INTRODUCTION
The rapid and uneven expansion of digital infrastructure across South Asian countries, including India, Sri Lanka, Pakistan, and Bangladesh, has introduced acute challenges to the establishment of rights-based data governance. The traditional understanding of the “digital divide” focuses primarily on the First-Order Divide: the simple lack of access or connectivity.1 However, contemporary analysis demonstrates that this conceptualization is insufficient. As digital systems become intensely integrated into national development, a more critical perspective accounts for the Second-Order Divide: the resultant inequalities that arise not merely from exclusion, but from the flawed inclusion of less-advantaged individuals and groups. In South Asia, this transition means moving beyond quantifying infrastructural deficit to scrutinizing the substantial gaps in digital skills, literacy, and meaningful usage.2 This is where the legal and technical intersect: high data generation, driven by rapid digitalization is coupled with a low capacity among citizens for exercising their newly legislated data rights. If a population lacks digital literacy, their participation in digital services generates vast amount of personal data, yet they lack the capacity to enforce protections like the right to erasure mandated by the new governance frameworks. Consequently, the legal architecture designed to protect an individual risks becoming an instrument that validates the exploitation of the digitally vulnerable. The effectiveness of nascent, often GDPR-inspired, data governance legislation across South Asia is structurally undermined by deep, persistent digital inequalities, particularly along gender, urban-rural, and literacy lines. These disparities render core protective legal mechanisms, most critically informed consent and algorithmic accountability, pathological and non-functional for vulnerable data subjects.
JUDICIAL FOUNDATION OF DIGITAL RIGHTS IN SOUTH ASIA
The grounding of data protection in fundamental constitutional principles provides the necessary legal benchmark. In India, the jurisprudence regarding digital rights hinges upon the landmark 2017 judgment in Justice K.S. Puttaswamy (Retd.) v. Union of India3. This decision, delivered by a nine-member bench of the Supreme Court, recognized the right to privacy as a fundamental right, intrinsically protected under Article 21 of the Constitution. This ruling set a constitutional requirement for comprehensive data protection legislation, paving the way for the eventual enactment of the Digital Personal Data Protection Act, 2023. The recognition of privacy as fundamental elevates data governance from mere regulatory compliance to a constitutional mandate, forcing the State to balance individual rights against its own data processing interests. While India and Sri Lanka have derived the right to privacy through robust judicial interpretation of broader constitutional guarantees, several neighbouring nations offer explicit constitutional recognition. The Constitutions of Pakistan and Bangladesh, for instance, explicitly recognize the right to privacy. Furthermore, the Constitution of the People’s Republic of Bangladesh specifically provides for a right to privacy. This divergence highlights varying jurisprudential paths toward achieving the same goal, though, constitutional recognition alone is insufficient without corresponding statutory enforcement mechanisms.
In some jurisdictions, judicial activism has attempted to mitigate the digital divide by extending fundamental rights to encompass connectivity itself. This reframes the provision of digital infrastructure from a mere policy preference into a constitutional obligation. The courts in India have been pivotal in linking the right to life and liberty with digital access. The Kerala High Court, in Faheema Shirin v. State of Kerala,4 explicitly held that the right to internet access constitutes a fundamental right under Article 21 of the Constitution, inseparable from the rights to privacy and education. This position was reinforced by the Allahabad High Court, which, when reviewing internet service suspensions, observed that the right to continuous internet service is an extension of the right to live, such that its discontinuation violates Article 21. This jurisprudence establishes a direct legal link between infrastructural failure and constitutional violation. Access to the internet, while constitutionally protected, remains subject to reasonable restrictions under Article 19(2) and (6) of the Constitution, governed by legislation such as the Telegraph Act, 18855, and the Information Technology Act, 20006. The implication of these rulings is profound in the sense that, if connectivity is fundamental, then the persistent denial of access especially due to the severe urban-rural divide, becomes actionable. This transforms infrastructural investment from a discretionary policy choice into a constitutional mandate.
DIGITAL INEQUALITY: BARRIERS TO LEGAL EFFICACY
The sophisticated legal rights stipulated in new data protection frameworks cannot function effectively if a significant portion of the population lacks the foundational awareness, skills, and access to exercise them. The digital divide, therefore, acts as a factual prerequisite failure for legal efficacy. Empirical data consistently shows that digital inequality is profoundly gendered across South Asia. Across Southern Asia, male users significantly outnumber female users, reaching a ratio of 2 to 1 on platforms like social media. This disparity extends across the adoption of technology, including mobile phone use and general internet access. The core issue extends beyond simple adoption into meaningful usage. In India, over 40% of women remain unaware that mobile internet exists. Similarly, studies examining India and Sri Lanka identify that knowledge and awareness of potential digital opportunities, such as online freelancing or e-commerce, are exceptionally low among women.7 where a citizen may be rural, female, and low-literacy creates a category of “super-vulnerable” data subjects for whom legislative protections are entirely theoretical. Laws like the DPDP Act or Sri Lanka’s PDPA grant individual rights, such as the right to rectification or erasure. However, a woman struggling with low digital skills and unaware of the basic existence of mobile internet cannot reasonably be expected to navigate complex digital platforms to exercise these rights, let alone challenge a Data Fiduciary in a regulatory proceeding.
The geographic component of the digital divide remains a potent structural force, particularly in low-income regions like South Asia. Globally, 83% of urban dwellers use the internet, compared to only 48% of the rural population. The geographic component of the digital divide remains a potent structural force, particularly in low-income regions like South Asia.8 Globally, 83% of urban dwellers use the internet, compared to only 48% of the rural population. Economic development is disparate, creating widening inequality between wealthier southern and western states and other parts of the country. These gaps were acutely exposed during the COVID-19 pandemic, revealing unequal access to essential digital services such as education, finance, and health. The persistence of this urban-rural inequality means that while data governance laws may apply throughout the national territory, effective access to the digital mechanisms required to enforce those laws (e.g., grievance redressal portals, digital consent forms) is inherently unequal. The law, though nationally applied, is functionally available only in urban centres, neglecting the vast majority of the rural data population.
COMPARATIVE STATUTORY ANALYSIS OF DATA GOVERNANCE FRAMEWORKS
The South Asian region exhibits a highly uneven landscape of data protection legislation, with countries ranging from having comprehensive, GDPR-inspired laws to maintaining fragmented or non-existent statutory frameworks. Following the Puttaswamy judgment, India enacted the DPDP Act in August 2023, establishing a comprehensive regime for the processing of digital personal data. The Act moved away from reliance solely on the Information Technology Act, 2000 (IT Act) and its rules, introducing key features such as defined obligations for Data Fiduciaries and specific rights for Data Principals (including withdrawal of consent).
Sri Lanka was the first country in South Asia to enact comprehensive privacy legislation, passing the PDPA in March 2022.The PDPA applies both territorially and extraterritorially and is heavily influenced by the European Union’s General Data Protection Regulation (GDPR), incorporating principles of legitimate purpose, proportionality, and transparency. A significant achievement in Sri Lanka is the progress towards institutional capacity. The Data Protection Authority (DPA) of Sri Lanka was successfully established in July 2023.This regulator has comprehensive powers, including making rules, issuing guidelines, receiving complaints, conducting inquiries, and imposing fines for non-compliance. However, while the DPA’s establishment provides a concrete enforcement body, its future effectiveness is subject to external constraints. The DPA’s budget and creation were highlighted as a priority, but the country’s ongoing financial crisis and austerity measures raise concerns regarding its sustained operational independence and fiscal capacity to handle widespread enforcement.
The regional fragmentation is most starkly illustrated by the legislative status in Pakistan and Bangladesh. Pakistan currently lacks enacted comprehensive data protection legislation similar to the DPDP Act or PDPA. Protection is partially reliant on the Prevention of Electronic Crimes Act, 2016 (PECA 2016). Although a draft Personal Data Protection Bill (PDPB 2023) has been introduced, seeking to incorporate GDPR-like elements, it awaits promulgation into law. Bangladesh remains without any general personal data protection law and, consequently, does not possess a dedicated data protection authority. Privacy protections are derived solely from constitutional provisions, specifically the right to privacy of correspondence, and reliance on sector-specific laws.
The varied status of Data Protection Authority (DPA) establishment across the region reveals a critical capacity gap. The presence of a sophisticated law, such as the PDPA in Sri Lanka, is rendered meaningless without the mandated independent authority to enforce it effectively, especially in resource-strained environments. Conversely, in Pakistan and Bangladesh, the complete absence of a DPA means that statutory rights, even if hastily enacted, would lack an effective redress mechanism, leaving digitally disadvantaged citizens with no practical means of addressing corporate or state data misuse.
Table 1: Comparative Status of Data Governance Frameworks
| Country | Primary Statute Status | DPA/Regulator Status | Foundational Privacy Status |
|---|---|---|---|
| India | DPDP Act, 2023 (Enacted, Awaiting Rules/Notification) | Data Protection Board (Developing) | Judicially Recognized (Puttaswamy) |
| Sri Lanka | PDPA, 2022 (Enacted, Phased Implementation) | Data Protection Authority (Established July 2023) | Judicially Recognized |
| Pakistan | Draft PDP Bill, 2023 (Pending) | None (Proposed in Bill) | Explicitly Recognized |
| Bangladesh | No General Law | None | Explicitly Recognized |
SYSTEMIC BREAKDOWN OF INFORMED CONSENT IN LOW-LITERACY CONTEXTS
The concept of informed consent is the foundation upon which most modern data protection laws, including those in South Asia, are built. However, the reality of the digital divide directly challenges the fundamental validity of consent processes. Data protection laws demand rigorous standards for consent. For instance, India’s DPDP Act mandates that consent provided by the data principal must be, duress-free; specific; informed; unconditional; unambiguous; signified by a clear affirmative action; and presented in clear and plain language. These legal requirements establish the “gold standard” of knowing and voluntary consent. Yet, these high legal standards are fundamentally mismatched with the empirical reality of low digital literacy. The pervasive skills gap prevents data subjects from achieving the necessary “informed” status.
Legal scholarship identifies several “pathologies of consent”—defects that invalidate the agreement, such as unwitting consent, coerced consent, and incapacitated consent. Due to the digital skills barrier and the complexity inherent in digital agreements (terms of service, privacy notices, cookie policies), low-literacy users cannot grasp the scope or long-term consequences of clicking “I agree.” When complexity and low capacity intersect, the procedural act of “agreeing” does not equate to a genuinely “informed” choice, rendering the consent unwitting and legally suspect.
In South Asia, especially concerning public services delivered through Digital Public Infrastructure (DPI) or digital health initiatives, citizens often face pressure to consent to data processing to access essential state entitlements (e.g., welfare payments, healthcare). If refusal means denial of essential services, the consent, while procedurally free of direct duress, is effectively coerced participation under the legal necessity paradox.
This systemic failure reveals that the legal mandate for “informed consent” in South Asian DP laws, when combined with infrastructural dependence (DPI), paradoxically becomes a mechanism of legal exclusion. If a Data Fiduciary meets the procedural requirements of consent (providing a clearly worded affirmative action box), they are legally protected, even if the data principal was fundamentally incapable of understanding the terms due to the digital divide. The legal system validates the data transaction, effectively shifting the burden of challenge entirely onto the vulnerable citizen, who must attempt to overturn a legal agreement they were structurally incapable of meeting in the first place.
DATA INEQUALITY AND ALGORITHMIC DISCRIMINATION IN E-GOVERNANCE
The move towards data-driven societies involves the pervasive use of algorithms and Artificial Intelligence (AI) in public sector decision-making, notably in e-governance schemes like welfare distribution and beneficiary screening. When trained on data sets reflecting existing societal inequalities, these systems reinforce and codify discrimination against the digitally disadvantaged. Digital systems deployed in e-governance frequently rely on variables that mimic existing socio-economic or regional disparities, leading to systematically biased and unfair outcomes. This constitutes indirect discrimination, which, though subtle, can be as destructive as explicit bias. In India, cases have shown that AI tools used to screen beneficiaries in essential programs like food security resulted in entitlements being denied based on “algorithmic decision-making” that lacked external verification.
The legal standard required should be clear that every AI-based decision affecting a citizen must be judged against the same standard of reasonable and fair actions that the law imposes on human decision-makers. However, the opacity of these systems often described as a “black box”, creates an uneasy precedent where justice is filtered without public understanding or judicial capacity for review.
A critical failing of South Asian data governance frameworks is the absence of explicit statutory safeguards against opaque automated decision-making. Unlike the European Union’s GDPR, which offers citizens a Right to Explanation when they are affected by automated decisions, India’s DPDP Act contains no equivalent statutory provision to address AI bias directly.25 The DPDP Act focuses on foundational rights over personal data (consent, limited use) but provides nothing to mitigate or remedy algorithmic discrimination.
This statutory void means that digitally disadvantaged citizens who suffer harm or exclusion due to biased algorithms have no immediate legal avenue to demand transparency or appeal the decision based on the underlying logic. The failure to include a Right to Explanation is not a technical oversight; it is a policy outcome that structurally prioritizes administrative efficiency and the unchecked power of the State or Data Fiduciary over fundamental democratic accountability. Since disadvantaged groups are often the primary targets of government surveillance and governance schemes, denying them the means to challenge decisions in court reinforces the existing power dynamic, making algorithmic exclusion legally impervious.
Existing legislative tools, such as India’s Right to Information (RTI) Act (2005), offer limited compensatory recourse. RTI has proven useful for journalists and citizens seeking accountability, compelling government departments to disclose that AI tools were used in decisions, such as the case involving an IBM tool for beneficiary screening in Odisha. However, while RTI can confirm the fact of algorithmic influence, it often fails to provide adequate grounds for appeal or systemic remedy, leaving the legal standard for fair and reasonable action unmet.
WAY FORWARD
To ensure that data governance frameworks are genuinely effective and rights-based, policy interventions must move beyond legislative enactment to actively bridge the structural digital divide through reformed legal design and institutional strengthening. Policy must treat digital skills and awareness as constitutional prerequisites for meaningful digital citizenship. This requires comprehensive, state-funded programs designed to address the skills gap. Without achieving functional digital literacy, citizens cannot effectively exercise sophisticated rights like the Right to Withdrawing Consent or the Right to Erasure. Legislatures and DPAs must move decisively away from complex, text-heavy consent models that induce “consent fatigue”. Data processing with high-risk mandates should require the use of simplified, universally accessible interfaces utilizing multi-lingual, visual, or audio confirmations to ensure genuine comprehension. This directly targets and mitigates the “unwitting consent” pathology.
All existing and proposed South Asian data protection statutes must incorporate a statutory ‘Right to Explanation’. This right must apply whenever automated systems are used to make decisions that significantly affect fundamental rights or entitlements. This reform is vital for enabling judicial review, mitigating indirect algorithmic discrimination, and upholding the constitutional mandate for fair action. The legal relationship between Data Fiduciaries (especially Significant Data Fiduciaries operating core public infrastructure) and data principals must be defined by a higher fiduciary duty concerning vulnerable and low-literacy populations. This duty should require proactive steps to ensure comprehension and prevent harm, going beyond the mere procedural satisfaction of consent requirements. This legal shift acknowledges the inherent power asymmetry created by the digital divide and places the burden of ensuring meaningful protection upon the data-processing entity.
Governments must ensure the immediate, full operationalization, independence, and adequate technical funding of newly established DPAs and proposed regulatory bodies. A formal mechanism for regional regulatory alignment is necessary to counter fragmentation and the unilateral “contagion effect”. This network should focus on sharing best practices, standardizing principles for DPI governance, and working towards harmonized data transfer standards (e.g., mutual adequacy assessments) to promote Data Free Flow with Trust (DFFT) and strengthen the collective pushback against digital authoritarianism.
CONCLUSION
The South Asian region stands at a critical juncture, having achieved significant milestones in establishing digital rights jurisprudence, particularly with India’s Puttaswamy judgment and the judicial recognition of the Right to Internet Access, Legislative progress, exemplified by Sri Lanka’s comprehensive PDPA and India’s DPDP Act, signals a formal commitment to data protection. However, this formal legal structure operates within an environment of profound structural failures. Deep-seated inequalities, including the 2:1 gender gap in digital access, persistent urban-rural disparities, and critical deficiencies in digital literacy, create insurmountable barriers to legal efficacy. This report has demonstrated that the digital divide generates legal pathologies which renders informed consent unwitting or coerced and enables systemic algorithmic discrimination due to the absence of a statutory Right to Explanation. Consequently, the digital divide functions not merely as a developmental barrier, but as a mechanism of legal exclusion, shielding both the State and corporate Data Fiduciaries from genuine accountability to the most vulnerable data subjects.
The South Asian paradigm mandates that legal policy must treat the digital divide as a structural legal vulnerability. Future reforms must pivot from merely replicating global North standards (like the GDPR) to designing governance frameworks that are context-specific and intrinsically inclusive, actively mitigating the socio-economic and literacy gaps inherent in the Global South. The effectiveness of data governance is inseparable from the achievement of digital equity. Without closing the gap between legislative intent and sociological reality, South Asian nations face the risk of codifying a two-tiered system of digital citizenship: one offering robust, enforceable rights for the digitally literate elite, and another assigning passive data subject status, devoid of meaningful agency or redress, to the excluded majority. Integrated legal and structural reforms, addressing literacy, consent pathology, algorithmic accountability, and regional cohesion, are therefore not just desirable policy choices, but constitutional imperatives to safeguard fundamental rights in the digital era.
*****
Footnotes
1. * Research Scholar, Faculty of Law, Jamia Millia Islamia, New Delhi-110025. Richard Heeks, Digital Inequality Beyond the Digital Divide: Conceptualizing Adverse Digital Incorporation in the Global South, 8 ITD. 668, (2022).
2. Helani Galpaya & Ayesha Zainudeen, Gender and Digital Access Gaps and Barriers in Asia: But What About After Access? UN Women Expert Group – CSW67: Innovation and Technological Change 1 (2022).
3. AIR 2018 SC (SUPP) 1841.
4. (2019) 09 KL CK 0001.
5. The Indian Telegraph Act, 1885 (Act 13 of 1885).
6. The Information Technology Act, 2000 (Act 21 of 2000).
7. INTERNET USE IN 2024, https://datareportal.com/reports/digital-2024-deep-dive-the-state-of-internet-adoption (last visited on 18 November, 2025).
8. Internet use in urban and rural areas, https://www.itu.int/itu-d/reports/statistics/2024/11/10/ff24-internet-use-in-urban-and-rural-areas/ (last visited on 16 November, 2025).