Access the official copy here.
The Telecommunications (Regulatory Sandbox) Rules, 2026 have been notified by the Department of Telecommunications (DoT). The rules were published in the Gazette on October 21, 2026, as G.S.R. 905(E) and came into force the same day.
They were published on October 21, 2026, in the Gazette as G.S.R. 905(E) and came into force on the same day.
Parts of India’s telecom licensing law for companies, researchers and individuals testing new services on a limited group of users can now be set aside by the Government because of these rules. Terms of each exemption will be decided per sandbox and will be made available on the government portal. The draft says that every sandbox “shall specify” its scope, eligibility criteria, exemptions, validity period and exit strategy. In contrast, the notified version says the government “may specify on the portal one or more of the following terms and conditions”.
Before these came out, the Telecom Regulatory Authority of India (TRAI) first consulted on a telecom sandbox in 2023. This was when the regulator was told by Bharti Airtel and Jio that rigorous testing was already allowed by the existing mechanisms, MediaNama reported. As a response, TRAI came out with a recommendation of a sandbox framework in April 2024; then, in November, the DoT published draft rules under the Telecommunications Act, 2023.
What can be tested, and on whom?
According to Rule 3, they exist “for the purposes of facilitating innovation and technological development in telecommunications”. Telecom services, processes, technologies, networks, equipment, products or business models can all be covered by a sandbox. And the test users are defined as “the limited set of users who voluntarily participate in a regulatory sandbox“.
A sandbox can be created by the government on its own after “assessing the need for the same”, or if an applicant submits a proposal in response to a government request for proposals or on its own initiative.
Who can apply?
An applicant, as defined by Rule 2, is “an authorised entity or company, society or partnership firm or a statutory body, duly incorporated, registered or constituted under any law for the time being in force in India, or an Indian national, or a research and development institution recognised by the Department of Science and Technology“.
A proposal would need the following:
- Lab results in the form of “copies of reports of the limited testing undertaken by the applicant in offline or laboratory environment”
- Reports of any other tests, “including in experimental isolated networks”
- Note on exemptions sought, such as assignment, authorisation, or other requirements, which need to be set aside for the sandbox.
- And a non-refundable processing fee of Rs 10,000
The government may inquire into a proposal’s eligibility and then “either accept or reject such proposal”. The rules do not specify a deadline for the decision.
What can be waived?
For each sandbox, Rule 5 lets the government specify:
“The exemptions granted from the requirements of authorisation or assignment or any other provisions under the Act or the rules made thereunder, or under the Telecom Regulatory Authority of India Act, 1997 (24 of 1997) or the regulations made thereunder for the validity period of the regulatory sandbox”
Authorisation refers to the licence to provide a telecom service or establish or operate a telecom network, while assignment refers to the allocation of spectrum. For waiving any provision of the TRAI Act, “prior consultation with the Telecom Regulatory Authority of India” is required. The draft of the rules previously only covered the Telecommunications Act and rules made under it as exemptions.
Duration of a sandbox: For up to 24 months at a time, a sandbox can be run and may be extended, upon request by the applicant, by the government “for a further period not exceeding twelve months at a time”. This request needs to be made at least 30 days before the sandbox expires and “accompanied by justification and purposes of such extension”. The rules do not specify a limit on the number of extensions.
What do test users get?
The approved applicant must do the following when their sandbox enrols test users:
- “inform such test users the purpose and scope of testing being undertaken”
- “obtain prior consent of the test users for being part of the test environment of the regulatory sandbox”
- “ensure that test users are not charged for their participation in the test environment”
The “laws relating to data protection and security” must also be followed by the applicant when onboarding test users. These obligations will become particularly relevant when major provisions of India’s data protection framework take effect on May 13, 2027. The rules also say that while undergoing testing, a product must not be “commercially available in the market during the testing period”, and any records, including consent records of users, need to be stored for at least a year after the sandbox ends. The records must subsequently be destroyed “in a secure manner“.
An important point to note is that there are no complaint mechanisms mentioned in the rules for users participating in testing, and complaints are only mentioned in the applicant’s final report, which must include “feedback from the test users, including complaints, concerns, security issues”. However, the government can issue directions “for protection of participants and test users”. The rules do not specify how or when these protective directions must be issued.
How much of this will the public see?
“The regulatory sandbox, including testing and results thereof” are to be kept confidential by the applicants and participants. The government “may publish any relevant and generic information about the regulatory sandbox, including the approved applicants and participants, without revealing any proprietary information”, but it is not required by the rules for the test results to be published or for the final reports to be shared.
Applicants are also required to “keep the Central Government indemnified from any acts of omission or commission, breaches or any kind of culpability or liability arising out of or in relation to any testing in the regulatory sandbox”.
Who watches the sandboxes, and when can approval be pulled?
The government will monitor each sandbox. Reports and data may be called for by it, or for “physical or virtual access” to be demanded. The government “may, where considered necessary, seek the advice or assistance of one or more external experts”. SCC Online and Fox Mandal note that the prior 2024 draft of the rules had provided for a governance committee which would monitor sandboxes and recommend suspensions where needed. The notified rules contain no equivalent provision.
The government can also suspend or revoke an approval “by order and recording the reasons therefor” on four grounds under Rule 9:
- Interference: If the sandbox “is interfering with the operations of a telecommunication network established by an authorised entity”.
- Non-compliance: If the applicant gave “incorrect or false information“, broke the sandbox’s conditions or failed to make participants comply.
- Security: If the government is of the opinion that suspension is needed “in the interest of national security or public interest“.
- Adjudication: If the applicant has been held in breach of the rules in proceedings under Chapter VIII of the Telecommunications Act.
In the entirety of the rules, “an opportunity of being heard” is only present with the ground of non-compliance. There is also no refund of fees if the approval is suspended or revoked. The government can also permit steps towards “commercial deployment of the product, service or business model in accordance with the provisions of the Act,” or extend/close the sandbox as it deems fit when testing ends. The rules do not expressly provide applicants with equivalent decision-making or hearing rights in these circumstances.
Also read:
