India’s Department of Telecommunications has notified rules requiring biometric identification before a person can obtain, change or disconnect a mobile connection, with operators given three months to build the systems that will run the checks.
The Telecommunications (User Identification) Rules, 2026 took effect on publication and follow draft rules the department circulated for consultation last year. They cover two notified services: wireless access services, which covers ordinary mobile SIM connections, and internet telephony through mobile user terminals, which covers app-based calling over a mobile device. The department has not defined the second category or said whether it reaches over-the-top calling applications.
Operators must run biometric identification at four points: before enrolling a user for a new SIM, before updating a user’s information, before disconnecting a connection, and whenever the department orders re-verification. Two routes are available. Aadhaar holders are authenticated through the Unique Identification Authority of India’s e-KYC facility, and the operator stores the e-KYC data it receives, including the Aadhaar number.
Everyone else goes through a D-KYC process. That covers people without Aadhaar and people who hold it but cannot complete face, fingerprint or iris capture because of an impairment, disfigurement, injury or amputation. The operator takes a live capture of the face, photographs the identity and address documents, and checks that the live face matches both the person and the document photograph. Where a claim is doubted, it can send someone to the address, seek police assistance, or both. Egypt’s telecoms regulator is building the same pairing of a live face check and a document image into mobile operator applications to stop unauthorised SIM registrations, and Mexico passed the first deadline in its staged prepaid registration programme earlier this month.
An operator that finds forged documents or an impersonation attempt must ask police to register a first information report and log the steps it took on the department’s portal. If it does not act, the department can direct it to file the report and open proceedings against the operator itself. The department can also require operators to alert a user’s existing connections asking them to confirm a request, and an operator that receives a denial must suspend the new connection or reverse the change or disconnection until it establishes what happened.
Business connections carry an additional obligation. The operator verifies the authorised representative and every end user on the account, and a changed end user must be biometrically identified within the period set on the portal or the connection is suspended. Subscriber data records are to be handled under applicable data protection law, with no retention period, deletion rule or encryption standard set out in the rules themselves.
Sources: MediaNama
–
By Ali Nassar-Smith
