eKYC, GDPR & Log Retention Compliance for Partners

Why Compliance Matters More Than Ever for eSIM Partners

If you're distributing travel eSIMs as a reseller, affiliate, or white-label partner, compliance isn't a box-ticking exercise — it's the foundation of a sustainable business. The global regulatory landscape for digital identity, telecoms, and data privacy has tightened considerably since 2023, and 2026 brings fresh obligations that every partner needs to understand.

According to the GSMA's 2025 Mobile Economy Report, eSIM connections are projected to exceed 3.4 billion globally by 2030, with travel eSIM adoption accelerating fastest in North America, Europe, and Southeast Asia. That growth is drawing regulatory attention: telecom regulators in the EU, UK, Australia, and across Asia are actively updating rules around subscriber identity, data residency, and audit-log standards.

Here's the headline: GDPR fines totalled over €2.9 billion across all enforcement actions from 2018 through early 2026, according to the GDPR Enforcement Tracker, maintained by CMS Law. Telecom and tech companies feature prominently. Partners who handle end-user data carelessly are exposed — and so, by extension, is Simology's network.

This guide walks through each compliance layer in plain language, explains what's changed in 2025–2026, and gives you actionable checklists you can implement immediately.

---

What Is eKYC, and When Do Partners Need to Apply It?

eKYC — electronic Know Your Customer — is the digital process of verifying a subscriber's identity before issuing a SIM or eSIM. Whether you need to run eKYC at the point of sale depends almost entirely on which country the subscriber is activating in, not where your business is registered.

This is a critical nuance. There is no single global rule requiring eKYC for eSIM sales. Requirements are set at the national level, and they vary enormously — from no requirement at all to full biometric verification.

Which Countries Require Subscriber Registration for eSIMs?

The majority of countries that require SIM registration apply the same rules to eSIMs. Here's a practical breakdown by region:

Mandatory registration (eKYC or in-person ID):

• Germany — German national law (Telekommunikationsgesetz, TKG) requires ID verification before SIM/eSIM activation. Carriers must retain subscriber data for the duration of the contract plus a regulatory period.
• France — French telecoms law mandates pre-activation identity verification.
• Spain, Italy — National regulations require valid government-issued ID.
• India — The Department of Telecommunications mandates full eKYC (Aadhaar-linked or video KYC) for all SIM/eSIM activations.
• Australia — The Telecommunications (Service Provider — Identity Checks for Pre-paid Mobile Carriage Services) Determination 2017 (updated 2023) requires identity verification for all prepaid services, including eSIMs.
• UAE, Saudi Arabia, Qatar — Gulf states require passport-level ID for all mobile subscriptions, including visitor eSIMs.
• Japan — eKYC is required; carriers must verify identity via approved digital methods.
• South Korea — Full identity verification required; foreign passport accepted for travel eSIMs.

No general registration requirement (as of mid-2026):

• Netherlands — No national law mandating prepaid SIM registration.
• Ireland — No registration requirement for prepaid services.
• Czech Republic — No mandatory SIM registration law.
• Romania — No mandatory registration requirement.
• United States — No federal law requires prepaid SIM/eSIM registration (though carriers may apply their own policies).
• Canada — No national registration mandate.

Important note on the EU: There is no EU-wide regulation requiring ID for prepaid SIMs or eSIMs. The European Commission has proposed (but not enacted as of mid-2026) a Council-level framework to restrict anonymous SIMs — treat this as a proposal to monitor, not a current legal obligation. Each EU member state's national law governs its own requirements.

What Does a Compliant eKYC Flow Look Like?

A robust eKYC integration for eSIM partners typically involves:

1. Document capture — The user photographs or uploads a government-issued ID (passport, national ID card, or driving license).
2. Liveness check — A selfie or short video confirms the person presenting the document is physically present (anti-spoofing).
3. Data extraction & verification — OCR extracts name, date of birth, and document number; the provider checks against a sanctions/watchlist database.
4. Audit record creation — A timestamped, encrypted record of the verification result (pass/fail) and the document type used is stored — but not the raw document image unless explicitly required by local law.
5. Consent capture — The user explicitly consents to identity processing, with a clear explanation of retention period.

Partners using Simology's API can pass a kyc_verified: true flag along with a jurisdiction code when a compliant eKYC has already been completed upstream. This avoids double-verification friction for the end user.

For destinations where your travelers frequently activate — such as eSIM plans for Germany or eSIM plans for Australia — make sure your onboarding flow is configured to trigger eKYC for those jurisdictions automatically.

---

How Does GDPR Apply to eSIM Partner Operations?

GDPR (the EU General Data Protection Regulation) applies to any organization that processes personal data of people in the European Economic Area — regardless of where the organization itself is based. If you sell travel eSIMs to EU residents, GDPR applies to you.

For eSIM partners, the key personal data categories in play include: name, email address, payment information, device IMEI/EID, IP address at activation, and any eKYC data collected. Each of these triggers GDPR obligations.

What Are the Core GDPR Obligations for Partners?

1. Lawful basis for processing You must identify a lawful basis before processing any personal data. For most eSIM partners, the relevant bases are:

• Contract performance (Article 6(1)(b)) — processing the name, email, and payment data needed to fulfill the eSIM order.
• Legal obligation (Article 6(1)(c)) — processing eKYC data where national law requires subscriber registration.
• Legitimate interests (Article 6(1)(f)) — fraud prevention and security logging, subject to a documented balancing test.

Relying on consent for operational data (e.g., activation logs) is generally inadvisable — consent can be withdrawn at any time, which creates operational problems. Reserve consent for optional processing like marketing emails.

2. Data minimization (Article 5(1)(c)) Collect only what you genuinely need. If a jurisdiction doesn't require eKYC, don't collect passport images. If your fraud system only needs an IP address and device fingerprint, don't also store the user's physical address.

3. Purpose limitation (Article 5(1)(b)) Data collected for eSIM activation cannot be repurposed for, say, behavioral advertising without a fresh lawful basis. This is one of the most commonly violated GDPR principles in the telecoms sector.

4. Data subject rights Users in the EEA have the right to access, rectify, erase, port, and restrict their data. Your partner systems must be able to respond to these requests within 30 days. Simology's partner API includes endpoints to retrieve and delete user records — make sure your integration surfaces these capabilities.

5. Data Processing Agreements (DPAs) If you're acting as a data processor on behalf of Simology (or vice versa), a signed DPA is legally required under Article 28 GDPR. All Simology partners processing EU user data must have a current DPA in place. Contact your partnership manager to obtain the standard agreement.

6. International data transfers If you're based outside the EEA and process EU user data, you need a valid transfer mechanism. Post-Schrems II, the standard options are:

• Standard Contractual Clauses (SCCs) — updated 2021 versions, now mandatory.
• UK IDTA (International Data Transfer Agreement) for UK-to-third-country transfers post-Brexit.
• Adequacy decisions — the EU has granted adequacy to a limited list of countries including Japan, South Korea, Canada (commercial organizations), and (as of July 2023) the US under the EU-US Data Privacy Framework.

If you're operating in Europe or handling data from European travelers, your legal team should confirm which transfer mechanism applies to your specific setup.

What Changed in 2025–2026 That Partners Need to Know?

Several regulatory developments have shifted the compliance landscape since 2024:

• EDPB Guidelines 01/2025 on consent and legitimate interests clarified that fraud-prevention logs qualify as legitimate interests, but partners must document the balancing test in writing.
• EU AI Act (effective August 2026 for high-risk systems) — if your eKYC solution uses AI-based facial recognition or biometric matching, it may be classified as a high-risk AI system under Annex III, triggering conformity assessment requirements. Check with your eKYC vendor.
• UK Data (Use and Access) Act 2025 — enacted in mid-2025, this modernizes the UK's post-Brexit data framework. It introduces a new "recognized legitimate interest" category that simplifies fraud-prevention processing for telecoms operators — a meaningful change for UK-based partners.
• NIS2 Directive — became enforceable across EU member states from October 2024. Telecoms are in scope as "essential entities." Partners providing connectivity infrastructure may need to notify their national competent authority and implement incident reporting within 24 hours for significant breaches.

---

What Log Retention Periods Apply to eSIM Partner Data?

Log retention is where compliance gets granular — and where partners most often slip up. The tension is between regulatory requirements to retain records (for audit, fraud investigation, and lawful intercept) and GDPR's data-minimization principle (retain only as long as necessary).

The answer isn't a single number. Retention periods depend on the type of log, the jurisdiction, and the purpose.

Recommended Log Retention Schedule for eSIM Partners

Log Type	Minimum Retention	Maximum Recommended	Legal Basis
Transaction records (purchase, activation)	5 years	7 years	Tax/accounting law (most jurisdictions)
eKYC verification result (pass/fail + document type)	Duration of subscription + 12 months	Duration of subscription + 36 months	National telecoms law where required
Raw eKYC document images	Do not retain beyond verification	30 days maximum (if retained at all)	GDPR data minimization
API access logs (authentication, rate limits)	90 days	12 months	Legitimate interests (fraud/security)
Activation event logs (EID, ICCID, timestamp)	12 months	36 months	Legitimate interests / lawful intercept
User support tickets	Duration of relationship + 24 months	Duration of relationship + 36 months	Contract performance
Marketing consent records	Until consent withdrawn + 36 months	Until consent withdrawn + 36 months	Compliance with GDPR Art. 7(1)
Security incident logs	12 months	36 months	NIS2 / legitimate interests

Key principles to apply:

• Tier your data. Not all logs are equal. Raw document scans are far more sensitive than activation timestamps. Apply proportionate retention to each tier.
• Automate deletion. Manual deletion processes fail. Implement automated purge jobs with audit trails showing what was deleted and when.
• Separate retention by jurisdiction. A German subscriber's eKYC record may need to be retained longer than an Irish subscriber's activation log. Your data architecture should support jurisdiction-level retention rules.
• Document your rationale. GDPR's accountability principle (Article 5(2)) requires you to be able to demonstrate compliance. A written Retention Policy document, reviewed annually, is your first line of defense in a regulatory inquiry.

What About Lawful Intercept Obligations?

In many jurisdictions, telecoms operators — and by extension their resellers — must be able to provide subscriber data to law enforcement upon valid legal request. This is distinct from general retention: it's about having the data available when required, not retaining it indefinitely.

For Simology partners, lawful intercept obligations typically flow through the underlying network operator (MNO). However, if you maintain your own subscriber database (common for white-label partners), you may independently receive law enforcement requests. Ensure you have a documented process for handling these, including legal review before disclosure.

---

How Should Partners Handle a Data Breach?

A data breach affecting eSIM subscriber data is a serious event with strict regulatory timelines. Under GDPR Article 33, a personal data breach must be reported to the relevant supervisory authority within 72 hours of becoming aware of it — if it's likely to result in risk to individuals' rights and freedoms.

For partners, the practical steps are:

1. Contain — isolate affected systems immediately to prevent further exposure.
2. Assess — determine what data was affected, how many individuals, and the likely risk level.
3. Notify Simology — contact your partnership manager within 24 hours. This is a contractual obligation under your partner agreement, not just a best practice.
4. Notify the supervisory authority — if the breach is notifiable under GDPR, file within 72 hours. In the UK, notify the ICO. In Germany, notify the relevant Landesbeauftragter für Datenschutz.
5. Notify affected users — if the breach is likely to result in high risk to individuals (e.g., identity documents exposed), you must notify them directly "without undue delay" under GDPR Article 34.
6. Document everything — even if you decide the breach doesn't require notification, document your reasoning. Article 33(5) requires all breaches to be recorded internally.

The UK ICO's breach reporting portal and the EDPB's breach notification guidelines are authoritative resources worth bookmarking.

---

What Privacy-by-Design Practices Should Partners Implement?

Privacy by design — baked into GDPR Article 25 — means building data protection into your systems from the ground up, not bolting it on afterward. For eSIM partners, this translates into concrete technical and organizational measures.

If you're thinking about broader privacy practices for your users, our travel privacy checklist for iOS and Android is a useful companion resource for end users who want to protect their data while roaming.

Technical Measures

• Encryption at rest and in transit — all subscriber data should be AES-256 encrypted at rest; all API communications must use TLS 1.3 or higher.
• Pseudonymization — where possible, replace direct identifiers (name, email) with pseudonymous tokens in operational logs. Store the mapping separately with stricter access controls.
• Role-based access control (RBAC) — only staff who need subscriber data for their job function should have access. Log all access events.
• Data-at-rest key management — use a hardware security module (HSM) or a cloud KMS (AWS KMS, Google Cloud KMS, Azure Key Vault) for encryption key management. Never store keys alongside the data they protect.
• Regular penetration testing — at minimum annually, and after any significant system change.

Organizational Measures

• Appoint a Data Protection Officer (DPO) — mandatory under GDPR if you process data at large scale or process special categories. Even if not legally required, a DPO or equivalent privacy lead is strongly recommended for eSIM partners with significant EU user bases.
• Staff training — all staff with access to subscriber data should complete annual GDPR and security awareness training.
• Vendor due diligence — any third-party service you use to process subscriber data (eKYC provider, analytics platform, customer support tool) must have a signed DPA and meet your security standards.
• Privacy Impact Assessments (PIAs/DPIAs) — required under GDPR Article 35 for high-risk processing (e.g., large-scale biometric eKYC). Conduct a DPIA before deploying any new eKYC system.

---

How Do Compliance Requirements Differ by Region?

Regional variation is the single biggest compliance complexity for global eSIM partners. What's required in Germany is different from what's required in the United States, which is different again from what's required in India or the UAE.

The table below summarizes the key variables across major markets:

Region / Country	eKYC Required?	Primary Data Law	Log Retention (Telecoms)	Key Regulator
EU (varies by state)	Varies by member state	GDPR	Varies; typically 6 months–2 years	National DPAs + EDPB
Germany	Yes (TKG)	GDPR + BDSG	6 months (traffic data)	BNetzA + BfDI
France	Yes	GDPR + national telecoms law	1 year	ARCEP + CNIL
Netherlands	No	GDPR	6 months	ACM + AP
United Kingdom	No (prepaid)	UK GDPR + DUA Act 2025	12 months	Ofcom + ICO
United States	No (federal)	State laws (CCPA, etc.)	Varies by state	FTC + state AGs
Australia	Yes	Privacy Act 1988 + Telecom Determination 2023	2 years	ACMA + OAIC
India	Yes (DoT mandate)	DPDP Act 2023	As directed by DoT	TRAI + DoT
UAE	Yes	Federal Data Protection Law (2021)	6 months minimum	TRA
Japan	Yes	Act on Protection of Personal Information	3 months–1 year	MIC + PPC
South Korea	Yes	PIPA 2023	6 months	KCC + PIPC

For partners serving travelers across multiple regions — say, a platform that sells eSIM plans for Asia alongside European coverage — a single global compliance framework won't work. You need a jurisdiction-aware architecture that applies the right rules for each user's activation country.

---

What Are the Compliance Obligations Specific to Simology Partners?

Beyond the general regulatory landscape, Simology's Partner Agreement includes specific compliance obligations. These are designed to protect end users, maintain network integrity, and ensure Simology meets its own obligations to underlying carriers and regulators.

Partner Compliance Checklist (2026)

Identity & eKYC:

• eKYC flow is triggered for all jurisdictions where subscriber registration is legally required
• eKYC results are passed to Simology via the API kyc_verified field with jurisdiction code
• Raw document images are not retained beyond 30 days (or shorter if local law permits)
• eKYC vendor has a signed DPA and ISO 27001 certification (or equivalent)

Data Protection:

• Signed DPA with Simology is current (review annually)
• Standard Contractual Clauses (SCCs) or equivalent in place for any non-EEA data transfers
• Privacy Policy is publicly accessible, up to date, and accurately describes eSIM data processing
• Data subject rights request process is documented and tested (30-day response SLA)
• DPIA completed for any high-risk processing (biometric eKYC, large-scale profiling)

Log Retention:

• Written Retention Policy document exists, reviewed in last 12 months
• Automated deletion/purge processes are in place and tested
• Retention periods are jurisdiction-aware (not a single global period)
• Security incident logs retained for minimum 12 months

Security:

• All subscriber data encrypted at rest (AES-256) and in transit (TLS 1.3+)
• Annual penetration test completed; findings remediated
• RBAC implemented; access logs maintained
• Breach notification process documented; Simology notified within 24 hours of any breach

Regulatory:

• NIS2 registration completed if applicable (EU partners providing essential services)
• Lawful intercept request handling process documented
• Staff privacy training completed in last 12 months

Partners who need help with any of these items should contact their Simology partnership manager. We also recommend reviewing how your compliance posture integrates with your broader customer experience — for example, if you offer family travel eSIM plans, there are additional considerations around processing data for minors (GDPR Article 8 and equivalent national provisions).

---

FAQ

Does GDPR apply to my eSIM partner business if I'm based outside the EU?

Yes — GDPR applies based on where your users are, not where your business is registered. If you sell eSIMs to residents of EU member states, GDPR applies to that processing regardless of whether your company is based in the US, Australia, or anywhere else. You'll need a lawful basis for processing, a signed DPA with Simology, and appropriate international data transfer mechanisms such as Standard Contractual Clauses.

Is there an EU-wide law requiring ID verification to buy a prepaid eSIM?

No. There is no EU-wide regulation mandating identity verification for prepaid SIMs or eSIMs. Requirements are set at the national level and vary significantly across EU member states — Germany and France require it under national telecoms law, while countries like the Netherlands, Ireland, and the Czech Republic do not. Always check the specific national law for each country where your customers activate.

How long should I retain eKYC verification records?

Retain the verification result (pass/fail, document type, timestamp) for the duration of the subscription plus 12 to 36 months, depending on the jurisdiction's national telecoms law. Raw document images — passport scans, selfies — should not be retained beyond 30 days after verification, and ideally should be deleted immediately once the check is complete. Never retain raw biometric data longer than legally required.

What happens if I receive a law enforcement request for subscriber data?

Do not disclose any subscriber data without a valid legal order (court order, warrant, or equivalent) reviewed by qualified legal counsel. Document the request and your response. If you operate a white-label platform with your own subscriber database, you may receive these requests independently of Simology — ensure you have a documented lawful intercept process in place. Notify your Simology partnership manager of any such requests as required by your Partner Agreement.

How quickly do I need to report a data breach to Simology?

You must notify Simology within 24 hours of becoming aware of any personal data breach affecting subscriber data — this is a contractual obligation under the Partner Agreement, separate from your regulatory obligations. Under GDPR, you then have 72 hours from awareness to notify the relevant supervisory authority if the breach is likely to risk individuals' rights and freedoms. These timelines run concurrently, so act fast.

Does the EU AI Act affect my eKYC system?

Possibly. If your eKYC solution uses AI-based biometric matching or facial recognition to verify identity, it may be classified as a high-risk AI system under Annex III of the EU AI Act, which became enforceable for high-risk systems in August 2026. This triggers conformity assessment requirements, technical documentation obligations, and registration in the EU AI database. Consult your eKYC vendor and legal counsel to determine whether your specific implementation is in scope.

What is a Data Processing Agreement (DPA) and do I need one with Simology?

A Data Processing Agreement is a legally required contract under GDPR Article 28 between a data controller and a data processor. If Simology processes personal data on your behalf (or you process it on Simology's behalf), a DPA is mandatory — not optional. It specifies the subject matter, duration, nature, and purpose of processing, as well as each party's obligations and rights. All Simology partners handling EU user data must have a current, signed DPA. Contact your partnership manager to obtain the standard template.

Are there special rules for processing data about children using eSIMs?

Yes. GDPR Article 8 sets the age of digital consent at 16 (though member states can lower this to 13). If you offer eSIM plans for minors — for example, as part of a family travel product — you must obtain verifiable parental consent for any data processing beyond what's strictly necessary to fulfill the service. Additional safeguards apply, including prohibition on profiling and stricter data-minimization requirements. Review our guidance on managing kids' phones and data on trips for practical context.

---

Staying Ahead of the Compliance Curve

Regulatory requirements for eSIM partners are not static. The EU AI Act, the UK's Data (Use and Access) Act 2025, India's Digital Personal Data Protection Act 2023, and ongoing GSMA work on eSIM security standards all signal that the compliance bar will continue to rise through 2026 and beyond.

The partners who navigate this well share a few characteristics: they treat compliance as an engineering problem (automate deletion, encrypt by default, build jurisdiction awareness into their data model), they maintain living documentation rather than one-time audits, and they communicate proactively with Simology when questions arise.

Your compliance posture is also a competitive differentiator. Travelers and enterprise buyers increasingly ask about data practices before choosing a connectivity provider. A transparent, well-documented approach to eKYC, GDPR, and log retention isn't just a legal obligation — it's a trust signal that converts.

If you have specific questions about how these requirements apply to your partner integration, reach out to your Simology partnership manager or email compliance@simology.io. We're here to help you get this right.