A billion subscribers.A billion Data Principals.

At telecom scale, a one-percent process gap is ten million people.

In one line: Only the Central Government can notify Significant Data Fiduciaries. Given the volume and sensitivity of subscriber data, large telecom operators are strong candidates and should prepare for Section 10 obligations.

The estate · TelecomHover to inspect

At scale, every small gap is a large number of people.

The scene

The SIM was activated at a roadside kiosk. The retailer photographed the ID on his own phone to 'save time'. Multiply that phone by a few hundred thousand retailers.

Where the thinking breaks

The unclear thoughtWhat it breaksThe clearer thought
Telecom law governs our data. Sectoral rules and DPDPA apply together; neither excuses the other. Build one control set that satisfies both.
Retailers are independent businesses. Where they collect for you, they are your processors. Govern the edge of the network like the core.
We'll deal with SDF status if notified. Volume and sensitivity make notification likely; the obligations take time to build. Build the SDF stack before the letter arrives.

Rights at scale

Access, correction and erasure requests at telecom volume cannot be handled by email. They need a product, with identity checks and timelines built in.

The full Telecom briefing

3 deep dives
Deep dive 01→

The network's weakest node is a retailer's phone.

A photographed ID on a personal phone is a breach with no date yet.
Deep dive 02→

Prepare for the letter before it arrives.

Significant Data Fiduciary is not a title. It is a timetable.
Deep dive 03→

A tenth of a percent is a hundred thousand requests.

Rights without a product are a queue. Queues become complaints.

Monday morning

  1. 01Audit five retail points for how IDs are captured and stored.
  2. 02Estimate annual rights requests at 0.1% of subscribers. Plan capacity.
  3. 03Draft the SDF readiness gap list.

Questions, answered plainly

Are telecom companies Significant Data Fiduciaries under DPDPA?

Only the Central Government can notify Significant Data Fiduciaries. Given the volume and sensitivity of subscriber data, large telecom operators are strong candidates and should prepare for Section 10 obligations.

Do retailers who collect SIM KYC count as Data Processors?

Where retailers collect and handle subscriber data on behalf of an operator, they generally act as Data Processors, and the operator remains responsible under Section 8(1).

Sector · InsuranceYour agent's phone is part of your data estate.Read → Sector · HR & StaffingThe candidate you never hired is still your Data Principal.Read → Sector · Hospitality & TravelGuests check out. Their passports stay.Read →

Tell us where your data sits.We'll show you where the exposure is.

A partner replies within one working day, with a first view on your penalty exposure.

Speak to a partner