Guest WiFi Logs in India: What CERT-In and PM-WANI Actually Require
Every guest WiFi vendor in India says its logs are "compliant". Few of them link to the rule. Here is what the CERT-In directions and the PM-WANI guidelines actually say, in their own words, and what a venue can reasonably do about it.
If you run guest WiFi at a hotel, cafe, clinic or co-working space in India, two official documents are the ones people mean when they say “WiFi logs are mandatory”. The first is the cyber security directions issued by CERT-In (the Indian Computer Emergency Response Team) in April 2022. The second is the PM-WANI (Prime Minister’s Wi-Fi Access Network Interface) framework from the DoT (Department of Telecommunications). Most articles on this subject quote neither. This one quotes both, says plainly where they are unclear, and explains what a useful guest WiFi log should contain.
This is not legal advice. It is a plain reading of public documents, written so you can have a better conversation with your own advisor.
The short answer: CERT-In’s April 2022 directions require every “body corporate”, which includes a sole proprietorship or firm doing business, to keep logs of all its ICT (information and communication technology) systems for a rolling 180 days. They do not mention guest WiFi by name, but a guest network a business runs is hard to argue is not one of its ICT systems. Separately, if you offer WiFi under PM-WANI, the aggregator you sign up with must store user data for one year, in India. A useful guest WiFi log ties each session to a verified person, a device and a time.
What CERT-In’s 2022 directions say
On 28 April 2022, CERT-In issued directions under section 70B(6) of the Information Technology Act, 2000. The document says they take effect 60 days after issue. Four of the six numbered directions apply to “all service providers, intermediaries, data centres, body corporate and Government organisations”. The one about logs reads, in full:
“All service providers, intermediaries, data centres, body corporate and Government organisations shall mandatorily enable logs of all their ICT systems and maintain them securely for a rolling period of 180 days and the same shall be maintained within the Indian jurisdiction. These should be provided to CERT-In along with reporting of any incident or when ordered / directed by CERT-In.”
Two other directions in the same document matter for a WiFi network:
- Clock synchronisation (paragraph i). ICT systems must sync their clocks to the NTP (Network Time Protocol) servers of the National Informatics Centre or the National Physical Laboratory, or to servers traceable to them. A log with the wrong time on it is close to useless, because every request to trace a session starts with a timestamp.
- Incident reporting (paragraph ii). Listed cyber incidents must be reported to CERT-In within 6 hours of noticing them.
Does “body corporate” include my cafe?
Probably, if it is a business. CERT-In’s own FAQ on the directions answers this directly, using the definition from section 43A of the IT Act:
“‘body corporate’ means any company and includes a firm, sole proprietorship or other association of individuals engaged in commercial or professional activities”
The same FAQ says “Individual citizens are not covered by these Directions”. So a family sharing its home WiFi with visitors is outside them. A proprietorship cafe sharing its WiFi with customers is a business, and the definition reaches it.
Does it cover the guest WiFi specifically?
This is where the honest answer is “the text does not say”. The directions cover “all their ICT systems” and never mention WiFi, hotspots or guests. CERT-In’s FAQ lists example logs, such as firewall, proxy server, application, VPN and event logs, and says the right set “depend[s] on the sector that the organisation is in” and that the list “is not exhaustive”. It also says that “both successful as well as unsuccessful events shall be recorded” (FAQ Q37).
A guest network a business owns, runs and gives to the public is, on any ordinary reading, one of its ICT systems. The conservative course, and the one most vendors and advisors take, is to keep guest WiFi session and login records for at least 180 days, with correct timestamps. If you need certainty for your own business, that is the question to put to your lawyer.
Do the logs have to stay in India?
The direction says the logs “shall be maintained within the Indian jurisdiction”. CERT-In’s FAQ softens this: “The logs may be stored outside India also as long as the obligation to produce logs to CERT-In is adhered to by the entities in a reasonable time” (FAQ Q35). If you want the simplest answer, keep them in India.
What PM-WANI says about user data
PM-WANI is a separate, voluntary framework for selling public WiFi without a telecom licence. If you join it, you become a PDO (Public Data Office) and connect your access points to a PDOA (Public Data Office Aggregator) that handles sign-in and accounting. The DoT’s framework puts the data obligation on the aggregator, not the shop:
“PDOA shall make necessary provisions for storage of user data for one year to ensure compliance with legal provisions, as required.”
“Complete user data and usage logs will be stored within India.”
So the “one year” figure you will see in vendor copy comes from PM-WANI, and it applies to PM-WANI aggregators. It is not a general rule for every venue’s private guest WiFi. PM-WANI explained for hotels, cafes and shops covers how the scheme works and whether it suits your venue.
What about the IT Act’s “intermediary” rules?
The IT Act defines an intermediary as anyone who, on behalf of another person, “receives, stores or transmits” an electronic record or “provides any service with respect to that record”, and lists “network service providers, internet service providers” and “cyber cafes” as examples (section 2(1)(w)). Some advisors argue that a business giving the public internet access fits this definition, which brings due-diligence duties with it. Whether a hotel or cafe’s guest WiFi does is a legal question we will not settle here. It is one more reason the people giving out the internet connection should be able to say who used it, and when.
What a useful guest WiFi log actually contains
Whatever the exact legal duty, the practical test is simple. If someone asks “who was using your WiFi at 9:42 pm on 3 March?”, can you answer? That needs these fields:
| Field | Why it matters |
|---|---|
| Verified identity (a phone number confirmed by OTP, or a voucher you issued) | Ties the session to a person, not just a device. A shared password gives you nothing here. |
| Device hardware (MAC) address | Distinguishes a guest’s phone from their laptop. Note that phones now use a private address per network, so this identifies a device on your network, not the device’s factory address. |
| Private IP address on your WiFi | What your router logs show for that device. |
| Your venue’s public IP address | What the outside world, and any request for information, will quote. |
| Session start and end time, from a synced clock | Every trace starts with a timestamp. |
| Data used | Separates a two-minute check-in from a six-hour download. |
| Login attempts, including failed ones | CERT-In’s FAQ asks for successful and unsuccessful events. |
What a session log does not tell you
A session log says who was online, from which device, and when. It does not say which websites they visited. That second kind of record, often called an IPDR (Internet Protocol Detail Record) or a NAT (network address translation) log, records each outgoing connection with its destination and port. It matters because everyone on your guest WiFi shares one public IP address, so a request that quotes only your public IP and a time can match several guests at once. Port-level NAT logs are what narrow that to one device, and they have to be captured on the router itself.
Be wary of any vendor that implies a login page alone gives you a complete, destination-level record. It does not.
What Wyfy Guest records, and what it doesn’t
We would rather be precise than impressive here.
- What it records. Every guest who signs in through Wyfy Guest is tied to a verified phone number or email (by OTP) or to a voucher you issued. The dashboard’s Guest Connection Records page shows each guest’s connection history: who connected, from which device, for how long, and how much data they used, along with their private IP on your WiFi, and your venue’s public IP where your router reports a real public address. Login attempts are recorded too, including failed ones.
- What it does not record. Destination-level traffic. Wyfy Guest does not log which websites a guest visited, and it is not an IPDR or NAT logging system.
- Retention. We do not publish a guaranteed retention period on this page. If your advisor tells you to keep 180 days, ask us to confirm in writing what applies to your account, and download your guest activity reports regularly as your own copy. Guest WiFi usage reports shows what you can export.
- Who can see it. Guest phone numbers can be hidden from staff by default, so collecting a number for the log does not mean every staff login can read it. See guest data masking.
A practical checklist for a venue owner
- Replace any shared password-only network with a login step that ties each session to a person. OTP or a voucher you issue both do this. Is your guest WiFi login legal in India? explains why this is the first fix.
- Check your router’s clock. Make sure it syncs to a reliable NTP source, so every timestamp in your logs is right.
- Decide your retention period with your advisor, write it down, and keep exported copies on that schedule.
- Ask your vendor, in writing, what it records, what it does not, where it stores it, and for how long.
- If you need destination-level logs, talk to whoever manages your router about NAT logging. A login page cannot produce them.
- Collect only what you need. India’s Digital Personal Data Protection Act, 2023 applies to the phone numbers and emails you collect at login, so log what identification needs and protect it.
Common questions about guest WiFi logs in India
Is it mandatory to keep WiFi logs in India?
CERT-In’s April 2022 directions require service providers, intermediaries, data centres, body corporates and government organisations to keep logs of all their ICT systems for a rolling 180 days, within Indian jurisdiction. “Body corporate” includes a firm or sole proprietorship engaged in business. The directions do not name guest WiFi, so the conservative reading is that a business’s guest network is covered. Confirm with your advisor for your own case.
How long should a hotel keep guest WiFi logs?
At least 180 days is the figure that follows from the CERT-In directions. One year is the figure in the PM-WANI framework, and it applies to PM-WANI aggregators storing user data. Some advisors recommend longer. Decide with your advisor and keep to it.
Does the 180-day rule apply to a small cafe?
The directions apply to “body corporate”, which CERT-In’s FAQ defines to include sole proprietorships and firms engaged in commercial activities, and they exclude individual citizens. A cafe run as a business is therefore within the definition. How strictly a small cafe’s guest network is held to it has not been publicly tested.
Does an OTP login make my WiFi compliant?
No single feature makes a network “compliant”. An OTP login gives you the most important piece, a session tied to a verified phone number, which a shared password cannot. You still need correct timestamps, a retention period you actually keep to, and, if required, destination-level router logs.
Does Wyfy Guest keep a record of websites guests visit?
No. Wyfy Guest records sessions and logins: who connected, from which device, when, for how long and how much data they used. It does not record destinations. If you need destination-level logs, they have to come from NAT logging on your router.
Can logs be stored outside India?
The direction says logs shall be maintained within the Indian jurisdiction. CERT-In’s FAQ says they may be stored outside India as long as they can be produced to CERT-In in a reasonable time. PM-WANI separately requires PDOA user data and usage logs to be stored within India.
Sources
- CERT-In, Directions under sub-section (6) of section 70B of the Information Technology Act, 2000, No. 20(3)/2022-CERT-In, 28 April 2022
- CERT-In, FAQs on Cyber Security Directions of 28.04.2022, May 2022
- Department of Telecommunications, Wi-Fi Access Network Interface (WANI) Framework and Guidelines for Registration
If you want to see exactly what a session record looks like before you decide anything, book a demo and we will show you the Guest Connection Records page on a live account.
