Telecommunications (Telecom Cyber Security) Amendment Rules, 2025

REGD. No. D. L.-33004/99 The Gazette of India CG-DL-E-22102025-267074 EXTRAORDINARY PART II-Section 3-Sub-section (i) PUBLISHED BY AUTHORITY No. 687] NEW DELHI, WEDNESDAY, OCTOBER 22, 2025/ASVINA 30, 1947 MINISTRY OF COMMUNICATIONS (Department of Telecommunications) NOTIFICATION New Delhi, the 22nd October, 2025 G.S.R. 771(E). - Whereas a draft of the Telecommunications (Telecom Cyber Security) Amendment Rules, 2025, which the Central Government proposes to make in exercise of the powers conferred by clause (v) of sub section (2) of section 56 of the Telecommunications Act, 2023 (44 of 2023), was published as required by sub-section (1) of section 56 of the said Act vide notification of the Government of India in the Ministry of Communication, Department of Telecommunication number G.S.R. 411(E), dated 24th June, 2025 in the Gazette of India, Extraordinary, Part II, Section 3, Sub-section (i), dated the 24th June, 2025, inviting objections and suggestions from the persons likely to be affected thereby, before the expiry of the period of thirty days from the date on which the copies of the Gazette containing the said notification were made available to the public; And whereas copies of the said Gazette were made available to the public on the 25th June, 2025; And whereas the objections and suggestions received from the public in respect of the said draft rules have been duly considered by the Central Government; Now, therefore, in exercise of the powers conferred by clause (v) of sub section (2) of section 56 of the Telecommunications Act, 2023 (44 of 2023), the Central Government hereby makes the following rules, namely:— 1. Short title and commencement. (1) These rules may be called the Telecommunications (Telecom Cyber Security) Amendment Rules, 2025 (2) They shall come into force on the date of their publication in the Official Gazette. 2. In the Telecommunications (Telecom Cyber Security) Rules, 2024 (hereinafter referred to as the principal rules), in rule 2, in sub-rule (1), — (a) after clause (c), the following clauses shall be inserted, namely: - '(ca) "licensee" means a person holding a license to provide telecommunication services under the Indian Telegraph Act, 1885 (13 of 1885); (cb) "MNV platform" means the mobile number validation platform established under rule 7A to enable validation by authorised entities and licensees as regards whether telecommunication identifiers specified by TIUE customers or users, correspond to the users as present in the database of an authorised entity or licensee, as the case may be'; (b) after clause (h), the following clause shall be inserted, namely:- '(i) "TIUE (telecommunication identifier user entity)" means a person, other than a licensee or authorised entity, which uses telecommunication identifiers for the identification of its customers or users, or for provisioning, or delivery of services'. 3. In the principal rules, in rule 3,— (a) in sub-rule (1), — (i) in clause (a), the word "and" at the end shall be omitted; (ii) after clause (a), the following clause shall be inserted, namely:- "(aa) seek data related to telecommunication identifiers used by a TIUE in the form and manner as specified on the portal; and"; (b) in sub-rule (2), in clause (b), after the words "telecommunication entities", the word and letters "or TIUE" shall be inserted. 4. In the principal rules, in rule 4, in sub-rule (3), after the words “telecommunication entity”, the word and letters "and TIUE" shall be inserted. 5. In the principal rules, in rule 5,— (a) for sub-rule (6), the following sub-rule shall be substituted, namely:- "(6) Where the Central Government considers that immediate action under sub-rule (5) is necessary or expedient in the public interest, it shall without issuing a notice under sub-rule (2), pass an order recording the reasons thereof, with appropriate direction- (a) to the telecommunication entity to temporarily suspend use of the relevant telecommunication identifier; and (b) to the TIUE to temporarily suspend use of the relevant telecommunication identifier for identification of or for delivery of message or services to its customers or users.”; (b) in sub-rule (7), after the words “telecommunication entity", occurring at both the places, the word and letters "or TIUE" shall be inserted; (c) in sub- rule (8), the following proviso shall be substituted, namely:- "Provided that any modification of the order under sub-rule (6) may also include an order directing: (a) the telecommunication entity to permanently disconnect the use of the relevant telecommunication identifier as specified under clause (b) of sub-rule (5); and (b) the TIUE to prohibit or circumscribe the use of relevant telecommunication identifiers for identification of its customers or users, or for delivery of message or services, in the manner as may be specified in such order to enable the reuse of relevant telecommunication identifiers.”; (d) in sub-rule (11), — (i) for the words "any person providing services that are linked to telecommunication identifiers", the word and letters "a TIUE" shall be substituted; and (ii) after the words "their customers", the words "or users,” shall be inserted. 6. In the principal rules, after rule 7, the following rule shall be inserted, namely:- "7A. Validation of telecommunication identifiers. (1) The Central Government, for ensuring telecom cyber security and preventing security incidents, shall either by itself, or through an agency authorised by it, establish a MNV platform and issue directions to authorised entities and licensees to participate on such platform. (2) The following entities may place a request on the MNV platform and upon payment of fees, as specified therein, seek validation as to whether the telecommunication identifiers as specified by their customers or users, correspond to the users as available in the database of an authorised entity or licensee:— (a) a TIUE, either suo moto, or upon a direction from Central or State Government or an agency authorised by the Central or State Government; or (b) the Central Government or State Government or any agency authorised by the Central Government or State Government: Provided that where a TIUE places a request suo moto on the MNV platform, the decision to allow use of such platform shall rest with the Central Government. (3) The fees charged for use of the MNV platform shall be shared between the Central Government or its agency that has established and maintains the MNV platform and the authorised entity or licensee providing the validation services, as specified on the portal. (4) The MNV platform shall transmit any request received under sub-rule (2) or sub-rule (3) to authorised entities and licensees for the purpose of validation, and such entities shall undertake such validation and provide their response to the MNV platform, as specified therein. (5) The mobile number validation under this rule shall facilitate validation of customers or users associated with a telecommunication identifier for the purpose of services linked to such identifier, and the TIUE, authorised entity and licensee, as the case may be, shall ensure compliance with applicable laws relating to data protection for this purpose.". 7. In the principal rules, in rule 8,— (a) after sub-rule (4), the following sub-rule shall be inserted, namely:- "(4A) The Central Government may issue directions to manufacturers of telecommunication equipment bearing International Mobile Equipment Identity (IMEI) number not to assign IMEIs that are already in use in telecommunication networks in India to new telecommunication equipment that are manufactured in India or imported to India from the date as specified by the Central Government on the portal.”; (b) after sub-rule (5), the following sub-rules shall be inserted, namely:— "(6) The Central Government shall, either directly or through an agency authorised by it, maintain a database of IMEIs which are tampered, or whose use has been restricted. (7) A person engaged in the sale and purchase in India of used telecommunication equipment bearing IMEI numbers or its authorised agency shall, prior to such sale or purchase access the database specified in sub-rule (6) on payment of fees as specified on the portal and ensure that it shall not directly or indirectly undertake sale or purchase of any telecommunication equipment bearing IMEI number that is specified in such database. (8) Every manufacturer or importer of any telecommunication equipment that bears an International Mobile Equipment Identity (IMEI) number shall ensure compliance with the directions as may be issued by the Central Government for the purpose of giving effect to these rules.". 8. In the principal rules, in rule 10,— (a) in sub-rule (2), after the words “telecommunication entities", occurring at both the places, the word and letters "or TIUEs" shall be inserted; (b) in sub-rule (3), after the words "telecommunication entity", the letters “, TIUE," shall be inserted. [F. No. 24-07/2024-UBB] DEVENDRA KUMAR RAI, Jt. Secy. Note: The principal rules were published in the Gazette of India, Extraordinary, Part II, Section 3, Sub-section (i) vide number G.S.R. 720(E), dated the 21st November, 2024. Uploaded by Dte. of Printing at Government of India Press, Ring Road, Mayapuri, New Delhi-110064 and Published by the Controller of Publications, Delhi-110054.