Document control
Regulatory Obligations Register (India)
Document ID: B-035
Author(s): GRC & Compliance Team
Version: 1.0
Date: 09-Nov-2026
Disclaimer:
This controlled document is intended for authorized SecureXcel use. It may not be reproduced, distributed, quoted, or disclosed outside its approved audience without prior authorization from the document owner.
| Document Title | Regulatory Obligations Register India | ||||
|---|---|---|---|---|---|
| Document Id | SecureXcel/AIMS/B-035 | Current Version | 1.0 | Date of Release | 09-Nov-2026 |
| Classification | Internal | Author | GRC & Compliance Team | ||
| Reviewed by | GRC & Compliance Lead | ||||
| Approved by | Management Representative | AI Governance Committee (AIGC) | |||
| Designation |
Revision History
| Version | Date | Author | GRC & Compliance Team | GRC & Compliance Lead | Management Representative |
|---|---|---|---|---|---|
| 1.0 | 30/09/2026 | GRC Lead | GRC Head | AIGC | Initial version |
1. Purpose
This register provides a centralised record of the regulatory and legal requirements applicable to SecureXcel AI Services operations in India and outside of India. It identifies the relevant regulatory requirements, applicability triggers, responsible owners, and monitoring mechanisms to support effective compliance management. It also serves as a reference for assessing and resolving any regulatory requirements related to data retention and other applicable obligations.
2. Scope
India-specific obligations applicable to SecureXcel AI Services and its data. International obligations (EU AI Act, GDPR for international operations) remain tracked in B-002 Appendix C; this register does not replace that one.
3. Regulatory Obligations Register India
| Regulator | Obligation | Trigger | Deadline / frequency | Owner |
|---|---|---|---|---|
| TRAI | Register and scrub message headers and content templates under the DLT / TCCCP framework before use | New sender header or template | Before first use; ongoing scrubbing on every message | Legal & Compliance |
| TRAI | Cooperate with DLT-registered-entity compliance checks | TRAI audit or query | As requested | Legal & Compliance |
| DoT | Retain call detail records and message logs for the mandated period | Ongoing, all in-scope traffic | Per DoT licence conditions; 3 years is the AIMS reference figure (B-003, B32) unless a longer DoT-specific period applies — confirmed with Legal at each review | Data Governance |
| DoT | Support lawful-intercept and traceability requests | Lawful request received | Per licence conditions, typically within a defined statutory window | Legal & Compliance / IT |
| DPDPA 2023 and Rules | Lawful basis, notice and consent for personal data processed by SecureXcel AI Services where applicable; honour data-principal rights requests | Personal data collection or a data-principal request | Per DPDPA Rules once notified; internal SLA target 30 days for rights requests | Data Governance / Legal & Compliance |
| DPDPA 2023 | Report a personal data breach to the Data Protection Board and affected data principals | Confirmed personal data breach | Per DPDPA Rules once notified | Information Security & GRC Lead / Legal & Compliance |
| CERT-In | Report a qualifying cyber security incident | Qualifying incident per CERT-In’s notified categories | Within 6 hours of noticing or being notified of the incident | Information Security & GRC Lead, via B-002 Incident Management Procedure |
| CERT-In | Maintain and produce logs for the mandated retention period on request | Ongoing | 180 days minimum retention within India, per CERT-In direction | IT / Information Security & GRC Lead |
| IT Act 2000 | General due diligence and reasonable security practices for sensitive personal data | Ongoing | Continuous | Information Security & GRC Lead |
4. Maintenance
- Reviewed annually by Legal & Compliance and whenever a regulator issues new guidance.
- Any new obligation identified is also checked against B25 (does it change a risk score) and the Statement of Applicability (does it require a new or changed control).
5. Compliance with ISO 42001:2023
| Requirement | Where met | Clause |
|---|---|---|
| Information for interested parties, including regulators | Whole document | A.8.5 |
| Legal and regulatory requirements identified as part of context | Section 3 | 4.1, 4.2 |