Telecom DPDP compliance
licence duties sit beside the Act, not above it.

Operators already verify subscribers and retain records under licence conditions, so they often assume the DPDP Act adds little. It adds a great deal. Licence-mandated retention is an exception to erasure, but not an exemption from notice, purpose limitation or subscriber rights, and the commercial layer is where exposure sits.

The regulated core is fairly well governed: subscriber verification, call detail records, lawful interception. The exposure is in what is built on top. Location history used to sell footfall analytics, browsing or viewing data used to target ads, and device identifiers shared with an ad network are processing for purposes the subscriber did not agree to when they bought a connection. A CDR kept because the licence says so is lawful; the analytics product built from it is a separate purpose needing separate consent.

Media platforms have an additional problem: age. If a meaningful share of your audience is under eighteen, section 9(3)'s ban on tracking, behavioural monitoring and targeted advertising applies to them, whatever the account holder agreed to. A family plan with one adult payer and three child viewers is four Data Principals, and three of them cannot be targeted.

Every business that sends commercial SMS in India must register on an access provider's DLT platform, with its headers and templates. Promotional messages go only to people who have not blocked that category or who have given explicit consent recorded on the platform, and each must carry an opt-out.

TRAI's February 2025 amendment to the TCCCPR tightened several points. Promotional content mixed into a transactional or service message turns the whole message promotional. A promotional message must offer an opt-out in the message itself. A recipient who revokes consent may opt in again whenever they like, but the sender may not ask again for ninety days. Consent-seeking messages come from a designated short code. Complaints can be filed within seven days of receipt, and repeated violations can blacklist a sender across every operator for at least a year. TRAI noted that digital consent acquisition on DLT has been slow to take off.

TRAI consent and DPDP consent are different records for different questions. TRAI's asks whether this number may receive this category of message. The DPDP Act asks whether you may process this person's data for this purpose. A marketing SMS programme needs both, and the DLT record does not replace your own consent record.

Any company that sends OTPs, order updates or offers by SMS in India is a principal entity under TRAI's regulations, even if it has never thought of itself as touching telecom rules. It must register on a DLT platform, register its sender headers and message templates, and keep promotional traffic within the consent and preference rules.

The work is mostly classification. Each template is registered as transactional, service or promotional, and the category decides who may receive it. TRAI's 2025 explanatory memorandum limits transactional messages to those triggered within thirty minutes of a transaction the customer started; an offer bolted onto a delivery update makes the whole message promotional. Promotional messages then go only to subscribers who have not blocked that category, or who have given explicit consent through the DLT consent process. The SMS vendor handles the pipes, but the principal entity owns the templates and the consents, and is the one blacklisted when they are wrong. Keep your own DPDP consent record for the same person alongside, because TRAI's record answers a different question.

Under the Telecommunications (Telecom Cyber Security) Rules, 2024, notified in November 2024, a telecom entity must report a security incident affecting its network or services to the Central Government within six hours of becoming aware of it, with fuller details within 24 hours. The DPDP breach reports run alongside.

The October 2025 amendment to those rules created a category of telecommunication identifier user entities, meaning businesses that use phone numbers to identify customers or deliver services, and a government mobile number validation platform they may be directed to use. Banks, fintechs and platforms that treat a phone number as identity should watch this closely. If an incident involves subscribers' personal data, the Data Protection Board and every affected subscriber must be told, with the detailed Board report within 72 hours; the breach deadline calculator lays out the clocks together.

Platforms hosting user content should also read the AI governance guide for the synthetic content rules, and anyone handling young audiences the children's data guide. For the law underneath all of it, read the DPDP Act and Rules 2025 guide. To see what your own website does before a visitor answers the banner, run the free two-pass cookie scan. The consent platform holds versioned notices in 22 languages, a hash-chained consent ledger, withdrawal relayed to each processor, and rights requests and breaches on their statutory clocks. The industries overview compares all eight sectors.