The architecture of surveillance is approaching a profound technological and normative transition. Artificial intelligence can already infer, classify and monitor human behaviour at unprecedented scale; biometric identification, large-scale data integration and algorithmic inference can expand the State’s capacity to identify, correlate and profile individuals. Quantum computing introduces a different but related challenge by threatening the cryptographic assumptions upon which the confidentiality and authenticity of digital life have long depended. Post-quantum cryptography (PQC) responds principally to that cybersecurity problem: it protects confidentiality, authentication and integrity against quantum-capable adversaries, but does not itself enlarge the State’s capacity to collect or infer information. This article therefore uses “quantum-ready surveillance” to describe surveillance infrastructures in which capability-expanding technologies operate within quantum-resilient security architectures, while keeping those functions analytically distinct. The study argues that quantum readiness presents a governance paradox, not because PQC itself creates new surveillance powers, but because more durable and quantum-resilient infrastructures may secure and preserve surveillance data generated through AI, biometrics, interoperable databases and large-scale collection. In an environment of “harvest now, decrypt later,” algorithmic decision-making and increasingly integrated governmental information systems, the constitutional problem concerns both the expansion of surveillance capability and the security architecture within which collected information is transmitted, authenticated and retained. Drawing upon India as the principal case study, with the United States and European Union as structured comparators, the article evaluates these developments against legality, necessity, proportionality, transparency, explainability and independent oversight. The article finds that the principal deficit is not merely technological preparedness but governance preparedness. Existing legal regimes remain fragmented, territorially bounded and institutionally uneven, while quantum-resilient digital infrastructures and AI-enabled surveillance operate across borders and institutional boundaries. It therefore advances an eight-component rights-centred model: technological resilience and crypto-agility; constitutional legality; privacy and rights by design; accountable AI; institutional accountability; risk-tiered governance; international interoperability; and technological equity. These components are operationalised through an integrated governance cycle—Resilience → Legality → Necessity → Privacy by Design → Risk Classification → Authorization → Auditability → Independent Oversight → Redress → Periodic Review → International Interoperability. Quantum security and human freedom need not be competing objectives; legitimacy depends upon ensuring that a quantum-secure State remains constitutionally restrained and democratically accountable.