Key Policies and Acts for Smart Cities: IT Act, IoT, Cyber Security, and Drones

Smart cities depend on a robust digital backbone, and that backbone is shaped by policies. In India, building connected, efficient, and secure urban spaces requires navigating a complex web of laws and regulations covering everything from electronic transactions to drone operations. Understanding these policies is essential for anyone involved in smart city development, urban planning, or digital governance.

The Information Technology Act, 2000 🔗

The Information Technology Act, 2000 serves as India’s foundational legislation for governing electronic transactions, cybercrime, and digital commerce. This landmark law provides legal recognition for transactions conducted through electronic data interchange and other forms of electronic communication, facilitating the shift away from paper-based processes.

The IT Act establishes a framework for digital signatures and electronic records, allowing government agencies and businesses to conduct legally binding transactions online. It covers crucial areas including electronic governance, regulation of certifying authorities, and penalties for cybercrime. The law also defines the powers and functions of adjudicating officers who handle disputes involving digital transactions.

Challenges for smart city applications 🔗

While the IT Act laid important groundwork, its definitions of “data” and “cyber security” were crafted over two decades ago. Smart cities generate massive volumes of sensor data, traffic information, utility consumption patterns, and citizen service requests. The Act’s original framework struggles to address the complexities of Big Data analytics and the sophisticated security threats targeting interconnected urban infrastructure.

The government has recognized these limitations. There have been proposals to replace the IT Act with a more comprehensive Digital India Act that would cover broader issues including privacy, social media regulation, and governance of emerging technologies. Until such reforms materialize, smart city administrators must work within the existing framework while implementing additional safeguards.

E-governance and digital service delivery 🔗

E-governance has become central to the Smart City Mission’s objectives. The Digital India programme launched in 2015 aims to transform the country into a digitally empowered society by ensuring digital access, inclusion, and empowerment while bridging the digital divide.

The IT Act provides legal sanctity to digital signatures and electronic service delivery, enabling seamless information exchange between government departments and private entities. This foundation supports numerous smart city applications including online citizen services, digital payment systems, and automated permit processing.

Key digital infrastructure components 🔗

Several platforms now support e-governance across Indian cities. DigiLocker facilitates paperless availability of public documents with over 11.7 crore users accessing more than 532 crore documents from issuing organizations. The Unified Payment Interface (UPI) has transformed digital payments, processing over 586 crore monthly transactions worth more than Rs 10 lakh crore.

Common Services Centres (CSCs) bring digital services to rural and urban areas alike, with over 5.31 lakh centres operational across the country offering more than 400 digital services. The National e-Governance Division manages platforms like UMANG, which aggregates major citizen-centric services through mobile applications and web portals.

Right to privacy and data protection 🔗

Smart cities collect enormous amounts of personal data through sensors, cameras, and digital services. In 2017, the Supreme Court of India in the Justice K.S. Puttaswamy judgment declared that privacy is a fundamental right protected under Article 21 of the Constitution as part of the right to life and personal liberty.

This ruling prompted India to develop a comprehensive data protection framework. The Digital Personal Data Protection Act, 2023 and its accompanying rules establish clear requirements for how personal data must be collected, processed, and stored.

Current limitations and concerns 🔗

The earlier IT Rules, 2011 provided some protections for personal data collected by private entities, requiring explicit consent for sensitive information. However, critics have pointed out that these provisions do not adequately address government collection of data. Real-time data streams from IoT sensors and surveillance systems often fell outside the scope of traditional privacy protections.

The new Digital Personal Data Protection Rules, 2025, now in effect, aim to address these gaps. Citizens have gained rights to access, correct, update, or erase their personal data. Data Fiduciaries must respond to such requests within 90 days. However, some experts remain concerned that the framework provides broad exemptions for government agencies, potentially allowing extensive data collection without adequate oversight.

Internet of Things (IoT) policy 🔗

The Draft Policy on IoT, 2015 released by the Ministry of Electronics and Information Technology set ambitious goals for India’s IoT ecosystem. The policy aimed to create a domestic IoT industry worth USD 15 billion and increase connected devices from around 200 million to over 2.7 billion by 2020.

The policy adopted a multi-pillar approach covering several strategic areas. These include capacity building and incubation, research and development initiatives, setting up of standards, and providing incentives for domestic manufacturing. The framework specifically targets applications in agriculture, healthcare, transportation, and smart city infrastructure.

Supporting the Make in India campaign 🔗

A key emphasis of the IoT policy is developing India-specific solutions that address local challenges. Setting up Resource Centres and Test-beds in academic institutions supports experimentation with IoT technologies. Incubation centres operating under public-private partnership models foster innovation among startups and small enterprises.

For smart cities, the IoT framework enables applications including smart urban lighting, intelligent waste management, environmental monitoring, and connected traffic systems. The Smart Cities Mission has accelerated adoption of sensor-based infrastructure and citizen-centric solutions across more than 100 cities. Integrated Command and Control Centres (ICCCs) now aggregate IoT data streams to support real-time urban management decisions.

National Cyber Security Policy, 2013 🔗

As digital infrastructure expands, so do security vulnerabilities. The National Cyber Security Policy, 2013 established a framework to protect public and private infrastructure from cyber attacks, develop defensive capabilities, and minimize damage from security incidents.

The policy addresses significant legal gaps in dealing with cybercrime, particularly threats to critical infrastructure like power grids, water systems, and transportation networks that smart cities depend upon. Its vision centres on building a secure and resilient cyberspace for citizens, businesses, and government operations.

Key institutional mechanisms 🔗

The policy established several important bodies. The National Critical Information Infrastructure Protection Centre (NCIIPC) operates around the clock to protect and enhance the resilience of India’s critical information systems. The Indian Computer Emergency Response Team (CERT-In) serves as the nodal agency for coordinating responses to cybersecurity incidents.

For smart city administrators, the policy emphasizes public-private partnerships in cybersecurity management. Organizations are encouraged to appoint Chief Information Security Officers and develop customized security policies based on their specific requirements. The Cyber Crisis Management Plan (CCMP) provides frameworks for countering cyber threats and terrorism affecting urban digital infrastructure.

Drone policy and regulations 🔗

Drones offer transformative potential for smart cities, from infrastructure inspection to emergency response and urban surveillance. The Drone Rules, 2021 notified by the Ministry of Civil Aviation establish a liberalized framework based on trust, self-certification, and non-intrusive monitoring.

The rules mandate that every drone operating in India must be registered on the Digital Sky Platform to obtain a Unique Identification Number (UIN). This platform serves as a comprehensive system for registration, flight permissions, and remote pilot certification. It displays interactive airspace maps showing operational zones and facilitates the “No Permission – No Takeoff” (NPNT) system that ensures compliance with airspace restrictions.

Classification and zone system 🔗

Drones are classified into five categories based on their maximum all-up weight: Nano (up to 250 grams), Micro (250 grams to 2 kilograms), Small (2 to 25 kilograms), Medium (25 to 150 kilograms), and Large (over 150 kilograms). Nano drones do not require registration or flight permissions but must follow operational guidelines.

Indian airspace is divided into three zones. Green zones cover approximately 90% of Indian airspace up to 400 feet, where NPNT-compliant drones can operate without additional permissions. Yellow zones near airports require Air Traffic Control clearance. Red zones around airports, military installations, international borders, and strategic locations are strictly prohibited for drone operations.

The rules also establish drone corridors for cargo deliveries and a Drone Promotion Council involving academia, startups, and other stakeholders to foster a growth-oriented regulatory environment. For smart cities, these regulations enable applications ranging from aerial surveys and infrastructure monitoring to medical supply delivery and disaster response.

What do you think? As smart cities expand their digital footprint, how should policymakers balance the benefits of data-driven urban management with citizens’ fundamental right to privacy? And given the rapid evolution of technologies like AI and IoT, are current legislative frameworks agile enough to keep pace with emerging challenges?

References

1. https://www.indiacode.nic.in/handle/123456789/1999
2. https://en.wikipedia.org/wiki/Information_Technology_Act,_2000
3. https://www.pib.gov.in/Pressreleaseshare.aspx?PRID=1847837
4. https://negd.gov.in/
5. https://law.nirmauni.ac.in/data-privacy-protection-in-india-technology-vis-a-vis-law/
6. https://www.pib.gov.in/PressReleasePage.aspx?PRID=2190655
7. https://idronline.org/article/rights/indias-new-data-rules-put-the-state-above-citizens/
8. https://icrier.org/policy_bank/internet-of-things-iot/
9. https://www.hsc.com/resources/blog/how-the-government-can-use-iot-to-drive-smart-city-development/
10. https://byjus.com/free-ias-prep/national-cyber-security-policy/
11. https://www.pib.gov.in/PressReleaseIframePage.aspx?PRID=1556474
12. https://static.pib.gov.in/writereaddata/specificdocs/documents/2022/jan/doc202212810701.pdf
13. https://drone-laws.com/drone-laws-in-india/