Internet companies say draft telecom cybersecurity rules to extend regulatory oversight, raise costs

Time of India

2 days ago

NEW DELHI: Internet companies have cautioned that the
Department of Telecommunications
' (DoT) proposed Draft Telecommunication (Telecom Cyber Security) Amendment Rules, 2025, could extend regulatory oversight to non-telecom licensed entities and raise costs, which will dent profits and impact ordinary consumers.
The industry raised concerns that the proposed
telecom cybersecurity
amendments exceed the legislative scope of the Telecommunications Act, 2023, by creating a new category of entities –
Telecommunication Identifier User Entities
(TIUEs) – which cover a wide-range of non-telecom licensed
digital service providers
, such as e-commerce players, banks, food delivery, streaming, gaming, and others.
The new draft rules, in their current form, will apply to all 'telecommunication identifier user entities' (TIUEs), or entities that use phone numbers to identify customers or their transactions.
The
Internet and Mobile Association of India
(IAMAI), in its submission to the telecom department, said that the inclusion of digital businesses under the proposed amendments was in 'violation of the scope of the Telecom Act and amounts to regulatory overreach'.
IAMAI further said that the proposed creation of a Mobile Number Validation (MNV) platform and imposition of a verification fee (₹1.5/₹3) could prove to be a 'significant expense and compliance burden for digital businesses'.
'This might lead to increased service costs for end-users and reduced profit margins for businesses, particularly for start-ups and MSMEs (micro, small and medium enterprises) where such costs may be disproportionately felt,' it added.
IT industry association
NASSCOM
, in a letter to Devendra Kumar Rai, joint secretary (telecom), DoT, said one of the most pressing concerns of digital companies is the proposed fee of ₹1.5-3 per verification request via the MNV platform, which is nearly 30 to 60 times higher than the prevailing cost of existing one-time password (OTP)-based verification, which is basically under ₹0.1 per request.
'For platforms handling large transaction volumes or serving cost-sensitive user segments, such a pricing structure is economically unsustainable. Moreover, the lack of clarity on whether the fee applies per user or per transaction further complicates cost projections,' National Association of Software and Service Companies (NASSCOM) said in its letter, dated July 24, 2025.
It warned that smaller players, startups, and high-volume platforms will be 'disproportionately impacted', creating barriers to innovation and hindering the government's goals around digital inclusion and ease of doing business. 'This may also discourage small businesses in adoption of verification technologies,' said NASSCOM.
The
Broadband India Forum
(BIF), in its submission, said that the existing mechanisms, such as DoT's ICDR system and CEIR portal enable IMEI registration, verification, and blocking, noting that the draft telecom cybersecurity amendments add a 'duplicative step in IMEI allocation process for OEMs which would interfere with GSMA processes'.
'Do not operationalise the MNV platform, i.e., Rules 7A read with 2(cb) without a clear legal basis, defined purpose and privacy protections. If operationalised, MNV should be voluntary, especially due to the prohibitive costs of compliance impacting innovation and adoption of digital verification tools,' BIF said, adding that the provisions regarding fees should be reconsidered due to the absence of legislative sanction for the same.
BIF's members include global Internet and technology giants including Google, Microsoft, Meta Platforms, Netflix, among others.