DPDP Act for Telecom Operators & ISPs: Compliance Guide
Telecom operators, internet service providers, tower and infrastructure firms and communication platforms hold identity documents, call records, location trails and browsing metadata for most of the country. The DPDP Act and Rules apply to this data alongside telecom licence conditions and the Telecommunications Act.
Telecom is already heavily regulated, and the DPDP Act does not replace that. It adds a common framework for notice, consent, security, breach reporting and user rights over data telecom law does not fully cover, such as marketing, analytics and app data. Where a licence or law requires you to collect, retain or disclose data, those rules apply, and the Act expects you to use that data only for those purposes. Most duties take effect on 13 May 2027.
Who this covers
Mobile and fixed-line operators are Data Fiduciaries for subscriber, usage and location data.
ISPs and broadband providers hold subscriber KYC, IP assignment and traffic data.
OTT communication and messaging platforms are fiduciaries for accounts, contacts and metadata.
Resellers, franchisees and distributors collect KYC on the operator's behalf.
Network, billing, CRM and analytics vendors are usually Data Processors.
Personal data you are likely to hold
Key provisions for Telecom & ISPs
The parts of the Act and Rules that matter most here. Select a reference to read the full explanation.
Data voluntarily provided for a stated purpose, and disclosures to the State that a law requires, are legitimate uses.
Itemised notice and specific consent for marketing, analytics and sharing.
Security, breach intimation, erasure and written processor contracts.
Large operators are likely candidates for Significant Data Fiduciary status.
The Central Government can exempt State agencies for security and public order.
The Act works alongside the Telecommunications Act and licence conditions.
Penalties up to ₹250 crore for security failures.
01Subscriber KYC and licence-mandated records
Operators must verify subscribers and keep certain records under licence conditions and telecom law. Customers give identity data for that stated purpose, a legitimate use, and Section 8 lets you retain data law requires you to keep. The rule to remember is purpose limitation: KYC and mandated records exist for compliance. Do not reuse them for marketing, credit-scoring or analytics without a separate basis.
- Keep KYC documents in a restricted store with access logs.
- Apply the same standards to resellers and franchisees who capture KYC for you. Their weak controls are your breach.
- Set retention periods from the licence and telecom law, and erase after they expire.
02Call records, location and traffic data
Call detail records, tower locations and IP logs are among the most revealing personal data that exists. Use them for running the network, billing and meeting legal duties, and limit internal access.
- Processing logs and traffic data must be kept for at least one year under Rule 8, with proper access control. Telecom licences may require longer, and the longer period applies.
- Using location data for advertising or analytics is a separate purpose and needs consent.
- Share data with partners for their purposes only with clear consent and a written contract.
03Lawful access and disclosure to the State
Operators regularly respond to lawful requests from government agencies. Section 7 permits processing needed to meet a legal obligation to disclose information to the State, as long as it follows the law requiring the disclosure. Section 17 allows the Central Government to exempt specified State agencies from parts of the Act in the interest of security and public order.
Operationally: keep a verified request register, disclose only what the order covers, and limit the staff who can access interception and records systems.
04Marketing calls, messages and consent
TRAI's rules on commercial communications and the do-not-disturb registry continue to apply. The DPDP Act adds a consent layer for using personal data in marketing. Keep promotional consent separate from the service contract, honour withdrawal quickly, and make sure partner promotions are covered by a clear notice.
05Security, breaches and scale
Telecom networks are prime targets. Rule 6 sets the baseline, and telecom security requirements and CERT-In duties apply alongside. A breach means telling each affected subscriber and the Board, with a detailed report within 72 hours (Rule 7). Large operators should expect possible Significant Data Fiduciary status (Section 10), with annual audits and impact assessments (Rule 13).
Penalties
The Data Protection Board decides actual penalties after an inquiry. These are the maximum amounts in the Schedule to the Act and apply to every Data Fiduciary, whatever the sector.
A breach of a voluntary undertaking accepted by the Board carries the penalty applicable to the matter the undertaking covered.
Common situations
Treat it as a security failure you are responsible for. Move capture to controlled devices, train resellers and audit them.
That is a new purpose. Ask for consent, explain what is used, and let customers refuse without losing the service.
Verify the request is lawful, disclose only what it covers and keep a record of the request.
Keep records the licence and law require for their set periods, restrict use, and erase the rest.
You remain the fiduciary. Notify affected subscribers and the Board, and run telecom and CERT-In reporting in parallel.
Compliance checklist
Common mistakes to avoid
Reusing KYC data for marketing because it is "already there".
Weak controls at resellers and franchisees.
Treating location data as ordinary billing data.
Disclosing to authorities without verifying the request.
Running separate, uncoordinated breach processes for each regulator.
Common questions
Does the DPDP Act replace telecom regulation?
No. Section 38 makes the Act work alongside other laws. Where the Telecommunications Act or licence terms are stricter or specific, they continue to apply.
Can we keep KYC records after a subscriber leaves?
For as long as the licence or law requires. After that, erase them.
Do OTT messaging apps fall under the Act?
Yes, as Data Fiduciaries for accounts, contacts and metadata they process.
Can operators share data with the government?
Where a law requires disclosure to the State, Section 7 allows it, subject to that law. Section 17 also lets the Central Government exempt certain agencies.
Are marketing calls covered by the Act?
TRAI's commercial-communication rules apply. The Act additionally requires a lawful basis, normally consent, for using personal data in marketing.
What are the penalties?
Up to ₹250 crore for failing to take reasonable security safeguards and up to ₹200 crore for failing to report a breach, with actual amounts decided by the Board.