DOT OSP Licence

If you run a BPO, call centre, KPO, or any IT-enabled service that uses telephony to talk to customers — in India or abroad — the Department of Telecommunications wants to know about it. Not the old-school way with fees and bank guarantees. The 2020 New OSP Guidelines tore up most of that paperwork. What's left is a clean self-declaration on the Saral Sanchar portal — but the eligibility question, the network architecture, and the TSP contract still need to be right before you file.

Getting OSP right matters for two reasons. First, your enterprise clients — especially overseas ones — increasingly ask for proof of OSP self-declaration during vendor onboarding. Second, the substantive obligations behind the form — lawful interception cooperation, TEC-compliant equipment, DPDP 2023 controls, and logical separation between domestic and international operations — are exactly where audits and contract reviews dig in. The filing itself is fast. The thinking behind it is what we handle.

At a Glance

• Governing law: Telegraph Act 1885 read with the New OSP Guidelines 2020, as clarified through 2021 and 2023 amendments.
• Who needs it: BPOs, call centres, KPOs, helpdesks, tele-banking, tele-medicine, and similar ITeS units that use telecom resources from a licensed TSP.
• Filing portal: saralsanchar.gov.in — the DoT's unified online portal. Filing is online only.
• Categories: Domestic OSP, International OSP, or Hybrid OSP depending on where your paying subscribers sit.
• Government fee: Nil. The 2020 reform removed registration fees, entry fees, and bank guarantee requirements.
• Turnaround: Self-declaration acknowledgement is typically issued in 3-7 working days; full architecture and SOP alignment runs 2-4 weeks.
• Validity: Self-declaration continues as long as the entity operates — no renewal cycle, only modification intimations when centres, TSP, or EPABX change.
• Key documents: Network diagram, EPABX configuration, TSP agreement, Class-3 DSC of the authorised signatory, and entity KYC.

What's New for FY 2026-27

The OSP regime has shifted from a permission model to a notification model, and the substance keeps moving. Here is what changed in the last eighteen months that you should know before filing or auditing your existing centre.

• DPDP Rules in force: The Digital Personal Data Protection Act 2023 is operational with notified rules. OSP centres handling voice and screen recordings, IVR data, and CRM extracts must map cross-border data transfers and retain consent and breach-notification logs.
• Saral Sanchar V2 stability: The portal's updated OSP module supports faster modification intimations for centre additions, TSP changes, and EPABX upgrades, with reusable entity KYC across filings.
• Logical separation now standard: Shared EPABX and bandwidth between Domestic and International operations is the norm — provided your SOP documents the separation and the TSP agreement reflects it.
• WFH and WFA fully mainstreamed: Work-from-home and work-from-anywhere agents are no longer a clarification footnote; they sit inside the main framework with VPN, endpoint security, and agent authentication as the audit checkpoints.
• TEC compliance scrutiny rising: Imported telephony hardware — IP-PBX, VoIP gateways, SBCs — is being checked more closely by client auditors against TEC equipment-compliance certificates. A non-TEC box on the network is the new compliance gap.
• Client audits replacing DoT audits: Overseas BPO clients run their own audits against ISO 27001:2022, SOC 2 Type II, and PCI-DSS v4.0.1 — your OSP filing and SOP set is what their auditors ask for first.

Who Actually Needs an OSP Filing

Not every IT services company needs an OSP self-declaration. The trigger is the use of telecom resources — leased lines, IPLC, MPLS-VPN, PRI lines, or SIP trunks taken from a licensed TSP — to provide voice or data services to subscribers. Pure software development, SaaS, or web services without that telephony layer often sit outside the OSP definition entirely.

• Domestic call centres: Indian-customer-facing inbound or outbound tele-services — banking helplines, e-commerce support, insurance servicing, healthcare appointment desks, citizen-services contracts.
• International BPOs: Centres serving US, UK, EU, Australia, or Middle East clients on voice or chat, with traffic terminated through Indian leased lines or IPLC circuits.
• Hybrid centres: Operations that handle both Indian and overseas subscribers from the same floor — increasingly common as exporters add domestic accounts and vice versa.
• Tele-medicine and tele-banking: Doctors on call, online consultation desks, and bank tele-collection units that route patient or customer voice traffic through TSP-provided telephony.
• Pure ITeS without telecom interconnect: Software development, app maintenance, analytics, and content moderation over corporate internet without TSP-provided voice circuits — usually outside OSP scope, but the eligibility call still needs documenting.
• Captive in-house centres: An enterprise's own customer-service desk handling its own customers may need an OSP filing depending on size and telecom-resource use.

How It Actually Works

OSP work is roughly twenty percent portal filing and eighty percent documentation. Here is the sequence we follow so the filing is defensible and the underlying architecture matches what you tell the DoT.

Step 1: Eligibility and Category Call

We start with the question nobody asks first: do you actually need an OSP filing at all? We map your service definition, telephony stack, and subscriber profile against the 2020 Guidelines. If you need one, we decide between Domestic, International, and Hybrid based on where the paying subscriber sits. This decision goes in writing so it can be shown to a client auditor later.

Step 2: Network and EPABX Architecture

Next we document what your network actually looks like — EPABX or IP-PBX make and model, agent seat count, recording servers, CRM integration, TSP leased line or IPLC circuit, VPN concentrator for WFH agents, and the data-flow between them. The output is a network diagram and an architecture note that anchors every downstream filing and audit.

Step 3: Saral Sanchar Self-Declaration

With the architecture locked, the actual filing on saralsanchar.gov.in is quick. We register the entity, the authorised signatory with DSC, the centre addresses, the TSP details, the category, and the EPABX configuration. The portal issues a digital acknowledgement which is your OSP registration certificate for client and auditor use.

Step 4: TSP Agreement Review

The TSP contract — Airtel, Jio, Vodafone Idea Business, Tata Communications, or BSNL — is where lawful-interception cooperation, security cooperation, and equipment-compliance clauses live. We review the SLA and, where gaps exist, request an addendum so the TSP-OSP interface meets the substantive obligations the Guidelines preserved after 2020.

Step 5: SOP Build for WFH, Logical Separation, and Data Protection

This is where the bulk of the work sits. We draft the WFH and WFA agent SOP covering VPN, endpoint, authentication, recording, and supervisor controls. For hybrid centres we draft the logical-separation SOP. For DPDP 2023 we draft the data-flow record, consent management note, cross-border transfer note, and breach-notification protocol. These are the documents your client auditor actually reads.

Step 6: Modification Calendar and Ongoing Hygiene

OSP is not file-and-forget. New centre, change of TSP, EPABX upgrade, signatory change, or category shift — each triggers a Saral Sanchar modification within stipulated days. We set up a tracker so these intimations are filed before the change goes live, not after a client audit flags them.

Step 7: Audit Readiness Pack

Finally we assemble the binder: filing acknowledgement, architecture note, TSP agreement, SOPs, DPDP record, TEC certificates, ISO and SOC and PCI evidence as applicable, and the modification log. This is the single artefact that gets passed to client vendor-management teams during onboarding or annual review.

A Real Example: Bengaluru Export BPO Going Hybrid

Consider an export BPO in Bengaluru — 320 seats, currently International OSP only, serving a US health-insurance client. The board has approved a domestic accounts pilot for an Indian fintech, with 80 of the same seats handling Indian customer calls in the evening shift.

• Earlier regime: Under pre-2020 rules this would have required a separate centre, separate EPABX, separate TSP circuits — easily ₹40-60 lakh of capex just to start the pilot.
• Current path: Under the 2020 framework, the centre files a modification on Saral Sanchar to add the Domestic category, becoming a Hybrid OSP from the same Bengaluru address.
• Architecture change: The existing EPABX is reconfigured for two extension ranges — international and domestic — with logical separation documented. The TSP SLA is amended to include domestic PRI capacity alongside the existing IPLC.
• SOP refresh: The agent SOP is updated for the shift switch — the same agent cannot handle both subscriber types in a single session; recordings tagged by category; supervisor dashboards split.
• DPDP layer: Indian customer voice data now sits inside DPDP scope; the data-flow record, consent script, and retention schedule are refreshed for the domestic queue.

Total elapsed time from board approval to first live domestic call: eighteen working days. Total government fees: nil. Total professional cost: a fraction of the avoided capex. This is what the 2020 reform actually unlocked — and why filing the modification correctly matters more than the original registration.

What Backs Up Each Filing — The Substantive Obligations

The 2020 reform removed the bureaucratic crust but kept the substance. Five obligations continue to apply to every OSP and form the audit baseline for client vendor-management teams.

• Telecom resources from licensed TSPs only: Bandwidth, leased lines, IPLC, MPLS-VPN, and SIP trunks must come from a licensed TSP. Grey-route VoIP, unlicensed gateways, and bypass arrangements remain prohibited and are an immediate disqualifier in client audits.
• Lawful interception cooperation: The Telegraph Act obligation to cooperate with security agencies for lawful interception passes through the TSP to the OSP. Your SOP must show how a lawful interception request would be operationally executed.
• TEC equipment compliance: Telephony hardware — EPABX, IP-PBX, VoIP gateways, SBCs — must be TEC certified. Imported boxes without a TEC certificate are a recurring audit finding, especially after refresh cycles.
• DPDP 2023 obligations: Personal-data flows in voice recordings, IVR logs, CRM extracts, and agent screen captures fall inside DPDP scope. Consent, purpose limitation, cross-border transfer rules, and breach notification within 72 hours all apply.
• Client-contract overlay: ISO 27001:2022, SOC 2 Type II, PCI-DSS v4.0.1, HIPAA, and HITRUST — your client contracts pull these in. The OSP filing sits inside this overlay, not separately.

The form on Saral Sanchar is the easy part. The five obligations above are what a client auditor actually wants to see — and they are non-negotiable.

Where It Goes Wrong: The Common Mistakes

Across hundreds of OSP files reviewed, the same handful of gaps shows up. None of these is fatal on its own — combined, they are how client onboarding stalls.

• Filing without the architecture call: Someone fills the portal in forty minutes, picks 'International' because the boss said the client is in the US, and ignores the domestic pilot. The category is wrong from day one and the modification never gets filed.
• Forgetting the modification intimation: New centre opens in Pune, EPABX gets upgraded, the signatory changes — and nothing is filed on Saral Sanchar. The current state stops matching the declared state. A client auditor spots this in ten minutes.
• Treating WFH as a workaround: Agents take laptops home, log in over residential broadband, and connect to the cloud PBX without a documented VPN and endpoint policy. The 2020 framework permits WFH — but only with the SOP in place.
• Non-TEC equipment on the network: An imported IP-PBX or SBC arrives, gets racked, and goes live without a TEC certificate. The client auditor asks for the certificate, and the box has to be swapped at peak season.
• No DPDP layer for the voice data: Recordings, IVR data, and CRM extracts move cross-border to a US client's data lake. No consent script, no cross-border transfer note, no retention schedule. DPDP applies, and the OSP centre is the data fiduciary in that chain.
• No audit binder at hand: Filing acknowledgement sits in someone's inbox, the architecture note is in a draft folder, SOPs are in three different formats. When the client audit lands, three teams spend a week recreating the binder.

What You Receive at the End

• Saral Sanchar OSP self-declaration acknowledgement or registration certificate as a downloaded PDF, ready for client vendor packs
• Eligibility and category decision memo signed by a qualified professional
• Network architecture diagram and EPABX configuration note
• Reviewed TSP service-level agreement with marked-up compliance annexure
• Work-from-home and work-from-anywhere SOP for OSP agents
• Logical-separation SOP for hybrid centres operating domestic and international from one floor
• DPDP 2023 compliance pack — data-flow record, consent script, cross-border transfer note, breach-notification protocol
• TEC equipment compliance register for telephony hardware on the network
• Modification triggers calendar covering centre, TSP, EPABX, and signatory changes
• Audit-ready binder consolidating all of the above for client vendor-management onboarding

How to Get Started

The first conversation is a thirty-minute call where we walk through your current setup — service definition, agent count, EPABX, TSP circuits, WFH proportion, and the geography of your subscribers. By the end of the call we usually know whether you need a fresh OSP self-declaration, a modification to an existing one, or no filing at all because your service sits outside the telecom-resource definition.

Once you confirm the path, we share a document checklist mapped to your specific setup — entity KYC, board resolution, DSC of the signatory, TSP agreement, EPABX details, and network description. The filing acknowledgement typically lands in three to seven working days, and the full architecture, SOP, and DPDP layer is delivered over the following two to four weeks. Share the basics — entity name, centre address, subscriber type, and TSP — to begin.