Telecom Cybersecurity Rules, 2025

The parent instrument is the Telecommunications (Telecom Cyber Security) Rules, 2024. The Telecom Cyber Security Amendment Rules, 2025, which came into force on 22 October 2025 via Gazette Notification G.S.R. 771(E), formally define the Telecommunication Identifier User Entity (TIUE). A TIUE is any non-licensee entity (for example, a Bank, e-commerce app, or Fintech) that uses telecom identifiers (mobile numbers, IMEI) for user verification. TIUE-related processing overlaps significantly with 'personal data' under the DPDPA. Processing of TIUE data must comply with both the Telecom Cyber Security Rules and the DPDPA's requirements.

The Rules establish a Mandatory National Verification (MNV) Platform under Rule 7A. The MNV Platform is decentralised by design - it does not create a large central database of its own. Instead, it acts as a real-time validation bridge: a TIUE sends a request, and the MNV routes it to the relevant Telecom Service Provider (TSP) to confirm whether the number belongs to the claimed identity. The MNV Platform's operations remain subject to DPDPA requirements including purpose limitation, security safeguards, and - depending on its designation - potential SDF obligations.

The Rules establish a framework for IMEI-based restrictions on stolen, counterfeit, or non-compliant devices. Under the 2025 Rules, entities in the resale market are now statutorily required to 'scrub' (check) every IMEI against the central blacklist before sale. This is a mandatory safety requirement that overrides the need for user consent for that specific check. The interplay between IMEI tracking and DPDPA's purpose limitation principle requires careful analysis - IMEI data collected for security purposes should not be used for other purposes without separate consent or lawful basis.

The Rules mandate reporting of cybersecurity incidents to the Central Government within 6 hours of becoming aware of the incident, with a detailed follow-up report to be furnished within 24 hours. This is separate from, and additional to, the distinct CERT-In incident reporting direction, and is significantly shorter than DPDPA's R.7 breach notification framework, which requires notice without delay followed by a detailed report to the Board within 72 hours of becoming aware of the breach. Telecom entities cannot 'choose' a single timeline - they must meet the 6-hour Central Government report and the 24-hour follow-up report, separately satisfy any CERT-In reporting direction, and then follow up with the DPDPA's 72-hour detailed submission to the Board. A unified incident response process that meets the stricter telecom timelines while also satisfying DPDPA's content requirements is the most efficient approach.