Keep network, customer, and rollout data controlled across a connected ecosystem

Condition 37.2 of the Unified Licence agreement, in Chapter V of Part-I, provides that subject to the terms and conditions of the licence, the Licensee shall take all necessary steps to safeguard the privacy and confidentiality of any information about a third party and its business to whom it provides the Service and from whom it has acquired such information by virtue of the Service provided. Condition 37.3 adds that the Licensee shall take necessary steps to ensure that the Licensee and any person acting on its behalf observe confidentiality of customer information. Condition 39.19 records that the Licensor or its representatives will have access to the subscriber database.

Condition 39.5, in the Security Conditions chapter of the same agreement, provides that the Licensee shall be completely and totally responsible for security of their networks and shall have an organizational policy on security and security management, submitted to the Licensor within 90 calendar days. Condition 39.6 requires a network security audit once in a financial year. Condition 39.20 requires all commercial records and Call Detail Records, Exchange Detail Records, and IP Detail Records to be archived for at least two years for scrutiny by the Licensor for security reasons.

Section 22(1) of the Telecommunications Act, 2023, notified as Act No. 44 of 2023 in the Gazette of India of 24 December 2023, empowers the Central Government to make rules providing for measures to protect and ensure cyber security of telecommunication networks and services, and Section 22(3) allows any network or part of it to be declared Critical Telecommunication Infrastructure. Section 42(2) provides that whoever gains or attempts to gain unauthorised access to a telecommunication network or to data of an authorised entity, or transfers data of an authorised entity, shall be punishable with imprisonment which may extend to three years, or fine up to two crore rupees, or both. The Explanation records that data of an authorised entity includes call data records, internet protocol data records, traffic data, and subscriber data records.

The Telecommunications (Telecom Cyber Security) Rules, 2024, notified as G.S.R. 720(E) on 21 November 2024, require at Rule 7(1)(a) that a telecommunication entity report a security incident affecting its network or service to the Central Government within six hours of becoming aware of it, and at Rule 7(1)(b) that it furnish the number of users affected, the duration, the geographical area, the extent of impact, and the remedial measures within twenty-four hours. Rule 4(4)(a) requires a telecom cyber security policy covering safeguards, testing, risk assessment, rapid action, and forensic analysis, Rule 4(4)(h) requires a Security Operations Centre, and Rule 6 requires the appointment of a Chief Telecommunication Security Officer.

Section 8(5) of the Digital Personal Data Protection Act, 2023 requires a Data Fiduciary to protect personal data in its possession or under its control, including processing carried out on its behalf by a Data Processor, by taking reasonable security safeguards to prevent personal data breach. The Schedule provides a penalty that may extend to two hundred and fifty crore rupees for breach of that obligation, as determined by the Board. Subscriber acquisition forms, identity proofs, care records, and channel extracts all carry personal data of this kind.

The CERT-In Directions of 28 April 2022 require service providers, intermediaries, data centres, body corporate, and Government organisations to report the cyber incidents listed in Annexure I within six hours of noticing them or being brought to notice about them. Annexure I expressly includes unauthorised access of IT systems or data, data breach, and data leak. This duty runs alongside, and not instead of, the reporting duty under the Telecom Cyber Security Rules, 2024.

Condition 39.7.1 of the Unified Licence agreement records that the Government, through the Designated Authority, will have the right to impose conditions for procurement of Telecommunication Equipment on grounds of the defence of India or national security, and that the Designated Authority for this purpose shall be the National Cyber Security Coordinator. It provides that with effect from 15th June 2021 the licensee shall only connect Trusted Products in its network, and shall seek permission from the Designated Authority for upgradation or expansion of the existing network using equipment not designated as Trusted Products. The condition is footnoted to DoT letter no. 20-271/2010 AS-I (Vol.-III) dated 10 March 2021.

Regulation 5 of the Telecom Commercial Communications Customer Preference Regulations, 2018, made by TRAI on 19 July 2018, requires every Access Provider to develop an ecosystem that provides a facility for subscribers to register preferences and maintains complete and accurate records of those preferences, provides a facility to record consents acquired by senders and maintains complete and accurate records of consent, and provides for revocation of consent with corresponding updates. Regulation 26 requires records of complaints against registered and unregistered senders to be maintained on a daily basis for each service area.

The Telecom Commercial Communications Customer Preference (Second Amendment) Regulations, 2025, dated 12 February 2025, insert a proviso that consent shall not extend beyond the duration or discharge of the contract between the Sender and the Recipient. The amendment also provides that a sender may re-acquire the consent of a customer who has revoked it only after ninety days from the date of revocation, and requires headers unused for ninety days to be temporarily deactivated. Purpose-bound and time-bound handling of customer data is written into the regulation rather than left to practice.

The Information Technology (Information Security Practices and Procedures for Protected System) Rules, 2018 apply to organisations whose systems are notified under Section 70 of the Information Technology Act, 2000. They require the Chief Information Security Officer to share information security audit reports, post-audit compliance reports, and IT security service level agreements with NCIIPC, and to establish a process for sharing logs of the protected system. Telecom infrastructure is a candidate for such notification, and a declaration of Critical Telecommunication Infrastructure under Section 22(3) of the Telecommunications Act, 2023 is a separate, parallel mechanism.

The SEBI (Listing Obligations and Disclosure Requirements) (Second Amendment) Regulations, 2023 inserted Regulation 27(2)(ba), under which details of cyber security incidents or breaches or loss of data or documents are to be disclosed along with the quarterly corporate governance report, as may be specified. Listed operators, tower companies, and equipment vendors sit inside that reporting obligation in addition to their sector-specific duties.

Article 32 of Regulation (EU) 2016/679 requires the controller and the processor to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, and names pseudonymisation and encryption of personal data among them. Article 83(4) places infringements of Article 32 in the tier of administrative fines up to 10 million euro, or up to 2% of total worldwide annual turnover of the preceding financial year, whichever is higher. This reaches an Indian operator or vendor through European roaming, enterprise, and employee data.

Annex I to Directive (EU) 2022/2555 lists, under sector 8 Digital infrastructure, both Providers of public electronic communications networks and Providers of publicly available electronic communications services. Article 3(1)(c) treats such providers as essential entities where they qualify as medium-sized enterprises, and Article 3(1)(a) does the same for Annex I entities above that ceiling, with Article 3(2) placing the remainder among important entities. Article 21(2)(d) requires cybersecurity risk-management measures covering supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers, and Article 21(2)(h) requires policies and procedures regarding the use of cryptography and, where appropriate, encryption.

Article 23(4) of the same Directive requires an early warning within 24 hours of becoming aware of a significant incident, indicating whether it is suspected of being caused by unlawful or malicious acts or could have a cross-border impact, and an incident notification without undue delay and in any event within 72 hours, with an initial assessment of severity and impact and any indicators of compromise. Article 34 provides for administrative fines against essential entities of a maximum of at least EUR 10 000 000 or at least 2% of total worldwide annual turnover in the preceding financial year, whichever is higher.

Section 64.2010(a) of Title 47 of the Code of Federal Regulations requires telecommunications carriers to take reasonable measures to discover and protect against attempts to gain unauthorized access to customer proprietary network information. Section 64.2009(c) requires all carriers to maintain a record of all instances where CPNI was disclosed or provided to third parties, or where third parties were allowed access to CPNI, and to retain that record for a minimum of one year. These rules bind US carriers; an Indian operator or vendor meets them through US customers, subsidiaries, or carrier contracts.

Section 64.2011 of the same Title requires a telecommunications carrier to notify law enforcement of a breach of its customers' CPNI, and provides that as soon as practicable, and in no event later than seven business days after reasonable determination of the breach, the carrier shall electronically notify the United States Secret Service and the Federal Bureau of Investigation through a central reporting facility. The carrier may not notify customers or disclose the breach publicly until seven full business days have passed after that notification, subject to the urgency exceptions in the rule. Section 64.2011(d) requires carriers to maintain a record of any breaches discovered and of the notifications made, including a detailed description of the CPNI that was the subject of the breach, and to retain that record for a minimum of 2 years.