Signal In The Machine- Evolving Regulatory Landscape On Telemetry Data And Connected Vehicles

Connected vehicles increasingly resemble computers on wheels. They rely on continuous data flows for safe operation, navigation, infotainment and driver-assistance features. This data - called telemetry-travels through Machine-to-Machine SIM cards (M2M SIMs), embedded SIMs (eSIMs), dedicated short-range communication (DSRC), cellular vehicle-to-everything(C-V2X) and cloud platforms. In India, each of these building blocks is regulated, but through separate legal framework rather than a unified regulation.

This article broadly explains how India currently deals with connected vehicles, regulatory vacuum around telemetry data, connectivity and spectrum, and steps which may bring greater clarity - without suggesting a definitive legal framework.

I. Telemetry and Connected Vehicles

A vehicle is connected if vehicle to everything (V2X) radiocommunication equipment is mounted on it and an advanced Intelligent Transport System (ITS) application is supported through cooperative V2X connectivity.¹ Common examples include a car that sends its location and health status to a manufacturer's server, or a fleet vehicle that shares driving behavior with a dashboard.

Telemetry data is the stream of information a vehicle produces as it operates. It can include operational data (speed, braking, engine or battery status), location and route data (GPS coordinates, route histories), environmental data (road conditions, obstacles and sensor-data), and user-linked data - such as driver identifiers, account details or infotainment usage. The boundary between personal and non-personal telemetry is not always clear, especially once datasets are combined, which is why the telecom, data-protection, technology and road-transport layers must be understood together.

II. Telecom Layer

The Telecommunications Act, 2023 (Telecom Act) postulates authorisation for providing telecommunication services; establishing, operating, maintaining or expanding a telecommunication network; or possessing radio equipment.² For connected-vehicles, this may arise across three layers:

(a) Service Layer — providers of SIM or DSRC- based communication connecting vehicles to network/ roadside units (RSUs) may need telecom authorisation e.g. as an M2M service provider.³

(b) Spectrum Layer — the Telecom Regulatory Authority of India (TRAI) released a consultation paper⁴ that records the in-principle view that C-V2X should be adopted as India’s harmonised Intelligent Transport System (ITS) technology. The 5875–5925 MHz band, identified for V2X/ITS in the National Frequency Allocation Plan 2022, is recommended for C-V2X deployment. The 24.05–24.25 GHz band is already delicensed for transport and traffic telematics device,⁵ and the 77–81 GHz band is recommended for delicensing, for automotive radar applications. The Telecom Act also empowers the Department of Telecommunications to allot spectrum for the safety and operation of transport systems on an administrative basis i.e. without auction.

(c) Equipment Layer — Dealing or possessing radio equipment may itself require authorisation.⁶ Radio units like On-Board Units (OBUs) installed in vehicles are proposed⁷ to operate on a licence-exempt basis under defined technical conditions, while RSUs may require authorisation for coordinated deployment and interference management. TRAI has also proposed type approval for OBUs and RSUs. This lighter-touch treatment for vehicle equipment, and clearer licensing for fixed roadside infrastructure, mirrors the practical distinction between mobile and fixed V2X components seen in jurisdictions such as the United States and Canada.

III. Data Protection & Technology Layer

The Digital Personal Data Protection Act, 2023 (DPDPA) governs personal data collected through telematics and connected-vehicle services. Telemetry that identifies or relates to an individual, such as driver’s behaviour scores, detailed route histories or in-cabin camera feeds - will generally be personal data. Data fiduciaries must process such data on lawful grounds, implement reasonable security safeguards, and honour data-principal rights, including access, correction and erasure. Personal data breaches must be reported to the Data Protection Board and affected data principals in the manner prescribed by the rules.⁸

Cyber-security compliances and breach reporting obligations sit separately with the Indian Computer Emergency Response Team (CERT-In) and under the Telecommunications (Telecom Cyber Security) Rules, 2024. CERT-In’s 2022 Directions⁹ require specified entities to report certain cyber incidents within six hours of identifying or being notified; these obligations may apply to connected-vehicle platforms and fleet dashboards. Recent reports¹⁰ also indicate that the government has asked electric vehicle (EV) manufacturers and related stakeholders to strengthen cybersecurity, audit battery communication interfaces, secure over-the-air update pathways, and prepare for AIS-189 and AIS-190 on cybersecurity (CSMS) and software-update management system (SUMS) after concerns that battery management applications could be misused to remotely disable e-rickshaws and other EVs.

IV. Transport Layer

Motor vehicles also fall within the Motor Vehicles Act, 1988 and the Central Motor Vehicles Rules, 1989 (CMVR), which prescribe type approval, security and fitness requirements relevant to connected vehicles. AIS-140 under CMVR, for example, sets technical requirements for vehicle-location tracking devices using GPS and Navigation with Indian Constellation (NavIC). The CMVR links fitness certification for specified vehicle categories to the presence of an active tracking device and valid SIM.>¹¹

Foreign regimes offer useful reference points. UNECE¹² Regulations¹³ require approved CSMS and SUMS across the vehicle life cycle. The EU's Data Act¹⁴ gives users access to product data and provides for fair, reasonable and non-discriminatory business-to-business sharing. China treats certain vehicle data as important data and imposes security-assessment requirements before some cross-border transfers.¹⁵ India's DPDPA takes a more general approach to cross-border transfers, without automotive-specific telemetry categories, giving the sector flexibility but also responsibility to classify and protect telemetry.

V. Conclusion

Indian organisations working with vehicle telemetry face practical questions. First, when does telemetry become personal data? If it can be tied to an identified or identifiable driver or user, it may likely be personal data under the DPDPA and may be treated accordingly. Engine-health readings, anonymised congestion maps or de-identified sensor feeds may fall outside that boundary, though they may remain commercially sensitive. Second, what data is necessary for the service, and how long should it be retained? Third, what happens when personal telemetry crosses borders, particularly if future government notifications restrict transfers to certain jurisdictions? For non-personal but sensitive telemetry, encryption, segregation and contractual protections remain important safeguards considering non-personal data sharing framework in India is only at a proposed stage.¹⁶

A further issue is connectivity failure: an RSU may go down at a busy junction, a cellular link may drop during a safety-critical update, or a misconfigured certificate may break authentication. These are not merely IT incidents; they can affect safety-critical functions. Responsibility is currently spread across contract law, telecom rules, data-protection obligations and road-transport standards, with no single framework stitching them together. The sensible response is to build incident-response plans that cut across these layers and clarify responsibility among original equipment manufacturers (OEMs), telecom providers, platform operators and fleet owners. India's connected-vehicle framework is therefore not being built from nothing. The building blocks already exist: telecom authorisation, data-protection law, cybersecurity reporting and transport standards that assume vehicles are online. The task now is to connect them deliberately so that designers, deployers and users of connected-vehicle services know where they stand.

Footnotes

^{1 Telecom Regulatory Authority of India, Consultation Paper on the Regulatory Framework for Vehicle-to-Everything (V2X) Communication, Consultation Paper No. 08/2026 (Apr. 30, 2026).}

^{2 Telecommunications Act, 2023, § 3}

^{3 For instance, under the under the Telecommunications (Authorisation for Provision of Miscellaneous Telecommunication Services) Rules, 2026}

^{4  Ibid. 1}

^{5 GSR 104 7(E) dated 18.10.2018 for Transport and traffic telematics devices; The frequency band 76-77 GHz has also been delicensed vide GSR No.699(E) dated 16.09.2015.}

^{6 For instance, under the Telecommunications (Radio Equipment Possession Authorisation) Rules, 2026}

^{7 Ibid. 1}

^{8 Digital Personal Data Protection Rules, 2025, Rule 7 (India)}

^{9 CERT-In Directions dated 28 April, 2022}

^{10 News report available here.}

^{11 Ministry of Road Transport & Highways, G.S.R. 349(E), Gazette of India (May 8, 2026), amending the Central Motor Vehicles Rules, 1989}

^{12 United Nations Economic Commission for Europe}

^{13  U.N. Regulation No. 155, Uniform Provisions Concerning the Approval of Vehicles with Regard to Cyber Security and Cyber Security Management System (UNECE WP.29, 2021); U.N. Regulation No. 156, Uniform Provisions Concerning the Approval of Vehicles with Regard to Software Update and Software Update Management System (UNECE WP.29, 2021)}

^{14  Regulation (EU) 2023/2854 of the European Parliament and of the Council of 13 December 2023 on Harmonised Rules on Fair Access to and Use of Data (Data Act); European Commission, Guidance on Vehicle Data Accompanying the Data Act (Sept. 12, 2025)}

^{15 Cyberspace Administration of China et al., Several Provisions on the Management of Automobile Data Security (effective Oct. 1, 2021); Ministry of Industry and Information Technology, Guidelines on the Security of Cross-Border Transfers of Automotive Data (2026 Edition) (Feb. 3, 2026)}

^{16 Draft National Data Governance Framework Policy dated 26th May 2022}

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.