Smart Glasses and the DPDP Act: What the EU's New Privacy Statement Means for Indian Businesses

Smart glasses look like ordinary spectacles, which is exactly why regulators are nervous about them. On 13 October 2026 the European Data Protection Board adopted Statement 1/2026 on the data protection challenges of smart glasses, alongside a report titled "The connected gaze". If you are wondering how smart glasses and the DPDP Act fit together, the short answer is that India has no wearable-camera rule yet, but the Act's notice and security duties already reach a business that lets staff record people on its behalf.

This post walks through what the EU said, where Indian law lines up with it, and a practical policy you can put in place before 13 May 2027, when the main DPDP obligations are due to apply.

What the EDPB actually said

The statement is eight pages, preliminary, and not binding guidance. It names no company and does not call any current product unlawful. Its main points, per the EDPB announcement:

• Glasses with cameras and microphones can record bystanders who have no idea it is happening. Hospitals, schools and workplaces are flagged as higher-risk settings.
• A wearer filming family for personal use may fall under the GDPR household exemption. A wearer who posts footage publicly, or uses the glasses for professional purposes, may become a controller.
• Makers and app providers cannot hand their duties to the wearer. In the EDPB's words, they should not rely on users' actions to meet their own obligations.
• Consent collected after the recording is not valid, and legitimate interest would be "particularly difficult to demonstrate" for AI training on bystander images, as reported by PPC Land.

Nothing here changes Indian law. But it shows how a mature regulator reasons about a problem your own staff may soon create.

Does the DPDP Act cover a wearer with a camera?

Section 3(c)(i) of the DPDP Act, 2023 says the Act does not apply to personal data processed by an individual for a personal or domestic purpose. A founder filming a weekend trek with friends sits outside it.

The picture changes the moment the purpose becomes business. An employee wearing smart glasses on a client site, a delivery rider recording doorstep handovers, a clinic receptionist using voice notes captured through glasses: here the employer decides why and how the recording is done. That makes the business a Data Fiduciary, and the people captured are Data Principals.

Two sections matter most. Section 5 requires a notice that says what personal data is processed and why, how rights can be exercised, and how to complain to the Data Protection Board. Section 8 and Rule 6 require reasonable security safeguards for whatever you store. Failing on safeguards carries the highest penalty band in the Act, up to ₹250 crore per instance.

The bystander problem is harder in India than it looks

Consent is the default lawful basis under the DPDP Act. You cannot realistically collect free, specific consent from the customer, the courier or the passer-by who walks into frame. The Act does list certain legitimate uses in Section 7, including employment purposes, but that covers your own employees' data. It does not stretch to every outsider an employee happens to record.

So the safest position for a business is blunt: unless there is a clear operational reason and a way to give notice at the moment of capture, do not allow always-on recording by staff wearables. That is a policy choice, not a legal prohibition, and the EDPB's focus on "in-the-moment" signals (visible lights, audible cues) is a useful design benchmark if you do allow it.

Where Indian SMEs are most likely to get caught

Think about the roles where cameras already exist on the job.

Field services and logistics. Proof-of-delivery photos and body cameras for riders are common. Customers' faces, home interiors and number plates end up in your storage.

Clinics, salons and gyms. Spaces where people are undressed or unwell. Recording here needs a far stronger justification than a shop floor.

Offices and co-working spaces. A visitor to your office has not agreed to be filmed by an employee's glasses during a meeting. Visitors and vendors are Data Principals too.

Tech teams testing AI features. If a product uses camera input and sends it to a model provider, the processing chain sits with you. Your vendor contract needs to say what the provider may do with the footage. Our earlier piece on data processing agreements covers that clause by clause.

A practical wearable-camera policy in one afternoon

You do not need a legal team to start. Work through this list with whoever runs operations.

1. Inventory. Ask each team which devices record audio or video: phones, dashcams, body cameras, smart glasses. Write the answers down. Most SMEs find two or three surprises.
2. Decide the purpose. For every device left in use, write one sentence on why you record and who it captures.
3. Set no-record zones. Washrooms, changing areas, medical rooms, client confidentiality meetings and anywhere children are present.
4. Add a notice. Signage at premises, a line in the customer terms, and an on-device indicator that cannot be switched off by the wearer.
5. Limit storage. Keep recordings only as long as the purpose needs. Restrict who can view them and log access.
6. Cover personal devices. Say plainly whether staff may bring their own recording wearables to work, and what happens to footage taken on company time.
7. Plan for a complaint. If a person asks you to delete footage of them, who answers, and in how many days?

A Privacy Impact Assessment is the right tool if you want to roll out recording at scale, for example a camera-equipped field team across several cities.

What to do this quarter

Between now and May 2027, treat wearables as one more item on your data map. The consent managers framework opens on 13 November 2026, but it will not help with bystander footage; that is on you. Start with the inventory, then fix notices and retention.

If you want a structured way to find gaps, our free DPDP checklist is a good first pass, and the DPDP Act compliance page explains how we support teams that need a full gap assessment. For specific scenarios such as recording in a clinic or a co-working space, talk to us.

This article is general guidance on data protection and is not legal advice. Facts about the EDPB statement are drawn from the EDPB's announcement and press coverage; the statement is preliminary. For advice on your situation, speak to a qualified lawyer. Ready to check where you stand? Start with the DPDP checklist or contact us.