Indian telcos seek clarity on data protection rules, flag gaps in compliance framework: COAI

India’s telecom operators have said the country’s newly notified digital data protection rules still leave key compliance requirements unclear and in some cases impose obligations that may conflict with existing sectoral regulations, industry body COAI said on Thursday.

The Cellular Operators Association of India flagged concerns around children’s data, consent management, breach reporting and legislative overlap, noting that issues raised during earlier consultations “remain unaddressed”.

COAI said rules governing consent managers are “overly stringent”, particularly provisions barring directors and key personnel from having any association with data fiduciaries. Several technology, financial and telecom companies have the experience to run responsible consent-management systems, it said.

The industry body proposed that telecom operators be allowed a single, interoperable consent-management layer, or be exempted from using external consent managers where they have robust and auditable in-house systems that meet DPDP standards.

On children’s data, COAI said obtaining verifiable parental consent for users aged below 18 is difficult in Indian household structures. It reiterated its request for a practical exemption for minors between 16 and 18 years of age for SIM acquisition.

The association also pointed to overlapping breach-reporting obligations under the IT Act, CERT-In directions, Department of Telecommunications guidelines and the DPDP framework. It said the Data Protection Board should adopt a calibrated, risk-based approach aligned with the telecom sector’s existing security architecture.

COAI recommended a harmonised breach-notification model across regulators, consistent with recent NITI Aayog panel recommendations aimed at improving ease of doing business. It also asked that Data Protection Impact Assessments recognised under global frameworks such as the GDPR be accepted by Indian authorities.

The group said telecom service providers already deploy mature network and system security controls, and that compliance requirements should be evaluated in a layered, risk-based manner rather than through prescriptive tools such as encryption or masking alone. It also raised concerns over the Act’s overriding effect on sector-specific laws, saying specific laws should prevail in case of conflict.