# Running a telecom data governancedata governanceData governance is the set of policies, roles, and processes that ensure data is accurate, secure, well-defined, and used responsibly across an organization.View full definition → operating model
At 2:47 AM, a fraud analyst at a tier-1 operator gets an automated alert: a law enforcement request has come in for real-time location data on a subscriber, but the request is missing a case number. The network team can technically pull the data in under a minute. Legal says the request doesn't meet the retention and disclosure standard. IT owns the pipelinepipelineAll active sales opportunities across the stages of the sales process, together with their combined potential value and probability of closing.View full definition → that would execute the query. Nobody in the room can say, with certainty, who has the authority to say no. That gap, not the technology, is what a operating model exists to close.
Telecom operators sit on some of the most sensitive personal data in any industry: call detail records (CDRs, the logs of who called whom, when, and for how long), real-time and historical location data derived from cell tower triangulation, and increasingly, behavioral data from apps and IoT (Internet of Things) devices riding their networks.
This data is valuable to three very different constituencies at once:
Each constituency has a legitimate claim. Each also creates a distinct misuse risk. Governance is the structure that decides, in advance, who gets to say yes.
Three regulatory regimes matter most for 2026 planning:
GDPR (General Data Protection Regulation), enforced by national Data Protection Authorities (DPAs) across the EU, treats location data as personal data requiring a lawful basis for processing (consent, contract, or legitimate interest). The ePrivacy Directive, sometimes called the "cookie law," specifically covers traffic and location data generated by electronic communications and generally requires consent or anonymization before use for anything beyond billing.
In the US, the Federal Communications Commission (FCC) enforces Section 222 of the Communications Act, which classifies location and call data as Customer Proprietary Network Information (CPNI) and restricts its use and sharing. The FCC has issued significant fines in past years to carriers for selling location data to third-party aggregators without consent; the FCC's CPNI enforcement page is a useful primary source for tracking these actions.
CALEA (Communications Assistance for Law Enforcement Act) in the US and equivalent lawful intercept frameworks in the EU (implemented country by country) legally require operators to build interception capability for authorized law enforcement requests, creating a permanent tension: the same infrastructure that enables compliance is a misuse risk if access controls are weak.
A credible telecom data governancedata governanceData governance is the set of policies, roles, and processes that ensure data is accurate, secure, well-defined, and used responsibly across an organization.View full definition → council is not a compliance checkbox. It is a standing body with real veto power, typically structured around three seats:
Network/Engineering. Owns the data at the point of generation (cell towers, core network elements). They understand technical feasibility: what can actually be logged, anonymized, or purged.
IT/Data platform. Owns the pipelines, warehouses, and access layers. They are accountable for who *technically* can query what, and for logging every access event.
Legal/Privacy (often under a Data Protection Officer, or DPO, a role GDPR mandates for organizations processing large volumes of sensitive data). Owns interpretation of the lawful basis and jurisdictional requirements, and has authority to block a data use case even if it's technically ready to ship.
A fourth seat, often underweighted, is business/commercial (marketing, product) because they're the ones proposing new uses like location-based advertising or third-party datathird-party dataData purchased from external aggregators, collected from audiences you don't own. It is bought or licensed rather than gathered through your own direct relationships.View full definition → monetization deals. They should be in the room, but without veto power, precisely because they have the strongest incentive to push boundaries.
A RACI matrix (Responsible, Accountable, Consulted, Informed) is only useful if it holds up under pressure, meaning during an actual breach or regulator inquiry, not just in a slide deck.
For a use case like "location data shared with a third-party analytics vendor for retail footfall insights":
| Activity | Network | IT/Data | Legal/DPO | Business |
|---|---|---|---|---|
| Define lawful basis | Consulted | Consulted | Accountable | Responsible (drafts use case) |
| Anonymization/aggregation design | Responsible | Responsible | Consulted | Informed |
| Access provisioning to vendor | Consulted | Accountable | Consulted | Informed |
| Ongoing audit of vendor use | Informed | Responsible | Accountable | Informed |
| Breach response if vendor misuses data | Consulted | Responsible | Accountable | Informed |
The critical design choice: Legal/DPO holds Accountable on the lawful basis and on breach response, not IT. This matters because when regulators investigate (as European DPAs have done with several operators over ePrivacy Directive violations), they ask "who approved this use case," not "who wrote the query." If Accountability sits with IT, the operator has effectively no defensible governance story.
Governance councils fail when they exist only on paper. The checks that make them real:
1. Access recertification, quarterly. Every individual and system with query access to CDR or location tables gets reviewed. Dormant access (an employee who changed roles six months ago) is the single most common finding in telecom data audits.
2. Purpose-limitation audits. Sample a set of queries run against subscriber data monthly and check them against the stated business purpose on file. This directly tests GDPR's purpose limitation principle.
3. Data retention sweeps. CDRs and location logs should have defined retention periods (commonly cited industry practice keeps detailed CDRs for billing-dispute windows, often around 12 to 24 months, though exact periods are operator- and jurisdiction-specific and should be verified against each operator's published retention policy). Automated jobs should confirm deletion actually happens, not just that a policy exists.
4. Third-party data-sharing contract reviews. Any vendor receiving even aggregated location data should be re-audited annually against its data processing agreement (DPA under GDPR terminology, a contract governing how a processor handles data on behalf of a controller).
5. Lawful intercept request logging. Every law enforcement request, approved or rejected, gets logged with a timestamp, requester ID, and legal basis cited. This log itself becomes evidence in future disputes or regulatory reviews.
A simple audit query pattern IT teams commonly run to flag purpose-limitation violations looks like this:
SELECT query_id, user_id, table_accessed, stated_purpose, query_timestamp
FROM data_access_log
WHERE table_accessed IN ('cdr_records', 'location_pings')
AND stated_purpose NOT IN (
SELECT approved_purpose FROM governance_use_case_registry
);Any row returned is a governance exception requiring escalation to the council, not a quiet fix by IT.
Knowledge check
1. In the opening scenario, a fraud analyst, legal, and IT cannot agree on who can refuse a law enforcement request missing a case number. What core governance gap does this illustrate?
2. Why does telecom data governance require reconciling the interests of network operations, marketing/analytics, and law enforcement rather than just picking one group's priorities?
3. A marketing team wants to use location data for a targeted churn-prediction campaign. Under a GDPR-informed governance model, what must be established before this use is permissible?
4. Select ALL correct answers: Which of the following are examples of sensitive data that telecom operators uniquely sit on, creating heightened governance stakes?
Select all the correct answers.
5. Select ALL correct answers: Why is a formal data governance operating model necessary in telecom, based on the reasoning in the lesson?
Select all the correct answers.
Return to the 2:47 AM request. A working governance model means the analyst has a documented escalation path: reject requests without a case number by default, escalate ambiguous ones to an on-call Legal/DPO contact, and log the decision regardless of outcome. Without this, the default behavior under time pressure is usually to comply first and question later, which is exactly the pattern that has led to regulatory fines in both the US and EU in recent years.
For a deeper primary-source reference on how European regulators view telecom-specific privacy obligations, the European Data Protection Board (EDPB) guidelines publish sector guidance updated periodically.