Telecom operators expect the government to review and harmonise sector-specific regulations with the DPDP (Digital Personal Data Protection) framework to reduce ambiguity, facilitate smooth transition, and avoid duplication of processes, industry body COAI said yesterday .

The Cellular Operators Association of India (COAI), whose members include Reliance Jio, Bharti Airtel and Vodafone Idea, amongst others, has sought practical exemption for minors aged 16-18 years for SIM acquisition under DPDP Rules, as establishing verifiable consent for users below 18 years of age presents practical challenges and does not adequately reflect India’s diverse household structures, a PTI report from new Delhi said yesterday.

The industry body said at the time of public consultation on DPDP Rules, it had highlighted areas like parameters for a security compliance framework, age verification methodology for verifiable consent in case of minors, and DPIA obligations for Significant Data Fiduciary (SDF), among others, where additional clarity was required, but most of these concerns remain unaddressed.

“COAI had recommended adherence to the well-established legal principle that specific laws prevail over general laws. A review and harmonisation of sector-specific regulations with the DPDP framework, along with clear interpretative guidance, would help minimise ambiguity and facilitate a smooth transition for all stakeholders,” the industry body said.

It has expressed concern about mandatory notification for data breaches and suggested adopting a proportionate reporting model, as followed in Japan and several EU jurisdictions.

COAI said given the multiplicity of incident-reporting obligations under the IT Act, CERT-In directions, DoT guidelines and now the DPDP framework, harmonised timelines and aligned procedures are required to help avoid unnecessary duplication to ensure cohesive compliance across regulatory regimes.

“CERT-In and the Data Protection Board may consider adopting a unified breach-reporting timeline, with a single trigger and a harmonised reporting window applicable across all digital and telecom entities,” the industry body said.

COAI has proposed that DPIA (Data Protection Impact Assessment) requirements under the rule can be risk-based rather than annual and prescriptive.

DPDP Rules mandate a significant data fiduciary to undertake a Data Protection Impact Assessment — an audit, to ensure effective compliance with the DPDP Act once every 12 months.

The government notified the DPDP Rules on November 14, which will become completely operational after 18 months. The rules aim to give citizens control over their data, allow them to check for misuse and protect their privacy in the online space.