DPDP Compliance for Telecom: Subscriber Data, Consent and Retention

DPDP compliance for telecom requires operators to govern subscriber data at activation, in network operations and through billing. Support and marketing teams handle the same data under their own permissions. The implementation must connect DPDP purposes and rights with the applicable Department of Telecommunications obligations and TRAI commercial-communication rules. Each regime covers a different part of the subscriber relationship.

Privacy, compliance and technology teams need to identify what each system processes and which permission or legal ground supports it. They also need to know what must happen when a subscriber changes a preference, ports a number or closes an account.

When should telecom operators prepare for DPDP compliance?

The core DPDP obligations commence on 13 May 2027. Rule 4, the Consent Manager registration framework, commenced on 13 November 2026. Operators can use the months before May 2027 to prepare notice and consent workflows, followed by rights and retention processes, while existing telecom requirements continue to apply throughout that period.

The DPDP Act covers digital personal data and offline information that is later digitised. Application forms entered into provisioning systems can therefore fall within scope, as can identity-document scans and identifiable support recordings. A Data Fiduciary decides the purpose and means of processing, and a Data Processor acts on its behalf.

Your telecom DPDP readiness programme should cover onboarding for mobile and fixed services, plus enterprise accounts and retail outlets. Call centres and apps belong in the same scope, along with outsourced operations. A vendor's physical location or collection channel gives an incomplete picture of its role.

Which subscriber data belongs in the assessment?

Subscriber data covers identity and contact details, service identifiers and billing details. Subscriber data extends to usage records and to information generated during support or network operation. Some technical identifiers become personal data when they relate to an identifiable individual.

An inventory should separate the mobile number from the subscriber identity, and both from SIM or device identifiers, while recording the account relationship and dates of service. Where they apply, call detail records and network-derived location belong in the inventory. Payment references and complaint attachments come next, followed by app events and recorded interactions.

The same person can hold multiple connections, and one enterprise account can cover many individual users. An operator can later allocate a mobile number to a different person. You should preserve the link between an identifier and its valid service period so that consent and rights requests reach the correct subscriber record.

Your record for each data flow should state the purpose, the source and the responsible entity. The record should also name the recipient, the access rights and the retention trigger. Copies held in analytics systems and dealer portals need tracing, as do those in fraud tools and contact-centre platforms. The resulting register gives you a workable basis for subscriber data protection across systems.

How does DPDP compliance for telecom differ from DLT consent?

DPDP consent governs the processing of personal data for specified purposes. TRAI's commercial-communication framework governs relevant communications sent through telecom resources, from sender registration and customer preferences to consent processes. The records may connect with each other, though their legal scope remains distinct.

A Distributed Ledger Technology (DLT) platform supports telecom commercial-communication controls. TRAI's Digital Consent Acquisition framework covers how consent is acquired and revoked in that ecosystem, along with how it is maintained. A DPDP notice must describe the personal data and processing purposes that the Act and Rules require.

For telecom consent management, capture the purpose permission and the communication permissions as separate attributes. A promotional SMS campaign should pass the relevant checks before dispatch. A DLT record alone leaves broader activities uncovered, such as sharing identifiable usage data for an unrelated commercial purpose.

Your campaign vendors and Principal Entities (the registered senders of commercial messages) should agree how preference changes reach the relevant records. The agreement should name the sender, the communication category and any separate consent-dependent use of subscriber data.

What changed in TRAI's September 2026 framework?

TRAI issued the Third Amendment to its commercial-communication regulations on 18 September 2026. The official explanation covers AI-assisted spam enforcement and Application-to-Person calls, along with legacy consent and access for Virtual Network Operators to relevant DLT systems.

For migration planning, the legacy-consent change carries the most weight, because it decides which existing permissions an operator can carry forward. The framework recognises legacy permissions only where they were obtained through verifiable means and then registered on the telecom providers' digital platform. An operator that treats every historical consent as reusable would overlook those conditions.

The amendment also requires advance declaration of Application-to-Person calling. Senders must give the telecom service provider the calling identifiers they use. Implementation teams should map the applicable commencement provisions and operational directions into their calling controls.

You should maintain separate migration checks for TRAI records and DPDP records. For consent given before commencement, Section 5(2) of the Act requires a notice to the subscriber as soon as reasonably practicable after commencement. Processing can continue until the subscriber withdraws consent. The section therefore does not call for a blanket re-consent exercise across the existing base.

How should operators separate service processing from optional uses?

You should document the ground and purpose for each activity, from identity verification and provisioning to billing and support. Statutory disclosures need an entry of their own, as do optional personalisation and third-party promotions. Section 4 allows processing on consent or on the legitimate uses listed in Section 7. The appropriate ground depends on the facts.

Data that a subscriber volunteers for a specified purpose may fall under Section 7(a), subject to its conditions. A legal duty to disclose information to the State or its instrumentalities falls under Section 7(d). Neither supports a general permission for all telecom processing.

Your notices should describe the data and purpose in clear language and give accessible routes for withdrawal and rights. Rule 3 asks for a notice that can be understood independently of any other information. Section 6 calls for consent through a clear affirmative action, with an ease of withdrawal comparable to giving consent.

Consider a hypothetical subscriber who accepts a broadband connection and declines partner promotions. Provisioning and billing follow their assessed grounds, while the marketing system records the promotional choice on its own. If the subscriber later opts in to a particular offer, that purpose updates without any rewrite of the earlier consent history.

Device permissions leave a gap of their own: an operating-system prompt to allow location or contact access does not, by itself, explain every purpose, recipient or retention condition that personal-data processing requires.

How does DPDP compliance for telecom affect retention?

Telecom data retention depends on the record category and the applicable licence or authorisation, together with statutory directions and preservation requirements. DPDP adds a purpose-based framework with legal-retention exceptions. It sets no single deletion period for all telecom records.

The DoT amendment to the Unified License dated 21 December 2021 requires operators to archive specified commercial records for at least two years. Call Detail Records, Exchange Detail Records and IP Detail Records carry the same minimum. Relevant subscriber login and logout logs also have a two-year minimum. Because the licence permits further directions, operators should check the applicable clause and current instructions for each service.

Under the scheduled DPDP regime, Rule 8(3) sets a minimum one-year retention period for personal data, associated traffic data and processing logs held for Seventh Schedule purposes. Section 8(7) recognises retention that another law requires.

Your retention schedule should therefore name each record and its legal requirement. Each entry should also carry a start event and period, plus any preservation hold or deletion approval. A promotional audience, a network log and a subscriber application record can each need different treatment.

After a subscriber withdraws consent for optional marketing, the relevant processing stops and the instruction propagates across connected systems. Required telecom records stay under restricted access for their applicable period. Restricting an archive helps prevent its continued use for purposes that no longer have a valid basis.

How should operators handle subscriber rights and vendor access?

Subscriber rights management depends on reliable identity matching, proportionate authentication and coordinated action across systems. Sections 11 to 14 of the Act cover access to information, correction and erasure, grievance redressal and nomination, each on its own terms.

A correction request should separate subscriber identity data from an issued bill or a historical network event. The legally required original stays preserved, and the approved correction is recorded beside it. For erasure, the team identifies mandatory records, explains the retention basis and completes the eligible deletions.

You should test reassigned numbers and enterprise administrators in the authentication process. Possession of a current number alone may fall short of authorising disclosure of historical subscriber information. Access responses should protect information about other individuals.

Contracts with dealers, contact centres, cloud providers and analytics processors should settle who has access and on whose instructions. They should also cover sub-processors, security escalation and the return or deletion of data. Section 8 of the Act keeps the Data Fiduciary responsible for processing done on its behalf.

You should review the telecom cybersecurity framework separately. DoT's Telecom Cyber Security Rules, 2024, and their later amendments address network and service security, including specified data and incident arrangements. The applicable telecom process and a DPDP personal-data-breach process may need assessing in parallel.

What should a telecom implementation test demonstrate?

A useful test follows one subscriber from assisted activation through a marketing preference change and a support request to eventual disconnection. The test should show what each connected system receives and which records stay lawfully preserved.

For DPDP compliance for telecom, assess these operational outcomes:

• The capture record identifies the subscriber, purpose, notice version, language and channel.

• Preference changes reach campaign and partner systems, with failure alerts and retry evidence.

• Rights requests reach the relevant provisioning, billing, support and archive owners.

• Retention rules distinguish marketing data from mandatory network or subscriber records.

• Vendor access ends or changes when the approved instruction requires it.

• Historical consent evidence survives account migration without becoming a new subscriber's permission.

Your team should define measurable synchronisation and recovery targets from the service architecture. In an evaluation of DPDP consent management software, ask for evidence of both the preference record and the downstream action.

As a consent management platform, OneConsent offers consent and preference management, Data Principal Rights and audit-trail modules that an operator can evaluate against these workflows. The operator's systems, identity model and telecom consent management requirements decide its suitability.

The DPDPA readiness guide can help your team organise the wider implementation review.

Book a demo to discuss subscriber consent, rights and evidence across the channels your business operates.