Overview
Bharat Sanchar Nigam Limited (BSNL), as a state-owned telecommunications giant, processes massive volumes of personal data including call detail records (CDR), KYC documents, location data, and financial transactions. Under the Digital Personal Data Protection (DPDP) Act 2023, BSNL qualifies as a Significant Data Fiduciary (SDF) due to the volume of data it handles and its impact on public order and state security.
DPDP Readiness: Section-by-Section Analysis
Section 5 — Notice 🔴
BSNL’s current notice is provided solely in English. The DPDP Act mandates that every notice must be available in English or any of the 22 languages specified in the Eighth Schedule to the Constitution.
Gap: There is no language selector for the privacy policy. Furthermore, the policy contains a clause stating BSNL can modify the policy “at any time without notice,” which directly violates the Section 5 requirement to inform Data Principals of any change in the processing activities.
Section 6 — Consent ⚠️
BSNL relies on an “implicit consent” model. The policy states: “BSNL shall ask you to provide certain information… it will only be used in accordance with this privacy statement.”
DPDP requirement: Consent must be free, specific, informed, unconditional, and signified by an affirmative action.
Gap: BSNL bundles consent for identity verification with consent for “promotional and marketing material” via telemarketing and SMS. Under DPDP, these must be granular; a user should be able to opt-out of marketing without losing access to core telecom services.
Section 8 — Obligations of Data Fiduciary ✅
BSNL performs strongly in its commitment to data security. The policy mandates that all employees and contractors act consistently with legal requirements.
Strength: The policy explicitly states that personal information will never be shared with other cellular service providers or banks to prevent “invasion of privacy.” This aligns with the Fiduciary’s duty to protect data.
Section 9 — Processing of Personal Data of Children 🔴
The master policy is silent on the processing of children’s data.
DPDP requirement: Fiduciaries must obtain verifiable parental consent before processing data of individuals under 18 and are prohibited from tracking or behaviorally monitoring children.
Gap: BSNL provides services (like Fiber-to-the-Home) used by entire households, yet lacks a verification mechanism for parental consent as required by Section 9.
Section 11 to 14 — Rights of Data Principal ⚠️
The current policy recognizes basic access and correction: “You undertake to intimate us in case there is any change.” However, it fails to address the expanded rights under DPDP:
- Right to Erasure: The policy does not specify a process for a user to request the deletion of their data once they port out of the network.
- Right to Nominate (Section 14): There is no provision for a Data Principal to nominate another person to exercise their rights in case of death or incapacity.
- Withdrawal of Consent: There is no “readily available” digital mechanism to withdraw consent for marketing while maintaining the service.
Section 13 — Right of Grievance Redressal ⚠️
BSNL has an extensive “Three-Tier” grievance mechanism (Call Centers, Nodal Officers, and Appellate Authority) as per TRAI regulations.
Gap: This mechanism is optimized for service/billing complaints, not data privacy breaches. The policy does not mention the right to approach the Data Protection Board of India (DPB) if a privacy grievance is not resolved within the prescribed timeline.
Risk Assessment
| Category | Risk Level | DPDP Compliance Note |
|---|---|---|
| Consent Architecture | High | Lacks granularity and affirmative action triggers. |
| Notice Transparency | High | English-only; “No notice for changes” clause is illegal under Section 5. |
| Data Retention | Medium | Vague timelines; needs specific “erasure on fulfillment” triggers. |
| Rights Fulfillment | High | No “Right to Nominate” or automated “Right to Erasure.” |
| Security Controls | Low | Strong internal protocols and PSU-grade security audits. |
Recommendations
- Multilingual Deployment: Immediately translate the privacy notice into all 22 scheduled languages to meet Section 5(3) requirements.
- Consent Manager Integration: Provide an interface for users to manage and withdraw consents through a specialized “Consent Manager” platform.
- Update Amendment Clause: Remove the “without notice” clause and replace it with a 30-day advance notice period for any policy changes.
- DPO Appointment: Publicly name a dedicated Data Protection Officer (DPO) distinct from the general Grievance Officer, as required for Significant Data Fiduciaries.