MeitY is conducting routine stakeholder consultations on safety and security requirements, with continuous engagement with industry on security standards

1. At a Glance

MeitY is running structured, routine stakeholder consultations with industry to evolve a regulatory framework for mobile device safety & security standards [S1].
Anchored in the Government's stated commitment to cybersecurity and citizen privacy in India's digital ecosystem amid >1 billion mobile users [S1].
Relevant for UPSC under GS-III (cyber security, IT) and GS-II (governance, consumer protection); links to DPDP Act 2023, IT Act 2000, CERT-In, BIS ecosystem [S1][S3].

PIB Release, 11 January 2026, by Ministry of Electronics & IT clarifying that MeitY's engagement with smartphone industry is a routine, ongoing consultation — not a one-off regulatory push [S1].
Triggered by industry concerns over compliance burden related to safety testing, EMI/EMC parameters, Indian-language support, interface and security standards on smartphones [S1].

IT Act, 2000 — foundational statute; Section 70B created CERT-In under MeitY [S3].
National Cyber Security Policy, 2013 — first umbrella cyber policy, articulates secure computing environment & trust in transactions [S4].
Mobile Security Roadmap & parallel IoT Security Roadmap, Cryptography Roadmap, Cyber Forensics Roadmap published by MeitY for sector-wise capability building [S2][S5].
CERT-In Directions, 28 April 2022 — mandatory cyber incident reporting (within 6 hours) [S3].
Digital Personal Data Protection (DPDP) Act, 2023 — statutory regime for personal data; complements device-security push [S1].

Nodal Ministry: Ministry of Electronics & Information Technology (MeitY) [S1].
Statutory anchor: IT Act 2000; DPDP Act 2023; Bureau of Indian Standards Act, 2016 (for device certification) [S1][S3].
Implementing arms: CERT-In (incident response), STQC (Standardisation Testing & Quality Certification), BIS (product standards), NCIIPC (critical infra) [S3][S6].
User base context: >1 billion mobile subscribers in India; smartphones used for financial txns & public service delivery [S1].
Consultation scope: safety compliance, EMI/EMC parameters, Indian language support, interface requirements, security standards [S1].

Legal / Constitutional: rests on Article 21 right to privacy (Puttaswamy, 2017); statutory expression in DPDP Act 2023 and IT Act 2000 [S1].
Economic: India is the world's 2nd-largest smartphone market; over-prescriptive standards risk raising compliance cost for OEMs — hence MeitY's claim that consultations are collaborative, not coercive [S1].
Scientific / Technological: standards span hardware (EMI/EMC), software (pre-loaded apps, OS update obligations), cryptography — flowing from Cryptography Roadmap [S2].
Administrative: multi-agency split — MeitY (policy), BIS (standards), CERT-In (incidents), TRAI/DoT (telecom layer) — federal interplay limited; mobile security is largely Union domain (Union List Entry 31) [S3][S6].
Ethical / Governance: transparency via public consultations vs. concerns of regulatory capture by large OEMs; balances digital sovereignty with global supply chains [S1].

11 Jan 2026 — PIB clarification on routine MeitY-industry consultations [S1].
MeitY publication of Guidelines on Information Security Practices for Government Entities [S7].
Continued operationalisation of DPDP Act, 2023 rules (draft rules circulated Jan 2025) [S1].
MeitY updating sectoral roadmaps — Mobile Security Roadmap & IoT Security Roadmap [S2][S5].

CERT-In is the national nodal agency for cyber incidents, under Section 70B of IT Act, 2000, administered by MeitY [S3].
NCIIPC (critical infrastructure protection) — under NTRO, not MeitY [S3].
National Cyber Security Policy was notified in 2013 [S4].
CERT-In April 2022 Directions mandate incident reporting within 6 hours [S3].
Digital Personal Data Protection Act was enacted in 2023 [S1].
STQC (testing & certification body) is an attached office of MeitY [S6].
Mobile security consultations cover EMI/EMC, Indian language support, interface, security — examinable list [S1].
India has >1 billion mobile users (govt figure cited in release) [S1].
MeitY has published Mobile Security Roadmap, IoT Security Roadmap, Cryptography Roadmap, Cyber Forensics Roadmap [S2][S5].
Product standards for electronic goods are notified by BIS, under the BIS Act, 2016 [S6].
Right to Privacy is a fundamental right under Article 21 (K.S. Puttaswamy, 2017) — basis of DPDP Act [S1].

GS-III — Internal security: Challenges to internal security through communication networks; Cyber security.
GS-II — Government policies: Issues relating to development & management of social sector / services (consumer + data protection).
Plausible question stems: 1. "Stakeholder consultations are necessary but insufficient to secure India's mobile ecosystem." Examine in light of MeitY's ongoing engagement with smartphone industry. (GS-III, 250 words) 2. Discuss the institutional architecture for cyber security in India and evaluate the role of CERT-In and MeitY. (GS-III, 150 words) 3. Balancing user privacy, national security, and ease of doing business in mobile device regulation — critically examine. (GS-II/III, 250 words)

DPDP Act, 2023 — statutory privacy regime complementing device security.
CERT-In 2022 Directions — incident reporting & logs retention.
IT Act, 2000 (and Intermediary Rules 2021) — base statute.
National Cyber Security Strategy (under formulation) — successor to 2013 policy.
BIS standards & STQC certification — product compliance mechanism.
NCIIPC & Critical Information Infrastructure — cross-link to internal security.
Puttaswamy judgment (2017) — constitutional foundation for privacy.
Global frameworks: Budapest Convention, GDPR — for comparative perspective.

Confusing CERT-In (MeitY) with NCIIPC (NTRO) — different parents.
Treating the National Cyber Security Policy as 2020 or 2023; correct year is 2013 [S4].
Assuming BIS falls under MeitY — it is under Ministry of Consumer Affairs [S6].
Conflating DPDP Act 2023 with IT Act 2000 provisions on data — DPDP supersedes Section 43A regime.
Misreading the 11 Jan 2026 release as new regulation — it is a clarification that consultations are routine, not a fresh mandate [S1].

[S1] MeitY Routine Stakeholder Consultations — PIB Release, 11 Jan 2026 — https://www.pib.gov.in/PressReleasePage.aspx?PRID=2213520&reg=3&lang=1 — (tier 1)
[S2] Mobile Security Roadmap — MeitY — https://www.meity.gov.in/content/mobile-security-roadmap-1 — (tier 1)
[S3] CERT-In page — MeitY — https://www.meity.gov.in/content/icert — (tier 1)
[S4] National Cyber Security Policy 2013 — MeitY — https://www.meity.gov.in/static/uploads/2024/02/National_cyber_security_policy-2013_0.pdf — (tier 1)
[S5] IoT Security Roadmap — MeitY — https://www.meity.gov.in/content/iot-security-roadmap-1 — (tier 1)
[S6] Standards & Policies (e-Governance) — MeitY — https://www.meity.gov.in/content/standards-policies — (tier 1)
[S7] Guidelines on Information Security Practices for Government Entities — MeitY — https://www.meity.gov.in/guidelines-information-security-practices-government-entities-safe-trusted-internet — (tier 1)