The Digital Personal Data Protection Act, 2023 (Act), read together with the Digital Personal Data Protection Rules 2025 (Rules), constitute the Magna Carta of India’s digital privacy and data protection framework. For telecommunications service providers (TSPs) and internet service providers (ISPs), although several substantive provisions of the Act are yet to come into force, the legislation does not simply introduce an additional layer of compliance. Instead, it fundamentally restructures how these entities are expected to conceptualise control over personal data and engage with both regulators and their customers. TSPs and ISPs sit at the centre of India’s digital ecosystem, acting as infrastructure providers, intermediaries, and increasingly, data-intensive commercial actors. The DPDP regime treats them accordingly, with expectations that go well beyond passive carriage of information.
The Semantics: An Overview of the Regime
At the threshold, the Act adopts a functional and activity-based approach. It does not carve out a bespoke category for TSPs or ISPs. Instead, their obligations are determined by whether they act as Data Fiduciaries, Significant Data Fiduciaries, or Data Processors, depending on the nature of processing undertaken. This distinction is critical. While core connectivity functions may appear neutral, in practice TSPs and ISPs routinely engage in extensive processing of personal data for billing, subscriber verification, traffic management, fraud detection, customer analytics, and value-added services, each of which squarely attracts the Act.
Customer onboarding in the telecom sector has long been shaped not only by license conditions under the Unified License, but also by binding directions issued by the Department of Telecommunications (DoT) and sectoral instruments administered by the Telecom Regulatory Authority of India (TRAI). KYC-driven collection of identity documents, address proofs, and biometric verification sits alongside the continuous generation of call detail records, location data, and usage metadata, all of which qualify as personal data under the Act.
Importantly, several elements that the DPDP regime now foregrounds already appear in fragments across existing telecom instruments. The Unified Licence contains security conditions requiring confidentiality of subscriber information, restrictions on unauthorised disclosure, prohibitions on private monitoring, and mandated security practices for handling customer data. The Telecommunication Act, 2023, reinforces State control over networks and user communications, implicitly recognising the sensitivity of subscriber data. TRAI has repeatedly engaged with these issues through its consultation papers, discussions, and recommendations , each of which flags concerns around secondary use of subscriber data, informed customer choice, and transparency in data practices. In a narrower commercial context, the Telemarketers Commercial Communications Customer Preference Regulations, 2018, read with TRAI’s directions on unsolicited commercial communications, introduce consent-based controls for the use of subscriber contact data for telemarketing and promotional messaging.
While the Act does not override sectoral mandates, it fundamentally recalibrates the legal basis for downstream data processing. The Act now compresses the latitude historically exercised under expansive interpretations of KYC and service enablement, making clear that deemed consent is not a residual category that legitimises all processing linked, however loosely, to regulatory obligations. Data collected to meet licence conditions cannot be repurposed for analytics, profiling, or cross-selling merely because it was lawfully obtained at onboarding. The legal basis for processing must therefore be revisited, typically through fresh, purpose-specific, and revocable consent distinct from the initial onboarding authorisation.
ISPs face a parallel yet distinct challenge regarding traffic and metadata. Metadata such as IP addresses, session logs, timestamps, and location indicators are undeniably personal data when linked to an identifiable individual. The DPDP regime does not recognise an intermediary exception for such data. Where ISPs determine the purpose of processing, rather than merely executing transmission as a technical function, their role is recast from passive intermediaries to Data Fiduciaries with statutory obligations.
Functions such as network optimisation, traffic management, cybersecurity monitoring, or behavioural analytics are not purpose-neutral, as they require affirmative decisions on why data is processed, the extent to which it is aggregated or correlated across users and devices, and the duration for which it is retained. Importantly, several categories of security-related processing, including logging, monitoring, and traffic data retention, flow from mandatory sectoral obligations. The DPDP Act does not override these sectoral mandates. Instead, it operates alongside them by constraining discretion beyond what is strictly required for compliance. The consequence is that engineering or security justifications, standing alone, no longer suffice as legal cover. Each processing activity must be anchored to a clearly articulated and limited purpose that satisfies the necessity and proportionality requirements, with retention periods aligned with the duration prescribed under the Unified Licence, and any retention beyond such mandatory periods must be defensible only where independently justified under the DPDP framework.
Significant Data Fiduciaries: Higher Duties, Higher Risk
One of the most consequential aspects of the DPDP Act for TSPs and ISPs is the concept of Significant Data Fiduciaries. Given the scale of data processed, the sensitivity of communications-related information, and the potential impact on public order, large telecom and internet access providers are prime candidates for designation by the Central Government. Once designated, obligations intensify. The appointment of a Data Protection Officer based in India, mandatory data protection impact assessments, and independent audits become non-negotiable.
Data breach obligations clearly illustrate the reallocation of risk under the DPDP regime. TSPs and ISPs have traditionally managed security incidents through license conditions and sectoral advisories, with discretion in assessing materiality and controlling external disclosure. The Act disrupts this equilibrium by imposing a notification obligation for any personal data breach, requiring disclosure to the Data Protection Board of India (Board) and the customers. In a networked environment characterised by high data volumes, constant traffic, and layered systems, even short-lived, localised or technically contained incidents may meet the statutory threshold. This would compel operators to resolve, in real time, complex questions of breach classification, evidentiary sufficiency, and cross-departmental coordination.
Further, many network management, cloud hosting, and customer support functions rely on global infrastructure. The DPDP Act adopts a permissive but conditional approach, allowing cross-border transfers except to jurisdictions specifically restricted by the Central Government. This operates against the backdrop of the Unified Licence, which already restricts the transfer of subscriber information outside India and mandates domestic control over specified categories of telecom data, such as user and accounting information.
Intermediary Status, Consent Architecture, and Enforcement Risk
The interaction between the DPDP Act and intermediary liability regimes is particularly nuanced. ISPs often rely on safe harbour protections under the Information Technology Act, 2000. However, data protection obligations operate independently of content liability. Compliance with takedown procedures or lawful interception directions does not absolve an ISP from ensuring that personal data is processed lawfully. In fact, the DPDP regime heightens scrutiny over how interception and monitoring data is accessed and retained.
Consent management emerges as a practical pressure point. Telecom consent frameworks have traditionally been licence-driven, bundled, and opaque, while the DPDP regime demands revocability and specificity. For TSPs, this means re-engineering customer pathways, particularly in mobile applications and online portals, to separate core service provisioning from ancillary data uses. For ISPs, it requires transparency around logging practices and third-party integrations that were previously buried in terms of service.
