Walk through Lucknow’s Hazratganj on an ordinary afternoon and count the cameras. They’re on traffic lights, mounted above shop awnings, bolted to poles that also carry street lights. Some are domes. Some are fixed-lens units pointing down the road. At the major intersections, you might spot the larger pan-tilt-zoom models — the ones that can follow a face across 400 meters of open street.
None of them carry labels saying who operates them, what footage they retain, or who can query the resulting data. There is no sign explaining that Lucknow is a Safe City project site. No QR code linking to a privacy notice. No opt-out.
This is not a hypothetical future. It is what was built — systematically, at public expense, across 100 Indian cities — under a program launched in 2015.
The Smart Cities Mission and the surveillance it funded
The Smart Cities Mission (SCM) was announced by the Ministry of Housing and Urban Affairs as an urban development initiative. One hundred cities were selected. Each received central funding and a mandate to modernize infrastructure. The program’s framing was about mobility, sanitation, digital connectivity, and citizen services.
Surveillance infrastructure became a core deliverable. The mechanism was the Integrated Command and Control Centre (the ICCC). It is a centralized operations hub connecting camera feeds, emergency dispatch, traffic management, and, in some cities, social media monitoring. Every selected city was expected to build one. Most did.
The Safe City initiative ran alongside SCM as a Ministry of Home Affairs program. It provided separate funding for police surveillance infrastructure in eight cities: Delhi, Lucknow, Mumbai, Kolkata, Chennai, Bengaluru, Hyderabad, and Ahmedabad. The two programs overlap substantially in some cities. That creates surveillance networks funded from multiple streams, with no unified oversight.
What was actually deployed
The scale varies sharply by city, but the pattern is consistent.
Lucknow’s Safe City project was among the earliest to deploy large-scale facial recognition. Cameras feed continuously into a system that matches faces against a police database — wanted persons, individuals on watchlists — without individual activation decisions.
Hyderabad stands out even within India’s surveilled landscape. The Telangana State Police operate TSCOP — Telangana State Citizen’s Online Portal — integrating camera networks with police databases, vehicle records, and field officer systems. It is among the most densely surveilled cities in the country by any reasonable measure.
Delhi is in a different category. The network exceeds 300,000 cameras under Delhi Police and various civic bodies. The stated justification for facial recognition was locating missing persons. During the 2020 Delhi riots, police used the system to identify protesters in the aftermath. The Internet Freedom Foundation documented the deployments. Multiple people were misidentified.
Surat, Bhopal, and Raipur have built ICCCs integrating traffic data, crime reporting feeds, and emergency services dispatch. The command center model pools data that was previously siloed across agencies. That integration is the point — and it is precisely what makes the accountability questions hard.
Across all of these deployments, vehicle number plate recognition (ANPR) runs alongside facial recognition. Some ICCCs incorporate social media monitoring feeds. No authoritative public count of cameras exists — the figure is in the tens of thousands, likely higher.
The accountability gap
The most important fact about India’s smart city surveillance infrastructure is not its scale. It is how little legal structure governs it.
There is no central law regulating CCTV deployment in Indian public spaces. Cities operate under state police orders, SCM project documentation, and Safe City scheme guidelines. None of these are public law. None establish individual rights. And none specify who can access footage, for how long, or on what authority.
No public disclosure of false positive rates exists for any facial recognition system currently in operation across Indian smart cities. This is not a minor procedural gap. A system with a 0.1% error rate applied to millions of daily camera matches produces thousands of false identifications. The people most likely to be misidentified — darker-skinned individuals, women, faces captured in poor lighting or low resolution — are not edge cases. They are a substantial portion of the population these systems operate against.
No mandatory data retention limits apply. Footage collected today may be retained for months or years — the period varies by city and agency, and in some cases appears to be indefinite.
The Software Freedom Law Centre (SFLC.in) and the Internet Freedom Foundation (IFF) have spent years filing RTI requests to establish basic facts. Which vendors supplied which systems. What databases the facial recognition queries. What oversight exists before a match triggers a police action. The responses have been partial, delayed, or refused. The accountability infrastructure does not exist — it is not merely hard to access.
Who built this
The camera hardware comes from a fragmented vendor ecosystem. Chinese manufacturers — Hikvision and Dahua — are prominent in the Indian market. Both were added to the US Department of Commerce Entity List for their role in surveillance infrastructure used against Uyghurs in Xinjiang. Whether footage from Indian deployments flows through or to foreign vendor systems is not publicly audited.
NEC Corporation holds Indian government contracts. Bosch and Axis supply cameras into the market. Indian companies including Staqu Technologies and FaceX supply facial recognition software to state police forces. Oversight of this ecosystem is not unified anywhere.
What the DPDPA does and does not cover
India’s Digital Personal Data Protection Act 2023 — the DPDPA — is a real law with real individual rights. It does not govern most of what is described above.
The DPDPA contains explicit exemptions for national security and law enforcement purposes. State police departments collecting facial recognition data under these exemptions face no DPDPA obligations. No requirement to disclose what they collect. No data minimization requirement. No mandatory retention limits. No individual right of access or correction. The surveillance infrastructure built under the Smart Cities Mission and Safe City initiatives operates in a space the DPDPA explicitly does not reach.
This is a policy decision, not an oversight. India has no surveillance reform framework: no law establishing judicial authorization requirements, accuracy standards, mandatory impact assessments, or individual rights against police data systems. That absence is itself a choice. Other democracies have grappled with this. India has not enacted a response.
The DPDPA is meaningful for commercial data processing. For state surveillance, it changes nothing.
What you can do
The options are limited but real.
File RTI requests with your city’s smart city special purpose vehicle (SPV). Ask specifically: how many cameras are deployed, what data they retain, for how long, and which vendors supply the facial recognition systems. SPVs are public bodies and RTI applies. Enough filings create pressure even where law does not.
The Internet Freedom Foundation tracks surveillance deployments and accepts public tips about new systems. Their work has produced the most reliable public record of what Indian police facial recognition systems have actually done. Supporting them matters.
At protests and public gatherings, facial coverings — masks, hats, glasses — meaningfully reduce recognition accuracy in most deployed systems. Do not carry linked devices if you can avoid it.
Advocate for a surveillance reform bill. India has privacy advocates, parliamentary committees that have noted the gap, and a constitutional right to privacy established in 2017. The infrastructure that exists today is being built ahead of any legal framework. That framework, once it arrives, will tend to accommodate what already exists rather than dismantle it. The window to shape what gets built is now — and it is narrowing.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.