1. Meaning of Code-Based Compliance Claims

Code-Based Compliance Claims refer to legal claims arising from the assertion that a software system, algorithm, automated decision-making tool, digital platform, smart contract, or other computer code did not comply with applicable law, regulations, contractual obligations, technical standards, or legally mandated controls.

In simple terms:

Code-based compliance asks whether the legal requirement has been correctly translated into, implemented by, and enforced through computer code.

For example, a company may claim that:

• software automatically collected data beyond what law permitted;
• an algorithm discriminated against certain users;
• a banking system failed to apply legally prescribed transaction limits;
• an e-commerce platform's code concealed mandatory consumer disclosures;
• software failed to implement contractual security requirements;
• an automated system denied a statutory benefit;
• a smart contract executed a transaction contrary to a legal restriction;
• an AI system processed personal data without a lawful basis;
• a platform's algorithm failed to implement a regulatory takedown obligation; or
• source code contained a compliance defect that caused financial or regulatory loss.

Important: “Code-Based Compliance Claim” is not presently a single, universally recognized statutory cause of action in Indian law. It is better understood as a legal theory or category of disputes in which the functionality or architecture of software becomes relevant to determining statutory, contractual, regulatory, constitutional, intellectual-property, privacy, or tortious liability.

2. Central Idea: “Code” and “Law”

Traditional legal compliance generally operates through:

Law → Policy → Human implementation → Compliance

Code-based compliance increasingly operates through:

Law → Regulatory requirement → Business rule → Software code → Automated action

For example:

Data-protection law requires deletion of personal information after a prescribed period → company creates retention policy → software automatically identifies expired records → code deletes them.

If the code instead retains those records indefinitely, a question arises:

Can the organisation argue that it had a written compliance policy even though its software did not actually implement it?

Generally, merely having a policy is not necessarily enough. Depending upon the applicable statute and facts, courts may examine actual conduct, technical implementation, contractual commitments, reasonable security measures, causation and resulting harm.

3. Major Categories of Code-Based Compliance Claims

A. Privacy and Data-Protection Compliance

A system may violate legal requirements by:

• collecting excessive personal data;
• processing information for an unauthorized purpose;
• retaining data longer than necessary;
• failing to delete information;
• sharing information without authorization;
• inadequate access controls;
• inadequate encryption;
• unauthorized profiling;
• unlawful automated decision-making.

These claims become particularly important under India's constitutional privacy jurisprudence and the statutory data-protection framework.

B. Cybersecurity Compliance Claims

A claimant may argue that software failed to satisfy:

• security obligations;
• contractual cybersecurity requirements;
• reasonable-security standards;
• access-control requirements;
• incident-reporting requirements;
• vulnerability-management requirements.

The crucial question can be whether the security failure resulted from:

1. negligent coding;
2. inadequate testing;
3. defective architecture;
4. failure to patch;
5. improper authentication;
6. inadequate encryption; or
7. failure to follow contractual security specifications.

C. Algorithmic Compliance Claims

Algorithms increasingly make decisions concerning:

• credit;
• employment;
• insurance;
• pricing;
• fraud detection;
• content moderation;
• eligibility;
• advertising;
• consumer profiling.

A claimant may argue that an algorithm:

• discriminates;
• produces arbitrary outcomes;
• violates privacy;
• lacks procedural safeguards;
• improperly delegates governmental power;
• gives no meaningful explanation;
• applies legally impermissible criteria.

D. Contractual Code-Compliance Claims

Software contracts frequently contain provisions requiring:

• regulatory compliance;
• cybersecurity;
• data protection;
• uptime;
• auditability;
• encryption;
• access controls;
• logging;
• disaster recovery.

If the delivered software does not perform according to those requirements, the dispute may constitute:

breach of contract + software defect + compliance failure.

E. Smart-Contract Compliance Claims

Smart contracts create particularly difficult issues.

A blockchain transaction may automatically execute:

IF X happens → execute Y.

But legal obligations are not always identical to computer instructions.

For example, code may automatically transfer an asset even though:

• the transaction was induced by fraud;
• contractual consent was defective;
• a regulatory prohibition applied;
• the transaction violated consumer-protection law.

Thus:

“The code executed exactly as programmed” does not necessarily mean “the transaction was legally valid.”

4. Legal Foundations in India

Code-based compliance claims may derive from several legal sources.

1. Constitution of India

Particularly:

• Article 14 — equality and non-arbitrariness;
• Article 19 — freedoms subject to lawful restrictions;
• Article 21 — life, liberty, dignity and privacy;
• Articles 32 and 226 — constitutional remedies.

2. Information Technology Act, 2000

Important provisions include:

• Section 43 — compensation for specified unauthorized acts;
• Section 43A — compensation concerning failure to maintain reasonable security practices in specified circumstances;
• Section 65 — tampering with computer source documents;
• Section 66 — computer-related offences;
• Section 69A — blocking of public access;
• Section 70B — CERT-In;
• Section 79 — intermediary safe harbour.

3. Digital Personal Data Protection Act, 2023

The Act creates obligations concerning processing of digital personal data and therefore has direct implications for software architecture, consent mechanisms, security, retention, grievance handling and automated data processing.

4. Contract law

The Indian Contract Act, 1872 can become relevant where software fails to perform contractual compliance requirements.

5. Copyright law

Computer programs receive copyright protection under the Copyright Act, 1957. Consequently, copying, unauthorized use, disclosure or misuse of source code may generate separate claims.

5. Essential Elements of a Code-Based Compliance Claim

A strong claim normally requires establishing the following.

1. Applicable Legal or Contractual Requirement

The claimant must identify the rule allegedly violated.

For example:

“The software was contractually required to encrypt customer data at rest.”

or

“The processing was required to comply with applicable data-protection law.”

2. Relevant Technical Function

The claimant must identify what the software actually did.

For example:

• stored information;
• transmitted information;
• automatically rejected applications;
• retained information;
• disclosed information;
• executed payments.

3. Compliance Gap

The claimant must demonstrate the difference between:

What law/contract required

and

What the code actually did.

This is often the heart of the dispute.

4. Attribution

The claimant must connect the defect to the defendant.

Potential defendants include:

• software developer;
• vendor;
• cloud provider;
• platform operator;
• employer;
• data fiduciary;
• government authority;
• system integrator.

5. Causation

The claimant normally needs to establish that the compliance failure caused legally recognizable harm.

6. Loss or Legal Injury

Depending upon the cause of action, this may include:

• financial loss;
• privacy injury;
• unauthorized disclosure;
• denial of a legal entitlement;
• discriminatory treatment;
• contractual loss;
• regulatory penalty;
• reputational harm.

6. Importance of Source Code Evidence

Source code can become critical evidence.

Courts may require examination of:

• source code;
• object code;
• databases;
• system architecture;
• APIs;
• logs;
• configuration files;
• audit trails;
• access-control systems;
• version histories;
• Git repositories;
• testing reports.

The Supreme Court's decision in Diyora and Bhanderi Corporation v. Sarine Technologies Ltd. is particularly important because the dispute involved expert comparison of source and object code. The Court upheld the use of an expert while emphasizing that the comparison should remain within the scope ordered by the court and that confidentiality of source code must be protected.

Thus, source code is not merely “technical material”; in appropriate litigation it can become legally relevant evidence.

7. At Least 6 Important Case Laws

1. Shreya Singhal v. Union of India

(2015) 5 SCC 1

Facts

The case challenged provisions of the Information Technology Act, particularly Section 66A, and also examined the intermediary framework under Section 79 and blocking mechanism under Section 69A.

Decision

The Supreme Court struck down Section 66A as unconstitutional and upheld Section 69A subject to procedural safeguards. It also interpreted intermediary safe harbour under Section 79.

Relevance to Code-Based Compliance

This case demonstrates an important principle:

Technical implementation of a statutory power cannot escape constitutional limitations.

If software or platform architecture implements a governmental or statutory restriction, the underlying implementation must still comply with constitutional requirements.

For code-based compliance claims, this means that:

• automated blocking;
• content filtering;
• moderation systems; and
• platform controls

cannot be considered purely technical matters where fundamental rights are implicated.

The case also illustrates that statutory compliance cannot be separated entirely from the manner in which technology implements the statutory scheme.

2. Justice K.S. Puttaswamy (Retd.) v. Union of India

(2017) 10 SCC 1

Facts

A nine-judge Constitution Bench considered whether privacy is a constitutionally protected fundamental right.

Decision

The Supreme Court unanimously recognized privacy as a fundamental right under the Constitution.

The Court emphasized concepts including:

• dignity;
• autonomy;
• informational privacy;
• individual control over personal information.

Relevance

This is one of the most important foundations for code-based privacy compliance.

A software system can interfere with privacy through:

• data collection;
• tracking;
• profiling;
• surveillance;
• facial recognition;
• location monitoring;
• behavioural analysis.

Therefore, software architecture itself may become relevant to determining whether an organisation's processing respects constitutional privacy principles.

Principle:

Privacy compliance must be reflected not merely in legal documents but, where applicable, in the technical design and operation of information systems.

3. Anuradha Bhasin v. Union of India

(2020) 3 SCC 637

Facts

The case concerned restrictions on internet access in Jammu and Kashmir and the constitutional implications of restrictions affecting speech and press freedom.

Decision

The Supreme Court examined internet access in the context of Articles 19(1)(a) and 19(1)(g), requiring restrictions to satisfy constitutional standards.

Relevance to Code-Based Compliance

Modern restrictions can be technically implemented through:

• network filtering;
• blocking systems;
• ISP-level restrictions;
• application-level controls;
• automated filtering.

The case demonstrates that technological implementation does not eliminate constitutional review.

A government or regulated entity cannot simply argue:

“The computer system automatically imposed the restriction.”

The underlying legal authority, proportionality and procedural requirements remain relevant.

4. Diyora and Bhanderi Corporation v. Sarine Technologies Ltd.

Supreme Court, 2018

Facts

The dispute concerned alleged infringement of software copyright. The trial court ordered comparison of source and object code and appointed an expert for technical examination.

Supreme Court's Approach

The Supreme Court dealt with the evidentiary and procedural issues surrounding examination of software code and maintained the importance of keeping the comparison within the appropriate scope.

Relevance

This case is highly significant for code-based compliance litigation because it demonstrates that courts can:

• examine source code;
• obtain expert assistance;
• compare software versions;
• protect confidential technical information;
• limit disclosure to what is necessary.

Therefore, where a claimant says:

“The software did not comply with the contractual/legal specification,”

technical examination of the actual code may become essential.

5. Tarun Tyagi v. Central Bureau of Investigation

(2017) 4 SCC 490

Facts

The accused was alleged to have stolen source code belonging to his former employer and used it in another software product.

The dispute involved provisions of the Information Technology Act and Copyright Act.

Decision

The Supreme Court dealt with access to electronic evidence and source-code-related material while safeguarding against misuse of the confidential source code.

Relevance

The case establishes the evidentiary importance of source code in technology litigation.

It demonstrates that:

Access to source code can be legally necessary while simultaneously requiring confidentiality safeguards.

That principle is directly relevant when a claimant needs to prove a code-based compliance failure.

For example, a claimant may need to inspect code to establish:

• unauthorized data collection;
• hidden functionality;
• security defects;
• copied compliance logic;
• unauthorized access mechanisms.

The Court also recognized safeguards against misuse of disclosed source-code material.

6. Satyam Infoway Ltd. v. Sifynet Solutions Pvt. Ltd.

(2004) 6 SCC 145

Facts

The dispute involved competing internet domain names and the misuse of a distinctive online identity.

Decision

The Supreme Court recognized the commercial and legal significance of domain names and treated them as having characteristics analogous to business identifiers.

Relevance

Although not a direct “code compliance” case, it is important for the broader proposition that:

Digital systems and technical identifiers can produce legally protectable interests.

Consequently, compliance disputes involving:

• domain systems;
• digital identifiers;
• automated registration;
• online authentication;

cannot necessarily be treated as purely technical disputes.

7. Trimex International FZE Ltd. v. Vedanta Aluminium Ltd.

(2010) 3 SCC 1

Facts

The dispute concerned whether contractual obligations could arise from electronic communications exchanged between parties.

Decision

The Supreme Court recognized that contractual obligations may arise through electronic communications where the requirements of contract formation are satisfied.

Relevance

This is important because software systems increasingly automate contractual activity.

For example:

• click-wrap agreements;
• API transactions;
• automated purchase orders;
• electronic acceptance;
• digital signatures;
• automated invoicing.

A company cannot necessarily avoid contractual responsibility merely because the relevant action was generated electronically.

Code may execute a contract, but the legal validity of the underlying contractual relationship continues to depend on law.

8. State of Tamil Nadu v. Suhas Katti

2004 Cri LJ 4233

Facts

The case involved cyber harassment and publication of offensive material online.

Significance

It became an important early Indian cybercrime decision demonstrating that conduct carried out through computer networks could attract criminal liability.

Relevance

The case supports the broader proposition that:

Digital execution does not create immunity from ordinary legal responsibility.

Thus, if software or an online system facilitates conduct prohibited by law, the fact that the conduct occurred through technology does not by itself eliminate liability.

9. Sublime Software Ltd. v. Union of India

Delhi High Court, 2024

Facts

The case concerned the Briar application, a free and open-source software application, and governmental blocking under Section 69A of the Information Technology Act.

The petitioner challenged the blocking of the software/application.

Relevance

The case is especially useful for understanding the interaction between:

• open-source software;
• source code;
• governmental regulation;
• technological systems;
• Section 69A.

The litigation demonstrates that software architecture and the legal regulation of access to software can intersect directly.

10. Sunil Ahya v. Secretary General, Supreme Court of India

2026

A very recent development concerns a petition seeking access to source code used in the Supreme Court's Case Management System.

The Court declined to entertain the Article 32 petition but indicated that proposals concerning source-code sharing could be considered if security were not compromised.

The controversy illustrates an increasingly important principle:

Open-source status does not automatically mean unrestricted public disclosure of operational source code where privacy and cybersecurity concerns exist.

This is particularly relevant to code-based compliance because transparency itself may have to be balanced against:

• cybersecurity;
• privacy;
• confidentiality;
• system integrity.

8. Case-Law Summary Table

9. Code as Evidence of Compliance

One of the most important aspects of these claims is the distinction between:

Paper Compliance

The company says:

“We have a privacy policy.”

Operational Compliance

The company demonstrates:

“Our system actually implements the privacy policy.”

Code-Level Compliance

The company demonstrates:

“The software architecture itself technically enforces the required restriction.”

This produces three levels:

Policy → Process → Code

The stronger the regulatory requirement, the more important it may become to establish that compliance actually occurred at the operational level.

10. Example: Data-Protection Code Claim

Suppose a company promises:

“Customer information will be deleted after the legally permitted retention period.”

But its database contains code stating:

retain_customer_data = indefinite

and no deletion mechanism exists.

A claimant might argue:

1. the company had a legal/contractual deletion obligation;
2. the system was designed inconsistently with that obligation;
3. the failure was foreseeable;
4. the company failed to implement an appropriate technical control;
5. continued retention caused legally recognizable harm.

The dispute therefore moves from:

“Did the company have a policy?”

to:

“Did the company actually implement the policy?”

11. Example: Algorithmic Discrimination

Suppose an automated recruitment system evaluates candidates using:

• educational history;
• employment history;
• geographic information;
• historical hiring data.

If the algorithm systematically excludes a legally protected group, the claimant may challenge:

• the underlying criteria;
• training data;
• model architecture;
• decision rules;
• human oversight;
• audit procedures.

The central legal issue becomes:

Can an organisation avoid responsibility by saying that the discriminatory decision was generated by an algorithm?

Generally, technology does not automatically eliminate responsibility for unlawful conduct.

12. Code-Based Compliance and Smart Contracts

Smart contracts raise a particularly interesting legal problem.

Traditional contract:

Agreement → legal obligation → performance

Smart contract:

Agreement → coded conditions → automated execution

Suppose the code provides:

If payment is received, automatically transfer asset.

But later:

• the contract is rescinded;
• fraud is discovered;
• the transaction is prohibited;
• one party lacked legal capacity.

The computer may still execute the code.

Therefore:

Code execution and legal enforceability are conceptually different.

“Code is law” is therefore not a complete legal proposition.

The better proposition is:

Code is a mechanism for implementing conduct; law determines whether that conduct is legally permissible, enforceable or compensable.

13. Code-Based Compliance and Cybersecurity

A company may be contractually required to maintain:

• encryption;
• multi-factor authentication;
• role-based access;
• penetration testing;
• vulnerability management;
• security logging;
• backup systems.

If the company fails to implement these controls, a claimant may argue that the organisation breached its compliance obligation.

Evidence may include:

• source code;
• security architecture;
• audit reports;
• penetration-test reports;
• vulnerability scans;
• access logs;
• Git history;
• incident-response records.

14. Role of Experts

Code-based claims are technically complex.

Courts may require expert assistance concerning:

• software architecture;
• source-code comparison;
• algorithms;
• cybersecurity;
• encryption;
• databases;
• machine learning;
• system logs.

The Diyora & Bhanderi litigation is particularly illustrative of the judicial use of technical experts for source-code comparison.

The court does not simply ask:

“Does the program look similar?”

It may ask:

“What does the underlying code actually do?”

15. Confidentiality of Source Code

A major difficulty is that proving non-compliance may require disclosure of proprietary source code.

This creates competing interests:

Claimant's interest

Access sufficient technical evidence to prove the claim.

Defendant's interest

Protect:

• trade secrets;
• intellectual property;
• confidential algorithms;
• security architecture.

Possible judicial safeguards include:

• sealed-cover production;
• limited expert access;
• confidentiality undertakings;
• restricted inspection;
• independent experts;
• comparison limited to specified software versions.

Indian judicial treatment of source-code evidence illustrates the importance of balancing evidentiary necessity against confidentiality.

16. Defences Available to a Defendant

A defendant facing a code-based compliance claim may argue:

1. No legal duty

There was no statutory or contractual requirement requiring the particular technical implementation.

2. Substantial compliance

The system satisfied the legally required objective even though the claimant preferred another technical method.

3. Causation failure

A coding defect existed, but it did not cause the alleged injury.

4. Third-party interference

The incident resulted from:

• hacking;
• customer misuse;
• independent third-party software;
• unforeseeable external attack.

5. Contractual limitation

The agreement contains:

• limitation of liability;
• exclusion clauses;
• warranty limitations.

However, the enforceability of such clauses depends upon applicable law and the nature of the claim.

6. Force majeure

The event resulted from circumstances beyond reasonable control.

7. Regulatory uncertainty

The relevant legal requirement was ambiguous or had not been sufficiently established.

17. Remedies

Depending upon the legal basis, remedies may include:

Monetary Compensation

For:

• financial loss;
• privacy injury;
• contractual loss;
• unauthorized use;
• other legally recognized damage.

Injunction

A court may restrain:

• unlawful processing;
• unauthorized use of code;
• distribution of infringing software;
• unlawful automated activity.

Corrective Technical Measures

A court or regulator may require:

• deletion;
• modification;
• security improvements;
• access restrictions;
• system redesign.

Audit

Independent technical audit may be appropriate in suitable cases.

Source-Code Inspection

Courts may permit controlled examination by technical experts.

Declaratory Relief

A claimant may seek a declaration that the system or implementation violated a legal or contractual requirement.

18. Challenges in Code-Based Compliance Litigation

A. Technical Complexity

Judges must often understand highly technical systems.

B. Rapid Technological Change

Code can change faster than litigation proceeds.

C. Version-Control Problems

The software operating at the time of the alleged violation may differ from the current version.

D. Attribution

It may be difficult to determine whether the defect originated with:

• developer;
• vendor;
• customer;
• cloud provider;
• open-source component.

E. Third-Party Components

Modern software may incorporate hundreds of third-party libraries.

F. Black-Box Algorithms

Machine-learning systems can make decisions that are difficult to explain in conventional rule-based terms.

G. Confidentiality

Full disclosure of source code can expose trade secrets or security vulnerabilities.

19. Difference Between Code Defect and Code-Based Compliance Failure

This distinction is important.

A program can therefore be technically “working” and still be legally non-compliant.

20. Important Legal Principle

The most important principle can be stated as:

Technical correctness is not necessarily legal compliance.

A program may execute perfectly according to its specifications but those specifications themselves may violate:

• constitutional rights;
• statutory duties;
• privacy requirements;
• consumer-protection law;
• contractual obligations;
• intellectual-property rights.

Conversely, software may be technically imperfect without creating legal liability if no legally protected interest or enforceable obligation has been breached.

21. Exam-Ready Legal Principles

For examination purposes, the following propositions are useful:

1. Code-based compliance is an emerging interdisciplinary category rather than a single standalone cause of action.
2. The underlying legal duty must first be identified.
3. The claimant must establish what the software actually did.
4. Source code may become important evidence.
5. Courts can employ technical experts to understand or compare software.
6. Confidential source code may be protected through judicial safeguards.
7. Automated decision-making does not automatically eliminate legal responsibility.
8. Constitutional rights continue to apply to technologically implemented governmental actions.
9. Privacy principles can affect software architecture and data-processing practices.
10. Electronic transactions can generate legally enforceable contractual obligations.
11. “Code is law” is not a substitute for legal analysis.
12. Compliance should be evaluated through law + system design + actual operation + evidence + causation.

22. Conclusion

Code-Based Compliance Claims represent the growing intersection of law, software engineering, cybersecurity, data protection, contracts and constitutional rights.

The central question is not simply whether a program contains an error. It is:

Whether the actual operation of software satisfies a legal, regulatory, constitutional or contractual obligation.

Indian jurisprudence already provides important building blocks for this field. Shreya Singhal establishes constitutional limitations on technology regulation; Puttaswamy establishes privacy as a fundamental right; Anuradha Bhasin demonstrates that technological restrictions remain subject to constitutional scrutiny; Diyora & Bhanderi and Tarun Tyagi establish the evidentiary importance and confidentiality concerns surrounding source code; and Trimex confirms the legal significance of electronic contracting.

Accordingly, future code-based compliance litigation is likely to focus increasingly on algorithmic accountability, privacy-by-design, cybersecurity-by-design, automated regulatory compliance, smart contracts, AI decision-making, auditability and technical evidence.