Telecom Operators and ISPs: A DPDP Act Impact Study

Executive summary

A mobile operator knows who every subscriber is, whom they call and where their phone has been. An internet service provider (ISP) knows the address, router and session logs of every household it connects.

Telecom does not start from zero. Department of Telecommunications (DoT) licence conditions have long required confidentiality of customer information, storage of user information in India and minimum retention of call and internet records. Since 2024, rules under the Telecommunications Act, 2023 have added incident reporting, interception safeguards and, from August 2026, biometric identification of mobile users.

The Digital Personal Data Protection Act, 2023 (the DPDP Act) and the DPDP Rules, 2025 add a different lens: sector rules protect the network and the State's access to it; the DPDP Act protects the subscriber. A data fiduciary decides why and how personal data is processed; a data principal is the person it is about. The core duties, rights and penalties commence on 13 May 2027.

Headline rating: Overall impact High. Six of the twelve scorecard areas are High for a typical operator or ISP; cross-border transfers are Low because licences already keep user information in India.

The three biggest changes:

• One incident, three clocks. A breach can require a six-hour report to DoT under the Telecom Cyber Security Rules, a six-hour report to CERT-In, and, under the DPDP Rules, notice to the Data Protection Board and to every affected subscriber, with a detailed Board report within 72 hours.
• The point-of-sale chain becomes a processor chain. Biometric identification under the User Identification Rules, 2026 runs through retailers and distributors. Under the DPDP Act, the operator answers for every one of them.
• Commercial use needs its own consent. TRAI's spam regulations decide whether a message may be sent; the DPDP Act decides whether subscriber data may be used to target it. TRAI's 2026 amendment says so expressly.

Background

Telecom data falls into five groups:

• Identity: e-KYC records, live face photographs, document images and the subscriber data record.
• Traffic and location: call detail records (CDRs), internet protocol detail records (IPDRs), log-in records, cell-site location and device identifiers.
• Commercial: plans, recharges, billing, payments, post-paid credit checks and collections.
• Service: complaints, call recordings, app usage, broadband router telemetry and installation addresses.
• Messaging ecosystem: headers, templates, consent records and complaints on the distributed-ledger (DLT) platforms TRAI's spam regulations require.

The data principals include subscribers, end users of business connections, family members on shared plans, recipients of commercial calls and messages, and individual retailers and field engineers.

Data leaves the operator to law enforcement under lawful orders, to DoT and TRAI, to other operators for interconnection, roaming and number portability, and to vendors: network equipment suppliers with remote access, managed-service providers, billing and CRM platforms, call centres, point-of-sale distributors and retailers, local cable operators acting as ISP franchisees, and collection agencies.

Legal framework

The DPDP provisions that matter most

• Grounds (ss.4, 6, 7). Processing needs consent or a listed legitimate use. Section 7(a) covers data a subscriber "has voluntarily provided" for a specified purpose. Section 7(d) covers disclosures a law requires to be made to the State, and s.7(e) compliance with judgments and orders. A legal mandate to collect data is not, by itself, a ground: identity data collected for a SIM rests on s.7(a).
• Exemption for offences (s.17(1)(c)). Processing "in the interest of prevention, detection, investigation or prosecution of any offence" is exempt from most of the Act, except the duties to remain responsible for processors and to keep data secure (ss.8(1) and 8(5)).
• Notice and consent (ss.5–6; Rule 3). Consent must be "free, specific, informed, unconditional and unambiguous with a clear affirmative action", with a standalone itemised notice and easy withdrawal.
• Security, breach and erasure (s.8(5)–(7); Rules 6–7). Encryption, access control and a year of logs; breach notice to the Board and each affected person without delay, with a Board report within 72 hours; erasure when the purpose ends unless law requires retention.
• Rights (ss.11–14; Rule 14). Access, correction and erasure where processing rests on consent or s.7(a); grievances answered within 90 days.
• Significant Data Fiduciaries (s.10; Rule 13). The Centre may designate a Significant Data Fiduciary (SDF) considering volume and sensitivity of data, sovereignty and integrity of India, security of the State and public order. An SDF needs an India-based Data Protection Officer, an independent data auditor and an annual Data Protection Impact Assessment (DPIA).

Telecom law that applies alongside

• Telecommunications Act, 2023 (Act 44 of 2023, 24 December 2023), largely in force since 26 June 2024. Section 3(7) requires "verifiable biometric based identification" of users of notified services; s.20 permits interception on a public emergency or for public safety; s.22 empowers cyber-security rules; s.28 provides for prior consent to specified commercial messages, a "Do Not Disturb" register and an online grievance mechanism. Section 29 bars false particulars and impersonation, and s.42(3)(e) punishes obtaining SIMs by fraud or personation with up to three years' imprisonment, a fine of up to ₹50 lakh, or both.
• Telecommunications (Telecom Cyber Security) Rules, 2024 (G.S.R. 720(E), 21 November 2024; amended by G.S.R. 771(E), 22 October 2025). Rule 3 lets the Centre collect traffic data, but not message content, for cyber security. Rule 6 requires a Chief Telecommunication Security Officer who is a citizen and resident of India and reports to the board. Rule 7 requires a report within six hours of becoming aware of a security incident, and details within 24 hours, including the number of users affected; the Centre may tell the public or direct the entity to do so.
• Telecommunications (Procedures and Safeguards for Lawful Interception of Messages) Rules, 2024 (6 December 2024; amended 12 September 2025). Operators must keep interception matters secret, run internal checks against unauthorised interception, answer for unauthorised interception by their employees and vendors, and destroy interception records within two months after interception ends.
• Telecommunications (User Identification) Rules, 2026 (G.S.R. 750(E), 21 August 2026). Biometric identification before enrolment, updates, disconnection and reverification: Aadhaar e-KYC, or a document-based process with live face capture (D-KYC). Point-of-sale staff must not store user or biometric information; the subscriber data record must be confidential, secure and immutable and comply with data protection law. Operators have three months, extendable by three, to implement. The services notified under s.3(7) are wireless access and internet telephony through mobile user terminals.
• Unified Licence (UL). Clause 37.2 requires privacy and confidentiality of third-party information, disclosed only with written consent or in listed cases; clause 37.3 binds anyone acting for the licensee. Clause 39.23(viii) bars transferring subscriber accounting information and user information outside India, with roaming exceptions; clause 39.23(xi) limits remote access from abroad to approved locations. A DoT amendment of 21 December 2021 raised retention of commercial records, CDRs, IPDRs and log-in records from one year to two.
• The new authorisation regime. The Telecommunications (Authorisation for Provision of Principal Telecommunication Services) Rules, 2026 replace licences with authorisations for new entrants from June 2026; existing licensees may continue under their licences or migrate under s.3(6) of the Act.
• TRAI Telecom Commercial Communications Customer Preference Regulations, 2018 (TCCCPR). The Second Amendment of 12 February 2025 moved promotional calls to the 140 series and service and transactional calls to the 1600 series. The Third Amendment Regulations, 2026 (No. 05 of 2026, 18 September 2026) define consent as "explicit or inferred", require legacy consents to be registered on operators' digital platforms, and state that senders' obligations under the DPDP Act are preserved. Most provisions commence 30 days after Gazette publication.
• CERT-In Directions of 28 April 2022. Six-hour incident reporting and 180 days of logs kept in India.

How sections 38 and 16(2) fit them together

Section 38(1) makes the DPDP Act additional to other laws; s.38(2) makes it prevail in a conflict. Telecom rules mostly add duties rather than contradict it: two-year retention fits the s.8(7) exception, interception falls within s.17(1)(c), and disclosure required by law within s.7(d).

Section 16(2) matters most. The Act restricts transfers abroad only to notified countries, and none is notified, but s.16(2) preserves stricter laws. Clause 39.23(viii) of the UL and the authorisation rules' localisation terms therefore apply in full.

The dates

• 13 November 2026: consent manager provisions commence. A consent manager is a Board-registered company through which people give, manage and withdraw consent.
• 13 May 2027: the main duties, rights, Rules 3 and 5 to 16, and penalties commence.

No notification compressing this timeline has been issued as of October 2026, and no appointments to the Data Protection Board have been announced.

Analysis

The Trayambic DPDP Impact Scorecard

Overall impact: High

One incident, three clocks

Suppose a compromised billing server exposes the names, numbers and addresses of several lakh subscribers. Three reports follow:

• To DoT within six hours of becoming aware (Telecom Cyber Security Rules, rule 7), with users affected, duration, area and remedies within 24 hours.
• To CERT-In within six hours under its 2022 Directions.
• To the Data Protection Board and each affected subscriber without delay under Rule 7 of the DPDP Rules, followed within 72 hours by a detailed report to the Board covering causes, mitigation and the notices sent.

The first two protect the network; the third protects people, and must explain likely consequences and the steps subscribers can take. Because the Centre may also announce an incident itself, subscriber notices should be drafted in advance.

The practical answer is one incident record feeding three templates, owned by the Chief Telecommunication Security Officer, with the DPDP lead signing off the subscriber notice. Vendor contracts must require notice within hours, or the six-hour clocks cannot be met.

Biometric KYC and the point-of-sale chain

Biometric identification for every new mobile connection, SIM replacement and change of user mostly happens at a retailer's counter. Under the DPDP Act, those retailers and agents are almost always the operator's processors. Section 8(1) makes the operator responsible for them "irrespective of any agreement to the contrary", and s.8(2) allows processors to act only under a valid contract. Three controls follow:

• Nothing stays on the device. Enforce the Rules' storage ban technically: no local storage in the enrolment app, no document photographs on personal phones, no paper copies.
• Contract with every link. Distributor agreements should flow down data terms to retailers, including security, breach notice and audit rights.
• Watch the impersonation risk. Fraudulent SIMs are an offence under s.42(3)(e) of the Telecommunications Act, and an identity misused at a counter is also a personal data breach of the person impersonated.

Aadhaar adds its own limits. The Aadhaar Act restricts sharing of identity information (s.29), so e-KYC data should flow only into the subscriber data record and never into marketing or analytics systems.

Subscriber data beyond the network

The core service rests comfortably on s.7(a): a subscriber who takes a connection provides her data to receive the service, and billing, network management and customer care follow from that purpose. Commercial reuse does not:

• profiling usage or location to sell targeted advertising or insights;
• recommending third-party offers through the operator's app;
• sharing data with group companies in payments, entertainment or retail;
• credit or affordability scoring for partners.

Each needs consent under s.6 and a Rule 3 notice. Clause 37.2 of the UL already requires written consent before third-party information is divulged; the DPDP Act sharpens a duty operators should already meet.

The TCCCPR governs whether a sender may call or message a subscriber, and the 2026 amendment accepts "inferred" consent from an existing relationship. That is not DPDP consent: TRAI's amendment says senders remain bound by the DPDP Act and that revoking permission under its regulations is separate from withdrawing DPDP consent. An operator marketing its own plans needs both: a TCCCPR basis to send, and a DPDP basis to use the data that selects recipients.

Retention and rights

Telecom retention is well defined: two years for commercial records, CDRs, IPDRs and log-in records; destruction of interception records within two months after interception ends; 180 days of logs for CERT-In and a year of security logs under the DPDP Rules.

Everything else changes. Marketing profiles, app analytics, churned-customer lists and old call recordings have no statutory shelter and must be erased under s.8(7) once their purpose ends. A churned subscriber's KYC and CDRs stay for the licence period; her segments and promotional history should not.

Section 11 entitles a subscriber to a summary of her personal data and of who received it. Operators should build a standard response from the subscriber data record, billing and consent systems, excluding interception and investigation matters, which the s.17(1)(c) exemption covers and the Lawful Interception Rules keep secret.

Worked example: a regional fibre ISP

Consider a regional ISP providing fibre broadband in a dozen Tier-2 towns. It sells through local cable operators as franchisees, runs a cloud CRM, bundles streaming subscriptions and manages home routers through a foreign vendor's platform.

Identity. Fixed broadband is not notified under s.3(7), so the biometric rules do not apply. Franchisees still photograph identity documents on their own phones. They are its processors; enrolment should move into the ISP's own app.

Retention. IPDRs and log-in records stay for two years under the licence; CERT-In logs for 180 days. Streaming bundle data and marketing lists for disconnected customers are erased when the purpose ends.

Localisation. The router platform stores household telemetry abroad. That is user information. The DPDP Act alone would allow the transfer, but clause 39.23(viii) of the licence does not, and s.16(2) preserves it. The ISP needs India hosting, and the vendor's remote access must fit clause 39.23(xi).

A breach. Attackers encrypt the CRM vendor's systems and copy customer records. The ISP reports to DoT and CERT-In within six hours, notifies the Board and each affected customer without delay, and files the Board report within 72 hours. The vendor's failure does not reduce the ISP's DPDP liability.

SDF risk. Low, but it should still document its security programme to the Rule 6 standard.

Compliance framework

Roadmap to 13 May 2027

• Now to December 2026: complete the data map; finish User Identification Rules implementation within the three-month window; confirm localisation of all user information and vendor remote access.
• January to March 2027: launch the joint incident runbook; publish new notices and consents for commercial uses; sign revised distributor, franchisee and vendor contracts.
• April to May 2027: test subscriber rights responses; switch on deletion for non-statutory data; brief the board on SDF readiness.
• Ongoing: track TRAI and DoT amendments; audit points of sale; rehearse breach notification twice a year.

Recommendations

1. 1.Treat the licence as the floor: confidentiality and localisation exist, but subscriber rights and breach notices are new.
2. 2.Run one incident process with three outputs, and pre-approve subscriber notice templates.
3. 3.Make the point of sale a controlled processor environment, with no local storage and contractual flow-down to every retailer.
4. 4.Keep TCCCPR consent and DPDP consent as separate records, and never treat "inferred" consent to send as consent to profile.
5. 5.Split retention between licence-mandated records and commercial data, and delete the latter on schedule.
6. 6.Large operators should prepare now for SDF designation, including a DPIA, a data audit and an India-based Data Protection Officer reporting to the board.

Key takeaways

• A telecom breach can trigger three clocks: six hours to DoT, six hours to CERT-In, and notice to the Board and every affected subscriber, with a 72-hour Board report.
• Retailers and distributors doing biometric KYC are the operator's processors; the User Identification Rules bar them from storing user or biometric data.
• TRAI's 'inferred' consent to send commercial messages is not DPDP consent to profile or share subscriber data.
• Two-year CDR and IPDR retention is preserved by s.8(7); marketing and analytics data for churned customers is not.
• Licence bans on transferring user information abroad continue to apply through s.16(2) of the DPDP Act.