Lowdown: DoT notifies network authorisation rules, bars telecom data from leaving India

The pdf of rules can be accessed here.

The Department of Telecommunications (DoT) notified the Telecommunications (Authorisation for Telecommunication Network) Rules, 2026, on July 20. The rules took effect upon publication and replace the network-side licensing regime that operated under the Indian Telegraph Act, 1885.

Six authorisations now cover the infrastructure layer of India’s telecom networks. Five apply nationally. Mobile number portability (MNP), which lets a subscriber keep a number while switching operators, applies across two zonal areas and comes through bidding.

Here is a lowdown of the rules and some questions they raise:

1. All network data stays in India: Rule 25(3) requires every system of a telecommunication network to sit inside India, along with all associated data, logs and information. No copy may be routed, shared or made available outside India.

The clause carries no proviso and exempts no category. It applies in full to the cloud-hosted telecommunication network provider, a new authorisation covering functions that once ran on dedicated telecom hardware and now run as software on generic servers.

Rule 25 also requires prior approval before building in security sensitive areas, adherence to Survey of India maps along international borders, and location details of all network systems on DoT’s direction.

2. Remote access requires prior permission and a mirror system: An entity providing remote access to its network from outside India must obtain DoT permission first. The application must disclose the purpose, duration, the person accessing the network, and the specific Indian location involved.

The permission carries conditions:

• Access is permitted only between approved locations and only for the stated purpose.
• Access cannot extend to lawful interception systems, lawful interception and monitoring facilities, call detail records, call content, or other sensitive data DoT specifies.
• The entity must install technical systems at the approved Indian location, connected to the approved foreign location, letting DoT monitor a mirror image of what is available abroad.
• An audit trail of remote access activity must be retained in India for six months.

3. Six authorisations, and what each permits: Rule 7(4) makes every authorisation non-exclusive. DoT can authorise any number of entities for the same network in the same area.

• Infrastructure provider holders build and share the passive layer, covering towers, ducts, dark fibre, right of way (RoW) and in-building solution (IBS) infrastructure. Rule 38 stops them at the physical kit. They may share passive infrastructure, right of way and in-building solution infrastructure on fair and non-discriminatory terms.
• Digital connectivity infrastructure provider holders build the active access layer, covering wireline terrestrial networks, radio access network (RAN), wireless local area network (WLAN) and in-building solutions….