Digital Law Weekly Tracker: W32 2026 — RBI Regulates Remote Device-Locking in Digital Lending with Rs 250-Per-Hour Compensation, TRAI Opens Quality-of-Service Consultation and Publishes Quarterly Anti-Spam Enforcement Data, DoT Opens Radio Equipment Authorisation Portal

India's digital-law week of 3 to 9 August 2026 produced the country's first rule on remote device-locking. On 6 August the Reserve Bank of India issued the Responsible Business Conduct Fourth Amendment Directions, 2026 (RBI/2026-27/223, effective 1 January 2027): a lender may lock a financed mobile handset only where the loan agreement expressly permits it, may not restrict functionality before 30 days past due, must preserve essential functions including incoming calls and emergency SOS, and owes Rs 250 per hour for wrongful restriction, capped at the loan amount. TRAI opened a quality-of-service consultation on 5 August and published quarterly anti-spam enforcement data on 4 August. CERT-In issued CIAD-2026-0037 on threats targeting Microsoft 365 on 7 August.

At a Glance — W32 Scoreboard

TL;DR for Founders

Three things to act on this week:

1. If you finance handsets or build the software that locks them: from 1 January 2027 device-locking is lawful only where the loan agreement expressly provides for it, only after 30 days past due, only in graduated steps, and never against incoming calls or emergency SOS. Wrongful restriction costs Rs 250 per hour. This is a build item, not a policy item — the 30-day floor, the carve-out and the reversal duty all have to exist in code and in logs.

2. If you rely on Microsoft 365 as your identity and email estate: CERT-In's advisory of 7 August is a prompt to check tenant configuration and, more importantly, tenant logging. From 31 July a regulated entity owes two six-hour reports on one detection — CERT-In under Section 70B of the Information Technology Act, 2000 and RBI via DAKSH. Weak logging does not pause either clock.

3. If any group entity touches telecom infrastructure, radio equipment or user identification: the DoT authorisation portal opened new application heads on 6 August and published User Identification Rules instructions on 9 August. Map each entity to an authorisation head now; the windows are opening on different dates.

Top 3 Developments

1. Can a Lender Remotely Lock a Borrower's Phone in India? RBI Answers with a 30-Day Floor and Rs 250 Per Hour (Fintech-Payments / Data-Protection)

What changed: On 6 August 2026 the Reserve Bank of India's Department of Regulation issued the Reserve Bank of India (Commercial Banks - Responsible Business Conduct) Fourth Amendment Directions, 2026 — RBI/2026-27/223, DOR.MCS.REC.No.193/01-01-032/2026-27 — amending the Reserve Bank of India (Commercial Banks - Responsible Business Conduct) Directions, 2025 with effect from 1 January 2027. Parallel amendment Directions were issued the same day across the rest of the perimeter: Small Finance Banks, Payments Banks, Local Area Banks, Regional Rural Banks, Urban Co-operative Banks, Rural Co-operative Banks, All India Financial Institutions, and NBFCs including Housing Finance Companies.

What it contains: On device restriction — a lender may deploy device-locking mechanisms on financed mobile devices only if the loan agreement explicitly permits it; restrictions cannot begin until 30 days past due, after which gradual restrictions on the device functionalities (except those deemed essential) may be initiated; essential functions must remain accessible, including incoming calls and emergency SOS; wrongful restriction attracts compensation of Rs 250 per hour, capped at the loan amount; borrowers get transparency about what has been restricted and an expedited reversal right once payment is made. On recovery conduct — recovery agents must hold certification from the Indian Institute of Banking and Finance; borrower contact is confined to 08:00 to 19:00 unless the borrower authorises otherwise; the lender must disclose recovery-agency details at least one day before first contact; and harsh practices including abusive language, social-media posting and threatening calls are prohibited. On grievance — a dedicated redressal mechanism with officer contact details included in every recovery communication.

Why it matters: This is the first Indian instrument to treat remote device restriction as a regulated act rather than a contractual remedy, and it lands squarely at the intersection of lending regulation and digital rights. Three points carry beyond banking. First, the express-contract gate disposes of the argument that a locking capability shipped in firmware or in a lender's app is available by default — capability is not authority. Second, the essential-functionality carve-out for incoming calls and emergency SOS creates a floor no commercial term can displace, which is the rule that matters when a locked handset is the only phone in a household. Third, the Rs 250 per hour measure converts a compliance failure into a computable liability, which in turn forces per-device, per-hour evidencing of when a restriction was applied, on what basis and when it was lifted.

The data-protection overlay is unavoidable. A device-management agent operating on a borrower's own handset processes personal data on the data principal's device; a lender relying on it must be able to identify its lawful basis under the Digital Personal Data Protection Act, 2023 (DPDP Act) and show that its Section 5 notice actually describes the capability. The Fourth Amendment's contractual gate is necessary but not sufficient — a loan-agreement clause does not by itself discharge DPDP notice obligations.

Practitioner takeaway: Three workstreams before the 1 January 2027 effective date. Contract — insert or re-paper express device-restriction authority, and align it with DPDP notice content rather than burying it in a general-consent clause. Build — implement the 30-day floor, the graduated-restriction ladder, the essential-function allowlist and expedited reversal as enforced states with immutable logs, because the compensation formula is evidenced hourly. Vendor — push the same obligations down to device-management and collections-technology suppliers, with audit rights over restriction logs.

Link: RBI — Responsible Business Conduct Fourth Amendment Directions, 2026 (Id 13665)

Score: 13/15.

2. What Is TRAI Proposing to Change in the Quality of Service Regulations, 2024? (Telecom-Emerging)

What changed: On 5 August 2026, vide Press Release No. 112, TRAI released a Consultation Paper on Draft Amendments in the Standards of Quality of Service of Access (Wireline and Wireless) and Broadband (Wireline and Wireless) Service Regulations, 2024. It issues from the Authority's Quality of Service division and is open for comments.

Context: The 2024 Regulations set the measurable benchmarks — and the reporting cadence — by which access and broadband providers demonstrate service quality. TRAI has run an unusually dense quality-of-service programme through 2026: eight Independent Drive Test assessments published in the week of 20-26 July alone (press releases No. 96-103), further assessments on 28 July (Godda), 4 August (Srinagar, Ganderbal, Anantnag and surrounding areas) and 14 August (Shimla and Solan), plus Press Release No. 111 of 4 August carrying quarterly anti-spam enforcement data. The consultation paper is the regulatory instrument that converts that measurement programme into revised obligations.

Why it matters: Quality-of-service benchmarks are a business-to-business regulatory transmission belt. They bind authorisation holders directly, but they surface in enterprise connectivity, colocation and managed-network contracts one contracting cycle later, as service-level definitions, measurement methodologies and credit regimes. For a digital business the practical question is not whether it is an addressee — it is not — but whether its connectivity contracts define availability, latency and restoration in terms that will still map to the amended benchmarks. Where they do not, the enterprise customer carries measurement risk that the regulation has moved off the operator.

Practitioner takeaway: Read the paper for measurement-methodology changes and reporting-frequency changes before reading the headline benchmarks; those are the provisions that flow into contracts. Diarise the comment deadline from the paper itself — TRAI states closing dates in the document, and the consultation listing does not always display them.

Link: TRAI — Consultation Papers

Score: 9/15.

3. Quarterly Anti-Spam Enforcement Data and the DoT Authorisation Portal Go-Live (Telecom-Emerging / Platforms)

What changed: Two operational developments. On 4 August 2026, vide Press Release No. 111, TRAI released Quarterly Highlights of Action Against Unsolicited Commercial Communications (UCC) for the period 01.04.2026 to 30.06.2026. Separately, the Department of Telecommunications enabled applications for Radio Equipment Possession Authorisation under the Radio Equipment Possession Authorisation Rules, 2026 on the Authorisation Portal with effect from 6 August 2026, and the Telecom eServices Portal carried notifications dated 9 August 2026 covering the User Identifications Notifications List and the instructions to be specified in accordance with the Telecommunications (User Identification) Rules, 2026.

Why it matters: The UCC quarterly release is enforcement telemetry for the Telecom Commercial Communications Customer Preference Regulations, 2018 (TCCCPR 2018) regime, published while the TCCCPR (Third Amendment) Regulations, 2026 — the anti-spam package carrying AI-based UCC detection, 15-day resource barring and a 7-day consent window — remain under finalisation following the Open House Discussion of 17 July 2026. For any business that sends transactional or service communications at scale, the quarterly data is the best available signal of where enforcement pressure is actually landing ahead of the amended regime.

The DoT portal activity is the operational phase of the migration away from Telegraph Act licensing. It follows the Telecommunications (Authorisation for Provision of Principal Telecommunication Services) Rules, 2026 (notified vide G.S.R. 513(E)), which replace the Unified Licence and UL-VNO framework, and the Telecommunications (Authorisation for Telecommunication Network) Rules, 2026 notified on 20 July 2026 for the network layer — the instrument carrying the absolute in-India localisation obligation in Rule 25(3). The User Identification Rules track is the one platform businesses should watch: identity and number-verification obligations under the Telecommunications Act, 2023 reach beyond licensed operators into the platforms that use phone numbers as a login and provisioning primitive.

Practitioner takeaway: Map each group entity to an authorisation head and check whether its application window has opened on the Telecom eServices Portal — the heads are going live on different dates. For platforms, treat the User Identification Rules instructions as a product-requirements input, not a telecom-department formality.

Link: TRAI — Press Releases | DoT — Telecom eServices Portal

Score: 9/15.

Beyond this Brief Preview — Veritect Legal AI

The clause-level analysis of the Responsible Business Conduct Fourth Amendment Directions, 2026 across all nine regulated-entity classes, the device-restriction state machine mapped against Section 5 notice obligations under the Digital Personal Data Protection Act, 2023, and the full authorisation-head matrix under the Telecommunications Act, 2023 rules family are available in Veritect Legal AI.

Regulatory Action Log — Items 4-8

Veritect daily-news cross-check: Veritect's daily-news output for 3-9 August 2026 carried no technology-law items for this window. No duplication with this tracker.

What's Next

• 17 August 2026 — RBI data-governance consultation closes (Press Release 2026-2027/677). Final week for regulated entities and technology vendors to comment on the Data Function at not below Chief General Manager rank, the Data Owner / Data Steward / Data Custodian roles, and the metadata, lineage, quality and third-party-sharing expectations. Submissions to dor.datagovfed@rbi.org.in.
• 24 July 2026 (already passed) — CERT-In AI Blueprint Phase 3 closed at Day 60 of the CISG-2026-02 roadmap for 25-May starters: red-team exercises, adversarial AI simulations, continuous control validation and model-integrity validation. (Corrected 5 September 2026 — this edition originally gave a 23 August 2026 Phase 3 close and described Phase 3 as external AI supply-chain assessments and board reporting; neither is supported by Section 13 of CISG-2026-02. Third-party and supply-chain assurance is a Phase 2 item.)
• ~August–September 2026 — first OGAI Rule 10 determination orders and register entries under the Promotion and Regulation of Online Gaming Rules, 2026.
• Q3–Q4 2026 — TRAI TCCCPR (Third Amendment) Regulations, 2026 final notification post-Open House, in force thirty days after Gazette publication; RBI final Model Risk Management guidance following the 24 July consultation close.
• ~November 2026 — DPDP consent-manager registration window opens under Rule 4 of the Digital Personal Data Protection Rules, 2025; RBI Q-SAFE quantum-safe roadmap due.
• 1 January 2027 — Responsible Business Conduct Fourth Amendment Directions, 2026 take effect: device-restriction gating, Rs 250-per-hour compensation, IIBF-certified recovery agents, 08:00-19:00 contact window. Same date as the RBI Customer Liability Amendment Directions (Rs 500 SMS alert threshold, 45/60-day fraud investigation, five-day credit-card shadow reversal).
• ~13 May 2027 — end of the 18-month DPDP phased-compliance runway.

Founder Action Items

• Treat device-locking as a product requirement with a hard date. By 1 January 2027 you need express contractual authority, a 30-day-past-due gate, a graduated restriction ladder, an essential-function allowlist covering incoming calls and emergency SOS, expedited reversal on payment, and hourly logs good enough to defend against a Rs 250-per-hour claim.
• Re-paper loan agreements and DPDP notices together. The Reserve Bank requires express contractual permission; the Digital Personal Data Protection Act, 2023 separately requires a Section 5 notice that actually describes the on-device processing. Doing one without the other leaves the exposure open.
• Audit Microsoft 365 tenant logging, not just tenant configuration. After CIAD-2026-0037, the question that decides your position is whether you can establish a detection timestamp. From 31 July, regulated entities owe both a CERT-In filing under Section 70B and an RBI DAKSH filing within six hours of detection.
• Patch the web stack named in the week's CIVN cluster. Ruby on Rails Active Storage (CIVN-2026-0393) and Next.js server-side request forgery (CIVN-2026-0394) sit in the default stack of most Indian product companies; Cisco IOS XE (0397) and Check Point (0395) sit at the perimeter.
• Submit on the RBI data-governance draft before 17 August. If you are a smaller NBFC or a co-operative bank, the Chief General Manager-rank requirement for the Data Function is the proportionality point worth making. If you are a vendor, the third-party data-sharing expectations are the ones that will land in your contracts.
• Map group entities to DoT authorisation heads. Radio equipment possession opened on 6 August; user-identification instructions on 9 August; network-layer and principal-services authorisations earlier. Availability is staggered — build a tracker rather than assuming one cut-over.

Practitioner Watch-List

• The device-restriction rule as a data-protection instrument. Expect the first disputes to be about notice and logs, not about the 30-day floor. Advise clients to preserve restriction logs as a defence artefact, and to check whether the device-management agent collects anything beyond what is needed to enforce restriction — location, contacts and app inventory collected 'for recovery' would be difficult to justify against purpose limitation under the DPDP Act, 2023.
• Parallel amendments across nine entity classes. The Fourth Amendment for Commercial Banks is one of a set issued on 6 August covering Small Finance Banks, Payments Banks, Local Area Banks, Regional Rural Banks, Urban and Rural Co-operative Banks, All India Financial Institutions, NBFCs and Housing Finance Companies. Confirm the correct instrument for each client entity — a Commercial Banks citation will not do for an NBFC file.
• Quality-of-service amendments and enterprise contracts. Track the 5 August consultation paper for measurement-methodology and reporting-cadence changes. These are the provisions that migrate into connectivity and managed-network service levels, and the ones enterprise customers most often fail to update.
• User Identification Rules, 2026 reach beyond operators. The identity and number-verification track under the Telecommunications Act, 2023 builds on the Mobile Number Verification and Telecommunication Identifier User Entity concepts introduced by the Telecommunications (Telecom Cyber Security) Amendment Rules, 2025 of 22 October 2025. Any platform using a phone number as a login or provisioning primitive should be reading this track as a product obligation. Confirm the gazette citation and notification date against the Official Gazette before relying on portal listings in a filing.
• DPBI constitution and the 17 August data-governance close. No Tier 1 notification constituting the Data Protection Board of India under Section 18(1) of the DPDP Act, 2023 was traced as at 9 August 2026. On data governance, the live design question is whether the new Data Function reports into, or is deliberately separated from, the Significant Data Fiduciary's Data Protection Officer under Section 10 of the DPDP Act read with Rules 12 and 13 of the DPDP Rules, 2025.

FAQ

When can a lender in India lock a financed mobile phone?

Only from 1 January 2027, only where the loan agreement expressly permits it, and only after the account is 30 days past due — and even then only through gradual restrictions that preserve essential functionalities including incoming calls and emergency SOS. The rule is in the Reserve Bank of India (Commercial Banks - Responsible Business Conduct) Fourth Amendment Directions, 2026 (RBI/2026-27/223, DOR.MCS.REC.No.193/01-01-032/2026-27, 6 August 2026), with parallel amendments the same day for Small Finance Banks, Payments Banks, Local Area Banks, Regional Rural Banks, Urban and Rural Co-operative Banks, All India Financial Institutions, NBFCs and Housing Finance Companies. Wrongful restriction attracts compensation of Rs 250 per hour, capped at the loan amount, and the borrower has an expedited right to reversal once payment is made.

What else changed in the recovery-conduct rules?

Recovery agents must be certified by the Indian Institute of Banking and Finance. Borrower contact is confined to 08:00 to 19:00 hours unless the borrower authorises otherwise. The lender must disclose recovery-agency details at least one day before first contact. Harsh practices are prohibited by name, including abusive language, posting about the borrower on social media, and threatening calls. Lenders must operate a dedicated grievance-redressal mechanism and include the responsible officer's contact details in every recovery communication. The social-media prohibition is the provision digital-lending platforms should read most carefully, because public shaming has historically travelled through platform features rather than through call centres.

Does the RBI data-governance draft replace the DPDP Data Protection Officer role?

No. The draft Guidance on Regulatory Expectations for Data Governance (Press Release 2026-2027/677, 15 July 2026, comments closing 17 August 2026) proposes a Data Function headed by an officer not below the rank of Chief General Manager, and three named accountability roles — Data Owner, Data Steward and Data Custodian — across 11 regulated-entity categories. These sit alongside, and do not substitute for, the Data Protection Officer required of a Significant Data Fiduciary under Section 10 of the Digital Personal Data Protection Act, 2023 read with Rules 12 and 13 of the DPDP Rules, 2025. The design decision each regulated entity must make is whether the Data Function reports into the DPO or is deliberately separated, because the draft's lineage and third-party-sharing expectations generate DPDP-relevant records either way.

What is the current status of the TCCCPR anti-spam amendment?

The Telecom Commercial Communications Customer Preference (Third Amendment) Regulations, 2026 remain under finalisation following TRAI's Open House Discussion of 17 July 2026. The package under consultation carried AI-based unsolicited-commercial-communication detection, 15-day resource barring and a 7-day consent window. TRAI's Press Release No. 111 of 4 August 2026 publishing quarterly enforcement action for 1 April to 30 June 2026 is the interim signal on how the existing TCCCPR 2018 regime is being enforced. On notification, TRAI regulations typically come into force thirty days after publication in the Gazette; confirm the commencement clause in the notified text.

Which CERT-In items from this week affect a typical Indian SaaS company?

Three. CIAD-2026-0037 (7 August) on emerging threats targeting Microsoft 365 reaches the identity and email estate. CIVN-2026-0394 (6 August) is a server-side request forgery vulnerability in Next.js, and CIVN-2026-0393 (5 August) an arbitrary file read in Ruby on Rails Active Storage — both sit in the default application stack of a large share of Indian product companies. Perimeter items CIVN-2026-0395 (Check Point authentication bypass) and CIVN-2026-0397 (Cisco IOS XE) matter for anyone running their own edge. None of these is itself a reportable incident; the reporting duty under Section 70B(6) of the Information Technology Act, 2000 read with the CERT-In Directions of 28 April 2022 attaches to an actual incident. Record patch timing and preserve logs so that a detection timestamp can be established if one occurs.

Primary Sources

Tier 1 sources only: RBI (rbi.org.in), TRAI (trai.gov.in), DoT (dot.gov.in, eservices.dot.gov.in), CERT-In (cert-in.org.in), SEBI (sebi.gov.in), MeitY (meity.gov.in), eGazette (egazette.gov.in). All developments reported as of 9 August 2026 unless stated. Items flagged 'expected' or 'due' carry that qualifier explicitly. DoT portal items are recorded as displayed on the Telecom eServices Portal; confirm gazette citations against the Official Gazette before citing in filings. Reconfirm against primary-source URLs before acting.

• RBI — Responsible Business Conduct Fourth Amendment Directions, 2026 (RBI/2026-27/223, 06.08.2026)
• RBI — Notifications portal
• RBI — Press Release 2026-2027/677: draft Guidance on Regulatory Expectations for Data Governance
• TRAI — Consultation Papers (Consultation Paper of 05.08.2026 on QoS Regulations, 2024 amendments)
• TRAI — Press Releases (No. 111 of 04.08.2026; No. 112 of 05.08.2026)
• DoT — Telecom eServices Portal
• DoT — Acts and Policies
• CERT-In — Advisories List 2026
• CERT-In — Vulnerability Notes 2026
• SEBI — Circulars listing
• MeitY — Digital Personal Data Protection Rules, 2025
• Gazette of India (eGazette)

Beyond this Brief Preview — Veritect Legal AI

Veritect Legal AI carries the research-grade layer behind this tracker: the full amendment text and entity-class comparison across the 6 August 2026 Responsible Business Conduct amendments, the device-restriction obligation mapped clause-by-clause against the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, the TCCCPR 2018 enforcement architecture and the pending Third Amendment package, and the complete authorisation-head map under the Telecommunications Act, 2023 rules family.

Next edition: W33 tracker covering 10-16 August 2026 — TRAI's 1601-series direction for non-BFSI service and transactional calling, DoT enforcement messaging on IMEI registration and tampering, CERT-In advisories on Microsoft and Apple threat notifications, and SEBI's revised Online Bond Platform Provider framework.

Corrections

5 September 2026 — CERT-In AI Blueprint Phase 3 close date and characterisation. This edition recorded that Phase 3 of CERT-In advisory CISG-2026-02 (25 May 2026) closes on 23 August 2026 for organisations that began the 60-day implementation on the issue date, and described Phase 3 as external AI supply-chain assessments and board-reporting integration. Neither statement is supported by the advisory. Section 13, Recommended Implementation Roadmap, prescribes a three-phase 60-day roadmap — Phase I Immediate Risk Reduction Days 0–7, Phase II Operational Strengthening Days 8–30, Phase III Advanced Resilience and Adaptive Security Days 31–60. For an entity commencing on 25 May 2026, Day 60 fell on 24 July 2026. Phase III comprises red team exercises and adversarial simulations, continuous control validation, security automation and orchestration, AI-assisted defensive operations, operational resilience and continuity planning, adversarial AI testing, validation of model integrity and AI orchestration security, and continuous reassessment of exposure and resilience posture. Third-party and supply-chain assurance is a Phase II item (Days 8–30), not a Phase III one. Recorded rather than silently amended because the error pointed in the direction of telling a reader a compliance window was still open when it had in fact closed a month earlier.