Archive · 28 Nov 2025
COAI Flags Compliance Hurdles in India's Data Protection Rules
The Cellular Operators Association of India (COAI) has raised concerns about India's new data protection rules.
They say some parts are unclear or too strict.
For example, they think the rules about getting permission from kids aged 16-18 for SIM cards are hard to follow.
They also want a single system for managing permissions and a unified timeline for reporting data breaches.
COAI believes these changes will make it easier for companies to follow the rules and protect people's data.
The government, however, insists on strict measures to ensure children’s safety and cohesive compliance across different regulatory frameworks.
COAI highlights ambiguities and stringent provisions in India's Digital Personal Data Protection (DPDP) Rules.
Concerns include children’s data, breach reporting, consent-manager mechanisms, and legislative overlap.
COAI proposes a single, interoperable consent-management layer for the telecom sector.
They suggest a unified breach-reporting timeline and a risk-based approach to security compliance.
COAI argues for accepting Data Protection Impact Assessment reports recognized by global frameworks like GDPR.
- Who
- Cellular Operators Association of India (COAI)
- What
- Issued a statement on compliance hurdles in India's Digital Personal Data Protection (DPDP) Rules
- When
- November 27, 2025
- Where
- India
- Why
- To address concerns about verifiable consent for minors, breach reporting, consent-manager mechanisms, and legislative overlap
COAI
Government
Verifiable Consent for Minors
COAI
COAI suggests a practical exemption for minors aged 16–18 for SIM acquisition, arguing that obtaining verifiable parental consent for this age group is challenging and counter to digital autonomy.
Government
The DPDP rules require verifiable parental consent for users under 18 to ensure children’s safety.
Breach Reporting Requirements
COAI
COAI advocates for a unified breach-reporting timeline and a harmonised reporting window to avoid duplication and ensure cohesive compliance across regulatory regimes.
Government
The DPDP rules mandate separate reporting obligations under different frameworks, including the IT Act, CERT-In directions, and DoT guidelines.
Security Safeguards
COAI
COAI argues for a risk-based approach to assessing the adequacy of security safeguards, considering the existing robust measures deployed by telecom service providers.
Government
The DPDP rules outline specific measures such as encryption, obfuscation, and masking as reasonable security safeguards.
- Organization
- Cellular Operators Association of India (COAI)
- Date
- November 27, 2025
- Key Concerns
- Verifiable consent for minors, breach reporting, consent-manager mechanisms, legislative overlap
- Proposed Solutions
- Interoperable consent-management layer, unified breach-reporting timeline, risk-based approach
- Global Framework
- GDPR
- Government Body
- NITI Aayog
- Compliance Timeline
- 12–18 months from November 14, 2025
- Data Protection Act
- Digital Personal Data Protection Act, 2023
Sources
Data protection rules yet to clear up ambiguities on compliance: COAI
Indian telcos seek clarity on data protection rules, flag gaps in compliance framework: COAI
Telecom industry flags compliance hurdles in digital personal data rules
Telecom operators slam Trai’s draft rules, call 1% turnover penalty excessive
Chilling effect of a privacy upgrade
DPDP draws the consent line for AI, but industry still sees grey zones
