India’s new cybersecurity rules are set to increase compliance costs for telcos, potentially leading to higher mobile service prices and raising concerns about the privacy of mobile users, according to senior telecom executives and legal experts.
The rules, which require telcos to report cybersecurity incidents to the government within six hours, have been criticized for their ambitious timeline compared to laws in the US and EU. Additionally, concerns have been raised about the lack of clarity around the type of data that can be requested by the government.
Leading corporate lawyers have highlighted worries about the privacy of mobile service consumers, noting that the rules do not define ‘traffic data’ or specify limits on data retention. This ambiguity could allow for indefinite retention of private consumer data without legal constraints.
The Department of Telecommunications recently notified the new cybersecurity rules, which mandate telecom entities to appoint a chief telecommunications security officer and report security incidents promptly. Legal experts have suggested that certain aspects of the rules need to be reworked to ensure a balance between constitutional rights and cybersecurity concerns.
While telco executives acknowledge the need for compliance, they anticipate increased costs that may eventually be passed on to consumers through tariff hikes. Industry experts suggest that telcos may need to invest in automation and AI tools to streamline compliance processes and reduce extra costs.
Overall, the new cybersecurity rules aim to enhance compliance in a sensitive sector like telecom, but concerns remain about the practicality and impact on consumers. Legal experts caution that the rules may place undue burden on telcos in preventing misuse of telecom resources by users.
As the industry navigates these new regulations, stakeholders are urged to adapt their cybersecurity processes and seek support from third-party consultancy firms to meet compliance requirements effectively.