The Impact of the 2025 Telecom Cyber Security Amendment Rules on Consumers and Small and Medium Businesses

Home

Background and Context

On 22 October 2025, the Department of Telecommunications notified the Telecommunications (Telecom Cyber Security) Amendment Rules, 2025. The final Rules largely retain the provisions set out in the draft consultation, expanding India’s telecom cybersecurity framework by introducing two major mechanisms. A Mobile Number Validation (MNV) system for verifying telecom identifiers used on digital platforms, and enhanced controls for tracking devices through International Mobile Equipment Identity (IMEI) numbers. The apparent objective of these measures is to curb identity theft, SIM-related fraud, and the misuse of telecom identifiers.

While the goal of strengthening cybersecurity is widely recognised, the Rules impose substantial new compliance obligations on digital platforms—including banks, fintech companies, e-commerce firms, and OTT services. These entities are required to validate users’ mobile numbers against telecom operator databases through the MNV platform, raising concerns regarding implications of feasibility, cost, privacy, and proportionality.

To examine these implications, this project evaluates the cost and impact of the Amendment Rules, with particular attention to their impact on consumers and small and medium-sized enterprises. This will include both direct and indirect costs and potential unintended consequences—such as disproportionate compliance burdens, exclusion risks, and privacy challenges—that may affect consumers, smaller service providers and the wider telecom ecosystem.