DPI Deep Dive — Sunday | March 15, 2026

Focus Layer: L7 Security, Privacy & Trust (CERT-In, DPDP, TRAI)
Coverage Period: March 8-15, 2026

Executive Summary

This week’s L7 developments showcase India’s intensified focus on cybersecurity governance across multiple fronts. CERT-In released landmark Space Cyber Security Guidelines mandating Zero Trust architecture for the space sector, while SIM binding rules came into effect on March 1st to curb telecom-related cybercrime. TRAI advanced its anti-spam framework with new consultation papers, and the Supreme Court issued notice on constitutional challenges to the DPDP Act—raising critical questions about the balance between data protection and RTI. Meanwhile, the TCS-JLR breach underscores the growing cybersecurity risks facing India’s IT services giants.

Key Developments

1. CERT-In Space Cyber Security Guidelines: A New Era for Space Sector Protection

The Indian Computer Emergency Response Team (CERT-In), in collaboration with the Satcom Industry Association (SIA-India), released the Cyber Security Guidelines for Space Including Satellite Communication (CISG-2026-01) at DefSat 2026 in late February, marking India’s first comprehensive cybersecurity framework for the space ecosystem. ¹

The guidelines mandate several critical requirements:

• Zero Trust Architecture: All space sector entities must adopt Zero Trust principles, assuming no implicit trust even within internal networks
• Six-Hour Incident Reporting: Critical infrastructure operators must report significant cybersecurity incidents to CERT-In within six hours of detection—a globally aggressive timeline
• Quantum-Safe Cryptography: Guidelines require adoption of quantum-resistant cryptographic protocols to protect against future quantum computing threats
• Satellite Communication Security: Specific provisions for securing ground stations, satellite links, and data transmission pathways

These guidelines arrive amid increasing attacks on global space infrastructure and represent India’s proactive approach to securing its growing space assets. The space sector, identified as critical national infrastructure, now has explicit security requirements that will reshape how ISRO, private space companies, and satellite operators approach cybersecurity.

Analysis: The CISG-2026-01 guidelines signal CERT-In’s evolution from a reactive incident response body to a proactive regulatory force. The six-hour reporting window aligns with global best practices while the quantum-safe cryptography requirement demonstrates forward-thinking policy. For DPI, these guidelines will influence how space-based communication services integrate with terrestrial digital infrastructure.

2. SIM Binding Rules Effective: Telecom Security Tightens

The Telecom Department’s SIM binding directive, which took effect on March 1, 2026, represents a significant tightening of telecom security to combat increasing cybercrime and protect national security. ²

Key provisions include:

• Device-SIM Binding: SIM cards must be linked to specific devices, preventing unauthorized use of cloned or stolen SIMs
• Enhanced KYC Verification: Stricter identity verification requirements for SIM procurement
• Automated Fraud Detection: Telecom operators must implement AI/ML-based systems to detect suspicious SIM usage patterns
• Cross-Operator Tracking: Mechanisms to track fraudulent SIMs across different service providers

The rules aim to address persistent issues with telecom fraud, including OTP theft, SIM swapping attacks, and organized cybercriminal operations that have plagued Indian telecom users. The timing coincides with a surge in financial fraud attempts leveraging telecom channels.

Analysis: SIM binding represents a fundamental shift in telecom security posture. While enhancing user protection, it raises questions about privacy implications and the balance between security and convenience. The requirements will necessitate significant upgrades to telecom operator systems and create ongoing compliance obligations under the broader DPI security framework.

3. TRAI Advances Anti-Spam Framework with Third Amendment

TRAI released two significant regulatory developments this week:

Digital Addressable Systems Audit Manual, 2026 (Issued March 10, 2026; Effective April 1, 2026):

• Comprehensive audit framework for cable and broadcasting services
• Mandates independent third-party security audits
• Requires compliance reporting to TRAI ³

Draft Telecom Commercial Communication Preference (Third Amendment) Regulations, 2026:

• Proposes AI/ML-based UCC (Unsolicited Commercial Communication) detection across all access providers
• Stricter complaint resolution timelines (within 7 days)
• Enhanced cross-operator complaint handling mechanisms
• Mandates real-time complaint data sharing between operators ⁴
• Public comments invited until April 12, 2026

Additionally, TRAI organized a Workshop on Quantum Safe Communication at its headquarters, signaling proactive engagement with post-quantum cryptography preparations. ⁵

Analysis: TRAI’s multi-pronged approach addresses both consumer protection and future technological threats. The AI/ML-based spam detection represents a technological leap over current rules-based systems, while the quantum communication workshop demonstrates strategic foresight. These regulations interact with the broader DPI through enhanced identity verification requirements that complement the SIM binding rules.

4. Supreme Court Questions DPDP Act: Public vs. Private Data at Stake

The Supreme Court on March 12, 2026, issued notice to the Union of India on multiple petitions challenging the Digital Personal Data Protection (DPDP) Act, 2023, raising fundamental questions about the distinction between “public data” and “private data.” ⁶

Key Issues Before the Court:

• Whether information about persons holding public office can be classified as “private data”
• The deletion of “public interest” exceptions from both the RTI Act and DPDP Act
• Section 7 powers allowing state-directed data processing without consent
• Section 17(2)(a) exempting government entities from the Act
• Independence and composition of the Data Protection Board

The petitions, filed by journalists, RTI activists, and civil society organizations including the Reporters’ Collective, Internet Freedom Foundation (IFF), and Software Freedom Law Centre (SFLC), argue that the Act:

• Allows mass surveillance without judicial oversight
• Removes individual compensation rights for data breaches (repealing Section 43A of IT Act)
• Creates blanket exemptions under RTI through Section 44(3) amendment
• Lacks exemptions for journalistic and public interest data processing

Senior Advocate Indira Jaising represented petitioners before the Court, which asked the Centre to respond by March 23, 2026.

Analysis: The Supreme Court proceedings represent a critical moment for India’s data protection regime. The outcome will shape how DPDP interacts with other fundamental rights, particularly RTI. For the DPI ecosystem, clarity on these issues is essential—the Act’s exemptions for government data processing under Sections 7 and 36 directly impact how other DPI layers (especially L1 Identity and L3 Documents) handle citizen data.

5. TCS Pilots Enhanced Cybersecurity After JLR Breach

Tata Consultancy Services (TCS) has initiated pilot programs for dedicated cybersecurity teams and standardized response procedures for its largest clients, following the significant data breach at Jaguar Land Rover (JLR) that has potential financial implications exceeding $1 billion. ⁷

The JLR breach:

• Halted production at multiple manufacturing facilities
• Exposed sensitive employee data
• Led to regulatory scrutiny and potential lawsuits
• Created reputational damage across the Tata Group

TCS’s response includes:

• Dedicated cybersecurity teams for top-tier clients
• Standardized incident response playbooks
• Enhanced threat detection capabilities
• Proactive vulnerability assessments

Analysis: The TCS-JLR incident highlights the systemic cybersecurity risks in India’s IT services sector, which handles sensitive data for global enterprises. This has implications for DPI as TCS and similar firms increasingly support government digital initiatives. The incident may accelerate requirements for security certifications and third-party risk management in DPI projects.

Cross-Layer Connections

L1 Identity & Authentication: The SIM binding rules directly impact L1, as telecom-based identity verification becomes more robust. The DPDP Act’s interaction with Aadhaar authentication mechanisms remains a pending legal question.

L2 Payments & Financial Rails: Enhanced telecom security (SIM binding) will reduce OTP-based fraud, directly protecting UPI and digital payment transactions. The TCS-JLR incident involved potential financial data exposure, highlighting payment system interdependencies.

L3 Documents & Data Exchange: The Supreme Court’s DPDP deliberations affect how DigiLocker and document exchange systems handle citizen data, particularly regarding government data sharing provisions under Section 36.

L4 Commerce & Logistics: ONDC and GeM platforms will need to align with evolving security requirements, particularly as TRAI’s spam regulations affect promotional communications.

L5 Sectoral Infrastructure: ABHA health records and AgriStack data fall under DPDP’s sensitivity classifications, with the Supreme Court challenge potentially impacting how sectoral data is classified.

L6 Governance & Grievance: CPGRAMS and grievance portals must align with DPDP requirements while maintaining transparency obligations—directly relevant to the RTI vs. DPDP tension before the Supreme Court.

Sources