Telecom Data Retention

Also known as: Communications data retention

Data retention is the legal obligation on electronic communications providers to store specified categories of traffic, location and subscriber metadata for a defined period so that competent authorities can access them for the investigation of serious crime. National regimes vary in scope and duration; retained data typically covers who communicated with whom, when, from where and by what means, but not the content of communications.

Categories: Identity and SubscriberRegulation and Compliance

Data Retention in context

Subscriber identifiers (IMSI, SUPI, MSISDN, IMEI) are the anchor for authentication, charging, lawful interception and fraud analytics. Any protocol or interface that leaks a permanent identifier is treated as a serious privacy defect, which is why 5G introduced SUCI concealment on the air interface.

Telecom regulation is fragmenting: NIS2 and the CER Directive in the EU, the Telecoms Security Act in the UK, sector rules in the US, GCC and APAC, plus horizontal frameworks like GDPR and DORA. Operators need control-level mappings between technical baselines (GSMA FS.11/FS.19) and each jurisdictional obligation.

To place Data Retention in the wider telecom-security picture, review GDPR, Metadata Retention, DSLAM, Any-Time Interrogation (ATI), Malware and SMSC.

Related terms

Related topic hubs

More from the TelcoSec Glossary

Browse the full TelcoSec Glossary, the Ultimate Guide to Mobile Network Security, or the P1 Arsenal of telecom-security tools.