Short answer: Starlink holds a licence in India, but it cannot start commercial service until security clearance and spectrum assignment are complete. The security conditions attached to that clearance are, in effect, a data sovereignty test: gateways in India, data that never leaves the country, and traffic the authorities can monitor and restrict.
Facts as reported up to 12 October 2026. This is general information, not legal advice.
What happened this week
On 7 October 2026, Elon Musk posted on X that unnamed "oligarchs" were blocking Starlink's India launch to maintain their "monopolistic chokehold on the Indian people", and called it a "crime against the people of India". He did not provide evidence. India's Ministry of Communications responded that its satellite communications framework is fair and non-discriminatory, and said: "The suggestion that the framework or its application is unfair or discriminatory is baseless and misconceived." It said three licensed operators are at broadly the same regulatory stage, all undergoing security assessments.
Government officials called Musk's claim that India was holding up Starlink's licence "blatantly false". Communications Minister Jyotiraditya Scindia said Jio Satellite Communications, Bharti-backed OneWeb and Starlink have all received licences, but each must meet the prescribed requirements before starting services.
Musk also posted: "if Starlink is too expensive in India, no one will buy it, so SpaceX will need to make pricing affordable." No Starlink price for India has been announced.
Timeline: the regulatory steps so far
| Date | Step |
|---|---|
| 2021 | The Department of Telecommunications warned customers against Starlink pre-orders, as it had no authorisation. |
| June 2025 | Starlink received its GMPCS authorisation from the Department of Telecommunications. |
| July 2025 | IN-SPACe cleared Starlink's Gen-1 constellation. |
| August 2025 | UIDAI onboarded Starlink for Aadhaar-based customer verification. |
| September 2025 | Starlink received provisional spectrum for trials. |
| As of 8 October 2026 | Still pending: security clearance, foreign investment approval and the final spectrum framework. The proposed spectrum charge of 5% of adjusted gross revenue awaits Union Cabinet approval. |
Spectrum is allocated administratively, not by auction.
The security conditions
Security concerns date to 2024, when authorities reported finding Starlink devices in a drug seizure in the Andaman and Nicobar Islands and during an operation in Manipur. The conditions below were stated by Minister of State for Communications Pemmasani Chandra Sekhar in August 2025, with the laser-link question reported in October 2026:
- Earth station gateways must be set up in India.
- No user traffic to or from India may be routed through a gateway outside India.
- No copying or decryption of Indian data outside the country.
- Indian user traffic must not be mirrored to any system or server abroad.
- Traffic from Indian users must be monitorable and controllable within India, and lawful interception is required.
- Authorities must be able to restrict service in specific areas or for specific users during emergencies.
- Authorities are examining whether laser links between satellites could let Indian traffic bypass Indian gateways.
Starlink reports more than 20 gateway sites in India and says Indian user data stays in India.
What these conditions show about where Indian regulation is heading
Read the list again and a pattern appears. India is not only asking whether a foreign operator is trustworthy; it is writing the operating model into the licence. Gateways on Indian soil, traffic that never leaves the country, decryption that stays in India, lawful interception and an emergency off-switch: each condition moves control from the vendor's network to the regulator's reach.
The privacy law alone does not create this outcome. The DPDP Act allows personal data to be transferred outside India except to countries the government restricts. But sector rules such as telecom licence conditions can still require data and traffic to stay in India. If you review vendors against DPDP only, you will miss the sector rules that actually bind them. See our DPDP Act compliance consulting.
CERT-In's directions of 28 April 2022 push the same way: covered organisations must report cyber incidents within 6 hours and keep ICT system logs for 180 days within India. A vendor that cannot meet either requirement fails those directions, not just a best practice.
What GRC teams should take from this: vendor review questions
We use these questions in vendor reviews for satellite and other connectivity vendors; they work for any vendor that carries your data across a border:
- Where is our data stored, and where is it decrypted? Who holds the keys?
- Can the data leave India, and through which sub-processors?
- Is any traffic routed or mirrored through systems abroad?
- Can the vendor meet CERT-In's 6-hour incident reporting window?
- Does the contract give us audit rights?
These questions map to the supplier-relationship controls in ISO 27001 (Annex A 5.19 to 5.22), covered in our ISO 27001 consulting, and to vendor management under CC9 in SOC 2, covered in our SOC 2 consulting. Record the answers in your vendor register and re-check them at each renewal, not only at onboarding.
Book a call about vendor risk or DPDP readiness
If your review list includes satellite, connectivity or cross-border vendors, we can help you pressure-test the answers before your customers or regulators do. See our GRC consulting services and DPDP Act compliance consulting, or book a 30-minute call.