Unused Data and SIM Validity for IoT Devices

Cameras, trackers, and sensors can lose connectivity when a SIM card or package expires. Unused-data protection can help package costs, but your team still has to manage the cards. Start with numbers, device locations, packages, deadlines, and responsible staff. Ask the operator what leftover-data protection is actually available for each package.

Komdigi confirms Circular Letter 4/2026 was issued on 28 August 2026 following the court ruling of 23 July. The 28 September date was an initial operator-reporting deadline, rather than proof that every package automatically provided identical protection.

This piece is for anyone who has a box on a pole, in a panel or on a truck that talks to the internet through a consumer SIM card. That covers more small deployments than most people admit.

What exactly changed?

The chain of events is short.

According to Komdigi’s official explanation, the circular does two things. It forbids operators from deleting leftover data when a package ends, and from charging extra to keep or use it. It also requires them to offer a set of choices: rollover (carrying unused data into the next period), no rollover, a longer validity period, transferring the benefit, compensation, a refund, or another mechanism that doesn't hurt the customer.

According to Kompas's summary of the circular, operators must also state price, data volume, validity and leftover-data treatment in plain language, and give customers a channel to check remaining data in real time. That last point matters more for device owners than for phone users, as we'll see.

Why does this matter for devices, not just phones?

Phones burn through data. Most field devices barely touch it.

A meter reader or sensor that sends a 200-byte reading every minute uses about 8.6 MB of payload a month (200 bytes × 1,440 minutes × 30 days). Add connection and encryption overhead and you are still in the tens of megabytes. The smallest consumer package on the shelf is usually a few gigabytes. Under the old regime, almost all of it expired every month, unused.

Cameras sit at the other end. A 4G camera streaming a 512 kbps sub-stream (the low-resolution copy of the video) around the clock moves roughly 166 GB a month (512,000 bits × 86,400 seconds × 30 days ÷ 8). Leftover data is not its problem; running out is.

So the new rule mostly changes the economics of low-traffic devices: trackers, meters, alarm panels, gateways that only send status. Those are the ones where businesses were quietly paying for gigabytes to deliver megabytes.

The more common failure, though, was never the data. It was the card itself.

A device that goes silent because its number lapsed needs someone to drive out, swap the SIM and often re-register it. That trip costs more than a year of data.

What does the rule not fix?

Four gaps are worth knowing before anyone relaxes.

Validity periods still exist. The telecom industry association ATSI said the ruling does not abolish package expiry dates; it only requires products that protect leftover data. A card whose validity runs out still heads toward deactivation.

Protection must be chosen and documented. Check how the offered package protects the value of leftover data. A notification alone or a “no rollover” label does not establish compliance with the circular.

Existing rollover has conditions. The rollover features operators already offered typically require buying the next package before the current one ends, and at Indosat the new package must cost the same or more. Only main data carries over; bonus data usually does not. Missing the renewal date can prevent carry-over under the old package terms; check the current terms for your package.

Prices may move. ATSI also flagged that guaranteeing data across periods could lead to tariff adjustments, with details waiting on technical rules. Budget lines built on today's package prices deserve a second look in three months.

Postpaid, corporate and machine-to-machine (M2M) contracts, meaning SIM plans sold specifically for devices, are not resolved by the coverage cited here. Those plans run on their own contract terms. Read yours rather than assuming the consumer rule applies.

What should device owners do this month?

The rule rewards the same habit that prevented outages before it existed: knowing exactly which SIM sits in which device.

1. Build a SIM inventory. One row per card: device ID, site, phone number, ICCID (the serial printed on the SIM itself), operator, package, period end date, and the name the card is registered under. That last field matters. A card registered to a technician's national ID leaves with the technician.

2. Pick the protection option on purpose. Once operators publish their new options, choose per device class. Low-traffic devices want rollover or a longer validity period. Cameras want a bigger package, not rollover.

3. Automate renewal before the period ends. Rollover only works if the next package lands before the current one expires. Put every end date into a scheduler and alert three days ahead, not on the day.

4. Measure usage from the device side. Have each device report bytes sent, signal strength and last-seen time with its normal telemetry. The operator's new usage channel is useful, but a dashboard you control catches a silent device within minutes. Our guide to monitoring small systems covers the alert rules that keep this quiet until it matters.

5. Right-size the package from real numbers. After a month of device-side data, you know what each device actually needs. Many fleets can drop to the smallest package once leftover data stops disappearing.

6. Price out a device plan above a few dozen cards. Operators offer IoT and M2M plans that may include central management, pooled data, and different validity terms. Confirm these features in the contract. Below a handful of devices, prepaid plus good tracking is fine. Beyond a few dozen, one managed contract usually costs less than the site visits.

When a device does go quiet, check the SIM and power before touching the software. In low-cost deployments like the ESP32-CAM meter readers we have written about, those are useful early checks for a "the system is down" call.

Is prepaid still a reasonable choice for devices?

For pilots and small sites, yes. Prepaid cards are cheap, available at any counter and need no contract. The new rule makes them slightly better value for low-traffic devices.

What it does not do is make them self-managing. A prepaid SIM in a device is a subscription with a deadline, and the deadline still arrives whether or not anyone is watching. The businesses best placed to assess the reported protection options are the ones that already track their cards. For everyone else, this month is a good time to start.