answer is better than that one. Much of this work is done through online platforms and outsourcing firms, much of it in the Global South, including India. It is low-paid, often precarious, and sometimes harmful: moderators and labellers view violent and sexual material for hours.

For delivery riders and drivers, the boss is often an algorithm: it allocates orders, sets pay per task, rates workers and can deactivate an account. The four Labour Codes came into force on 21 November 2025. The Code on Social Security 2020, one of the four, defines gig workers (s2(35)) and platform workers (s2(61)) and provides for social security schemes for them (s114), the first national labour law in India to name them.

Deepfakes are used for more than elections. Voice clones of relatives ask for money. Fake videos of activists are used to discredit them. Synthetic intimate images are used against women journalists and community leaders. A response has to move fast, because the 2026 IT Rules give platforms three hours to act on an order, and harm spreads faster still.

The EU Act applies to providers and deployers who place AI on the EU market or whose AI outputs are used in the EU, wherever they are based. Most South Asian programmes will never be directly covered. The Act still reaches them in three ways, and it is the most detailed public statement of what responsible AI requires, which makes it a useful checklist even where it has no legal force.

MeitY released the India AI Governance Guidelines on 5 November 2025. They were drafted by a committee chaired by Prof. Balaraman Ravindran of IIT Madras. Their central position is that existing laws on information technology, data protection, consumer protection and criminal law can govern most AI uses, so a separate AI law is not needed at this stage given the current assessment of risks.

On 7 March 2024 the Union Cabinet approved the IndiaAI Mission, with a budget outlay of Rs 10,371.92 crore. Its components include public AI compute of 10,000 or more GPUs, better data quality, support for indigenous foundation models, startup financing and tools for safe and trusted AI. The rights questions sit inside these components: which data trains the models, and whose languages and needs are served.

Two non-binding texts give shared vocabulary across countries. They are the standards a development organisation can cite in any South Asian country, because they do not depend on national law. Neither creates a remedy for a harmed person. Both are useful for writing an organisational AI policy that donors and partners will recognise.

An assessment is a structured set of questions asked before a digital tool goes live, and asked again when it changes. It need not be long. Its value lies in forcing the questions in this deck to be answered by named people before participants carry the risk. Run it at the triggers below, and keep the answers on file: a donor, an ethics committee or, from May 2027, the Data Protection Board may ask for them.

Illustrative. A women's rights NGO in one district plans a WhatsApp chatbot. Widows type or speak a few answers (age, district, whether they hold a ration card) and the bot tells them which state and central pension schemes they may qualify for, and which documents to bring to the block office. Version two would add a likely eligible score that the NGO would share with the block office to speed up approvals. The NGO, the district and the figures in this example are made up for teaching.

Illustrative. Using the decision table, the team rated version one Medium and version two Unacceptable as designed. It launched version one after the agreed actions and replaced the score with a document checklist that the widow herself carries to the office. The block office gets nothing from the bot, which removes the risk that a score quietly becomes a gate. The team set four indicators to watch.