SIM-binding for messaging apps and the DPDP Rules: mobile numbers, device tokens and consent

Nearly every customer service team, enterprise helpdesk and mobile banking or shopping app in India uses messaging accounts, one-time passwords and phone-number verification to authenticate users and send account updates. As telecom and cybersecurity authorities move to tighten SIM-binding requirements for messaging applications and curb remote impersonation fraud, organisations must also prepare for how the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 regulate mobile number collection, device identifiers and messaging vendors from 13 May 2027.

Why SIM-binding and telecom verification intersect with data protection

When a bank, fintech lender, hospital or online store verifies that a mobile app session is bound to an active physical or embedded SIM card on the user's device, it processes personal data. A mobile phone number, an international mobile equipment identity code, a SIM serial identifier and a session token linked to an identifiable customer are all personal data under the law because they identify or relate to an individual.

Security mandates issued by sector or telecom authorities and privacy duties under the data protection law work side by side rather than against each other. The DPDP Rules explicitly confirm that nothing in the reasonable security safeguards rule takes away from the codes, standards or directions that a sector regulator or cybersecurity authority requires. At the same time, collecting a phone number or device token for fraud prevention does not give a business permission to reuse that phone number for unrequested promotional broadcasts on messaging apps.

How phone numbers and messaging channels flow across Indian businesses

Across retail, banking, healthcare and software services, a customer's mobile number often travels through five or six external systems within seconds of sign-up. Separating security verification from marketing outreach is the single clearest step an engineering and operations team can take before the law takes full effect on 13 May 2027.

Separating authentication from promotional messaging

A common mistake on Indian websites and mobile apps is presenting a single checkbox—or no checkbox at all—when asking for a customer's phone number at login or checkout, and then adding that number to a promotional broadcast list. Under the Act, consent is valid only when it is free, specific, informed, unconditional and unambiguous with a clear affirmative action, and it is limited strictly to the personal data necessary for the specified purpose.

Consider how the statute's own principles apply in practice:

• If a customer enters a mobile number to verify their identity, bind their app session or receive a digital receipt, processing the phone number is necessary for account security and order fulfilment.
• Enrolling that same phone number into weekly promotional messages on a chat platform is a separate purpose that is not necessary for logging in or completing the purchase.
• When a customer withdraws consent for promotional messages, the business and its messaging Data Processor must cease sending marketing messages within a reasonable time, while keeping the core account login active if the customer still uses the service.

Messaging platforms and CPaaS vendors as Data Processors

Most Indian businesses do not connect directly to telecom operators; instead, they use communications-platform-as-a-service vendors, WhatsApp Business solution providers, SMS aggregators or cloud contact centres. Whenever an external platform routes messages, stores chat histories or verifies phone numbers on your behalf, that vendor is your Data Processor.

Under the law, your organisation as the Data Fiduciary remains fully responsible for compliance, and may engage a messaging vendor only under a valid contract. That contract must require the vendor to maintain reasonable security safeguards—including encryption, access controls and one-year visibility logs—and to notify you immediately if any chat logs, phone lists or API keys are exposed so you can meet the 72-hour Data Protection Board reporting deadline.

Our view: a six-point checklist for mobile login and messaging teams

In our view, product managers, engineering leads and operations teams that rely on mobile numbers, SIM-binding or messaging apps should put six controls in place well before 13 May 2027: