Who the rules bind: venue, ISP or aggregator
Indian public WiFi rules are written for three different parties, and the first step in compliance is knowing which one you are.
- Licensed ISPs and telecom operators hold a Unified Licence from the Department of Telecommunications (DoT). The licence conditions, including the Call Detail Record (CDR) and Internet Protocol Detail Record (IPDR) retention clauses, bind them directly.
- Venues such as hotels, restaurants, colleges and malls are usually the ISP's customers. The DoT's WiFi security instructions reach them through the ISP, which must ensure that WiFi at customer premises is authenticated and traceable. In practice the ISP's service agreement passes that duty to you.
- PM-WANI participants. Under the Prime Minister's WiFi Access Network Interface framework, a venue that registers as a Public Data Office (PDO) sells WiFi through a Public Data Office Aggregator (PDOA), and the PDOA carries the authentication, accounting and data-storage duties.
Rule of thumb: whichever party you are, a regulator or police request will ask for the same thing: the verified identity behind a session, its start and stop time, and the IP address it used. Everything below is about producing that answer.
The rules, one by one
1. DoT instructions on WiFi security (23 February 2009)
After the 2008 Mumbai attacks, in which open WiFi networks were used to send messages, the DoT issued instructions (letter no. 820-1/2008-DS Pt.II) on the secure use of WiFi in the unlicensed band. They direct licensees to use centralised authentication so that every user of a WiFi network can be traced to a login identity, and to create controlled, bulk login IDs for public places rather than leaving networks open. This is the origin of the "no open WiFi" expectation that ISPs still write into their customer terms.
Sources: Centre for Internet & Society analysis; ISP customer notice citing the DoT letter.
2. PM-WANI framework (DoT, December 2020; amended September 2024 and May 2026)
PM-WANI is the DoT framework for public WiFi hotspots run without an individual licence. Users authenticate through an app with a verified mobile number (an OTP), the PDOA authorises and accounts for each session, and the PDOA must provide for storage of user data for one year so that legal requests can be met. The May 2026 circulars (1/PM-WANI/2026 and 2/PM-WANI/2026) added QR-code login for secondary devices such as laptops and short-duration packs of 15, 30 and 60 minutes, with an eight-week implementation window.
Sources: PM-WANI Guidelines (DoT); MediaNama on the May 2026 circulars.
3. Unified Licence amendment on record retention (21 December 2021)
The DoT amended the Unified Licence to raise the minimum retention of CDR, Exchange Detail Record (EDR) and IPDR data from one year to two years. For an ISP, IPDR means the NAT or session translation logs that map a public IP and port back to a subscriber at a given time. If you are a licensee, or you run WiFi under an ISP that pushes this obligation to you contractually, two years is the floor.
Sources: Communications Today on the UL amendment; Deccan Herald, Dec 2021. The DoT letter itself (dated 21 Dec 2021) is published under Circulars on dot.gov.in.
4. CERT-In cybersecurity directions (28 April 2022)
Issued under section 70B(6) of the IT Act, these directions require service providers, intermediaries, data centres and body corporates to enable logs on all their ICT systems and retain them for a rolling 180 days within India, producing them to CERT-In on request or when reporting an incident. A WiFi management platform and its RADIUS, portal and gateway logs fall squarely inside "ICT systems".
Sources: CERT-In directions and FAQs; Khaitan & Co summary (PDF).
5. Information Technology Act, 2000 and its rules
Section 43A and the 2011 Sensitive Personal Data Rules require reasonable security practices for personal data you collect, which includes the phone numbers and device identifiers a captive portal gathers. The IT (Guidelines for Cyber Cafe) Rules, 2011 separately require identity verification of users and a one-year log register for cyber cafes, and commentators have noted that the definition can stretch to other businesses offering public internet access.
Source: SFLC.in comments to TRAI on public WiFi.
6. Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025
The DPDP Act treats the mobile number and session data you collect as personal data, and you as the data fiduciary. The Rules were notified on 13 November 2025 with phased commencement: the consent-manager provisions are reported to apply from November 2026 and the substantive duties on notice, consent, security safeguards, breach intimation and retention from May 2027. Two consequences for guest WiFi: your portal must show a clear notice of what is collected and why, and you need a defined retention period after which data is erased unless another law (such as the DoT or CERT-In rules above) requires you to keep it. Those retention laws take precedence, so keeping session logs for the mandated period is not a DPDP violation; keeping them indefinitely would be.
Sources: MeitY data protection framework; Hogan Lovells on commencement dates; SCC Online summary of the Rules.
How long to keep guest WiFi logs
| Rule | Who it binds | What to keep | Minimum period |
|---|---|---|---|
| PM-WANI Guidelines | PDOAs (and the PDOs they aggregate) | User data, accounting logs, NAT IPDR per access point | 1 year |
| Unified Licence amendment, Dec 2021 | Licensed ISPs and telecom operators | CDR, EDR, IPDR | 2 years |
| CERT-In directions, Apr 2022 | Service providers, intermediaries, body corporates | All ICT system logs, stored in India | 180 days rolling |
| Cyber Cafe Rules, 2011 | Cyber cafes (scope debated for other public access) | User identity register and log register | 1 year |
| DPDP Act and Rules | Every data fiduciary | Only what is needed, for a stated purpose | Erase when the purpose ends, unless another law requires retention |
Practical reading: a venue or PM-WANI operator is covered by keeping identity-bound session logs for one year. A licensed ISP needs two. CERT-In's 180 days is shorter than both, so it adds no extra time, but it does add the requirement that the logs exist for every system, not just the portal.
What a compliant session log contains
The documents above describe the outcome, not a file format. Across DoT, PM-WANI and police requests, the fields that are actually asked for are consistent:
| Field | Why it is needed | Where it comes from |
|---|---|---|
| Verified identity (mobile number, OTP-confirmed) | Ties the session to a person; the core of the 2009 instructions and PM-WANI | Captive portal OTP login |
| Device MAC address | Distinguishes devices on the same identity; supports MAC auto-login | RADIUS Calling-Station-Id |
| Session start and stop time | Lets a request for "who was online at 21:14" be answered | RADIUS accounting start/stop with interim updates |
| Assigned private IP and, for ISPs, the public IP and port used (IPDR) | Matches an external complaint to an internal session | RADIUS Framed-IP-Address; router NAT logs for IPDR |
| Data uploaded and downloaded | Usage evidence and billing | RADIUS accounting octets |
| Location and NAS identifier | Which venue and which router served the session | RADIUS NAS-Identifier |
Note the split in the IPDR row. A RADIUS platform records the private address it assigned; the public-address translation happens on the ISP's or venue's router. Venues with their own NAT should enable NAT logging on the router, and PM-WANI PDOs are expected to store NAT IPDR per access point.
How xceed-wifi covers these requirements
- OTP identity on every session. Guests log in with a mobile number and a 6-digit code sent by SMS or WhatsApp, rate-limited to 5 generations per number and 6 verification attempts per code. Voucher and MAC logins are bound to a verified subscriber record, so no session is anonymous.
- Full RADIUS accounting. Start, stop and 3-minute interim records capture identity, MAC, assigned IP, timestamps, data volume and the router that served the session.
- 12-month retention by default. This meets the PM-WANI one-year requirement and the Cyber Cafe Rules, and exceeds CERT-In's 180 days. Licensed ISPs that must keep two years can export accounting data on a schedule into their own archive.
- Audit exports. Session logs can be exported per location and date range for a police or DoT request, and Enterprise plan customers can request a compliance report on demand.
- Consent notice on the portal. Each location's splash page carries your own terms and privacy text, so the DPDP notice requirement is met at the point of collection.
- Works with your router. The platform integrates over standard RADIUS with MikroTik, UniFi, TP-Link EAP, Meraki and Ruckus. See the MikroTik hotspot setup guide for the configuration that enables accounting and remote disconnect.
Compliance checklist for venue owners
- Know your category. Ask your ISP what their agreement requires of your guest WiFi, and whether you are, or should be, a PM-WANI PDO.
- Close the open network. Any SSID guests can join without authentication is the thing the 2009 instructions were written to end.
- Verify identity with OTP, not a shared password at the front desk. Shared passwords produce logs with no person behind them.
- Record sessions, not just logins. Start and stop times and the IP used are what investigators ask for.
- Enable NAT logging on your router if you translate addresses yourself, so a public IP and port can be traced back.
- Keep logs for at least one year (two if you are a licensee), stored in India.
- Publish a privacy notice on the portal stating what is collected, why, and for how long, ahead of the DPDP duties taking effect.
- Rehearse a request. Pick a date and time from last month and confirm your team can produce the identity, device and session for it within a working day.
Frequently asked questions
- Is open guest WiFi illegal in India?
- There is no statute that uses the word "illegal", but the DoT's 2009 instructions require licensees to ensure WiFi at customer premises is authenticated and traceable, and ISPs pass that obligation on in their terms. An open network puts you in breach of those terms and leaves you unable to answer a lawful request for user identity.
- Is a WhatsApp or SMS OTP enough to count as identity verification?
- Under PM-WANI, mobile-number verification by OTP is the designed mechanism, because Indian SIMs are themselves KYC-verified. For hotels, room-number plus OTP, or voucher plus OTP, adds a second factor.
- Do these rules apply to a small cafe with one router?
- Yes, through the ISP agreement and, if the cafe sells access, potentially through PM-WANI or the Cyber Cafe Rules. The scale changes the tooling, not the obligation.
- What about the 180-day CERT-In rule versus one or two years?
- They stack rather than conflict. CERT-In sets a floor of 180 days for all system logs; the DoT and PM-WANI rules require longer retention for the user and session records specifically. Keeping session logs for one or two years satisfies both.
- Does keeping logs for a year breach the DPDP Act?
- No. The Act allows retention where another law requires it. What it prohibits is collecting more than you need, failing to tell users, and keeping data after both the purpose and the legal retention period have ended.
This page summarises publicly available regulations as of the review date above and links to the primary sources where they are online. It is not legal advice. Obligations vary with your licence status, your ISP agreement and your state's police requirements; confirm them with qualified counsel.