Automotive, EV and Connected Mobility: A DPDP Act Impact Study

Executive summary

A connected car reports its location, speed and battery state to its maker's cloud; its infotainment system copies the owner's contacts; a cabin camera may watch for drowsiness; its FASTag logs every toll plaza. Dealers, financiers, insurers, charging networks and rental operators each hold part of the picture.

The Digital Personal Data Protection Act, 2023 (the DPDP Act) and the DPDP Rules, 2025 apply to all of them from 13 May 2027. A data fiduciary decides why and how personal data is processed; a data principal is the person the data is about; a data processor acts on a fiduciary's instructions.

Headline rating: Overall impact High. Six of the twelve areas in the Trayambic scorecard below are rated High for a typical vehicle maker (OEM), dealer group, connected-services provider, charging operator, rental business or telematics insurer.

The three biggest changes:

• Connected features need consent, feature by feature. Location history, driving scores, voice recordings and sharing with insurers are not needed to sell or service a vehicle, and consent to them must be withdrawable without disabling the car.
• Vehicles change hands; data must not. A resold car can carry the seller's contacts, home address and a still-linked app, so unlinking and wiping become part of every transfer.
• The value chain becomes a fiduciary map. Makers, dealers, telematics providers, insurers and charging operators each decide some purposes, and no contract shifts a fiduciary's responsibility for its processors.

Background

The businesses in scope:

• OEMs run connected platforms, apps, customer systems and warranty and recall programmes.
• Dealers sell, register, finance, insure, service and increasingly resell vehicles.
• Connected-car and telematics providers supply devices, connectivity and cloud platforms to OEMs, fleets or owners.
• EV charging operators run chargers, apps and payments, and exchange session data with roaming partners.
• Rental operators hire out cars and two-wheelers, including to delivery riders, and track them.
• Insurers and insurtechs price motor cover on driving data.

The data principals are owners, family drivers and chauffeurs, passengers (including children), pedestrians on exterior cameras, test-drive leads, used-vehicle sellers and buyers, renters, charging customers, policyholders and workshop staff.

The data includes KYC and registration details, the vehicle identification number (VIN) linked to an owner, finance and insurance records, service history, trips and live location, driving behaviour, charging sessions, voice commands, synced phone contacts, video and toll transactions. It flows from vehicle to OEM cloud over an embedded SIM, from OEM to dealers, from dealers to lenders and insurers, between charging networks, and through government systems such as Vahan, Sarathi and FASTag.

Legal framework

The DPDP provisions that matter most

• Who is a fiduciary (s.2(i)). Anyone who "alone or in conjunction with other persons" decides the purpose and means of processing, so several businesses can be fiduciaries for the same vehicle data.
• Grounds (ss.4, 6, 7). Section 7(a) covers data voluntarily given for a specified purpose, such as a purchase or service booking; s.7(i) covers employees. Other uses need consent that is "free, specific, informed, unconditional and unambiguous", limited to necessary data (s.6(1)) and backed by an itemised notice (Rule 3). There is no legitimate-interests ground.
• Children (s.9; Rule 10). Verifiable parental consent for anyone under 18; no tracking or behavioural monitoring of children.
• Fiduciary duties (s.8; Rules 6–7). Responsibility for processors "irrespective of any agreement to the contrary"; accuracy where data drives a decision (s.8(3)); security safeguards with a year of logs; breach notice to each affected person and the Data Protection Board, with a detailed report within 72 hours; erasure once the purpose is served unless law requires retention (s.8(7)).
• Rights and SDFs (ss.10–14; Rules 13–14). Access, including who else received the data; correction and erasure; grievances answered within 90 days. A designated Significant Data Fiduciary (SDF) needs an India-based Data Protection Officer, independent data audits and annual impact assessments.

Penalties reach ₹250 crore for security failures and ₹200 crore for breach-notice and children's data failures.

Sector instruments

• Central Motor Vehicles Rules, 1989. Rule 125H (G.S.R. 1095(E), 28 November 2016) requires tracking devices and emergency buttons on public service vehicles but exempts two- and three-wheelers, e-rickshaws and vehicles needing no permit. Under G.S.R. 901(E) of 22 December 2022, a dealer in registered (used) vehicles is treated as transferee while a vehicle is in its custody and keeps an electronic and physical stock register and a movement log for each vehicle.
• Automotive Industry Standards. AIS-140 covers tracking devices; AIS-184 (drowsiness warning) requires systems to work without biometric information in a closed, overwriting loop. AIS-189 (cyber security and cyber security management system) and AIS-190 (software update and software update management system), whose titles mirror UN Regulations 155 and 156, are listed by MoRTH as drafts dated 6 November 2023.
• MoRTH Policy for Data Sharing from the National Transport Repository (August 2025) covers Vahan, Sarathi, e-Challan, accident and FASTag data and names vehicle and component manufacturers, insurers, banks and aggregators among recipients. Personal data is masked unless the person consents through an Aadhaar-authenticated OTP; recipients need a CERT-In empanelled audit, India storage, a year of access logs and purpose limits, and are treated as data fiduciaries. In September 2026 the Internet Freedom Foundation reported an app still selling owner details drawn from registration records.
• FASTag. NPCI's circular NPCI/2024-25/NETC/001 (20 June 2024) requires tag issuers to collect the registration certificate, vehicle photographs and a KYC-linked mobile number, verify against Vahan and repeat know-your-vehicle checks every three years. NHAI dropped that process for new car FASTags from 1 February 2026, relying on Vahan validation before activation. Toll rules amended on 9 September 2024 (S.O. 3856(E)) allow tolling through GNSS on-board units and number-plate recognition, without addressing the location data produced.
• EV charging. The Ministry of Power's EV charging infrastructure guidelines of 17 September 2024 encourage open protocols (OCPP, OCPI and UEI). The Ministry's account of them to Parliament covers connections, tariffs and interoperability, not customer data.
• Insurance. Insurers' records fall under the IRDAI (Maintenance of Information by the Regulated Entities and Sharing of Information by the Authority) Regulations, 2025: a ten-year minimum and data centres in India.
• CERT-In Directions of 28 April 2022: incidents reported within six hours; logs kept in India for 180 days.

How sections 38 and 16(2) fit them together

Section 38 makes the DPDP Act additional to sector law and gives it priority only in a conflict. Motor vehicle rules mostly govern the vehicle, not the data, so the Act sets the data standard, with the transport repository policy adding conditions such as India storage. Section 16(2) preserves stricter transfer rules such as IRDAI's India data-centre requirement; OEM clouds face no general localisation rule, and no country has been restricted under s.16(1).

The dates

Consent manager provisions commence on 13 November 2026; the main duties, rights and penalties on 13 May 2027. No compression of the timeline has been notified, and no Board members have been appointed, as of October 2026.

Analysis

The Trayambic DPDP Impact Scorecard

Overall impact: High

Maker, dealer, telematics provider or insurer: who is the fiduciary?

The Act lets several businesses be fiduciaries for the same data, and in this sector that is normal:

• The OEM is a fiduciary for its connected platform, app, customer database and warranty and recall records.
• The dealer is usually a separate fiduciary, not the OEM's processor. It decides its own purposes: selling, arranging finance and insurance, servicing and marketing its own offers. When it captures leads for an OEM campaign on the OEM's instructions, it acts as the OEM's processor for that campaign.
• A telematics provider running the OEM's platform is a processor; one selling its own device and app to owners or fleets is a fiduciary.
• An insurer pricing on driving data is a fiduciary; data it receives from an OEM or app is a disclosure that needs the owner's consent.

Three consequences follow. Dealer agreements need data clauses in both directions: what the OEM may pull from dealer systems, what the dealer may do with OEM leads, security, breach notice and deletion. Access requests under s.11 must name the others who received the data, so an OEM must know which dealer, lender and insurer saw a customer's file. And a dealer breach is the dealer's to report for its own data, but the OEM's credentials are exposed too, so joint runbooks matter.

Connected features, cameras and consent

Sort connected data into three tiers:

• Needed for safe and lawful operation: emergency functions, security updates, legally required tracking, warranty diagnostics. These can rest on s.7(a) as part of the purchase, with clear notice.
• Features the owner chooses: trip history, geofencing, remote unlock, voice assistant, family sharing. Each needs consent and its own switch.
• Disclosures to other fiduciaries: driving scores passed to an insurer or lender, movement data supplied to third parties, cabin audio used for model training. Each needs its own consent unless the data is genuinely non-identifying, and each recipient must appear in the answer to an access request under s.11.

Consent must be "unconditional", so turning off location history should not disable infotainment or affect the warranty.

Drivers and passengers who never accepted the terms are data principals too. Driver profiles, a guest mode that pauses history and an indicator when recording is on give them notice and a choice.

Cameras. Driver monitoring that stores facial images goes well beyond AIS-184, which works without biometric information in a closed, overwriting loop. Make that design the default and treat face recognition as a separate, consented feature. Cabin cameras also see children, and s.9(3) bars their tracking or behavioural monitoring, so occupant detection should stay on the device and be transient. Exterior cameras record pedestrians and number plates; keep uploaded clips for incidents only.

Usage-based insurance. A driving score that changes a premium is a decision about a person, so s.8(3) requires accurate, complete and consistent data. Show policyholders which events count and their trips, and correct errors such as a passenger's journeys scored as theirs. Trayambic's insurance impact study covers insurers' wider duties.

Sale, transfer and the previous owner's data

Every resale is a data event. A used car may carry the seller's paired contacts and messages, saved home and work locations, garage-door codes and an app account still linked to the VIN, which lets the seller locate or unlock the car. The buyer's trips then flow into the seller's app.

• The OEM holds the account link. Once the vehicle is sold, the purpose of linking the seller's account to it has ended, so s.8(7) requires erasure; sending the buyer's location to the seller is a security failure under s.8(5) and processing without a ground. Build a transfer workflow: unlink on the seller's request or proof of transfer, prompt the buyer to open her own account and purge vehicle-side history.
• Used-vehicle dealers under G.S.R. 901(E) already hold the vehicle as deemed transferee and keep a stock register. Add a wipe and app unlink to the intake checklist.
• Rental and leasing operators should reset devices between hirers.

The seller can also ask the OEM to erase her data under s.12. Records needed for warranty, recalls or tax may be kept under s.8(7) for as long as the law requires, and no longer.

Charging sessions, toll trails and rentals

Movement data accumulates even without a connected car:

• Charging. Each session log puts a person at a charger at a given time, and a month of them sketches a routine. Roaming over OCPI passes session data between the charging operator and the driver's app; each decides its own purposes and is better treated as a separate fiduciary, with a roaming agreement on security and deletion. Keep session detail for billing and disputes; plan networks on aggregates.
• Tolls. FASTag issuers hold registration copies, vehicle photographs and mobile numbers, and the toll trail records where a vehicle went. The toll rules are silent on how long GNSS positions may be kept, so the DPDP default applies: keep what billing and disputes need, then erase.
• Rentals. Rule 125H exempts two-wheelers, so tracking a rental scooter is the operator's choice. Tracking for theft and billing during the hire can rest on s.7(a); anything more needs consent. Unmasked licence checks through the transport repository need the renter's OTP consent. Trayambic's blog on driver and rider location data covers retention of trip traces.

Worked example (illustrative): an electric scooter maker with its own app

An Indian electric two-wheeler maker sells connected scooters through 300 franchised dealers. Its app shows rides, battery status and geofence alerts; a partner insurer offers a usage-based add-on; a leasing arm rents scooters to delivery riders.

• Fiduciary map. The maker is a fiduciary for the app and platform; dealers for their sales and service records, and processors for the maker's campaigns; the insurer and leasing arm for their own customers.
• Consent. Ride history and geofencing become opt-in; theft tracking stays on with notice. Sharing ride scores with the insurer needs a separate consent when the customer chooses the add-on.
• Leasing. Tracking during the lease rests on the lease and its notice; the delivery platforms the riders work for get the trail only with the rider's consent.
• Resale. The app unlinks the seller when a dealer logs a trade-in or the buyer proves transfer.
• A breach. A researcher shows that changing a scooter ID in an API call returns another owner's live location. The maker reports to CERT-In within six hours, notifies owners and the Board without delay, files the 72-hour report and fixes object-level authorisation.
• Retention. Invoices and warranty records for their legal periods; ride history for 12 months unless the owner chooses longer (an internal choice); leasing traces briefly after the lease ends.

Compliance framework

Roadmap to 13 May 2027

• Now to December 2026: fiduciary and data map; vendor inventory; API review; gap assessment against AIS-189 and AIS-190.
• January to March 2027: consent redesign; dealer and partner contracts; camera and retention settings.
• April to May 2027: transfer workflow live; rights channel live; breach drill with a dealer and a telematics vendor.
• Ongoing: track the cyber security and driver-assistance rules, SDF notifications and IRDAI telematics guidance.

Recommendations

1. 1.Draw the fiduciary map first, then write it into dealer and partner contracts.
2. 2.Make every connected feature beyond safety and security a switch the owner controls.
3. 3.Treat ownership transfer as a data event, with unlinking and wiping built into apps and dealer checklists.
4. 4.Use AIS-184's privacy design for cameras and keep cabin processing on the device.
5. 5.Start building to AIS-189 and AIS-190 now; the draft timelines are short.
6. 6.Keep trip, charging and toll data only as long as billing, disputes and safety require.
7. 7.Give drivers who are not account holders notice and a choice: profiles, guest mode, in-car indicators.

Key takeaways

• Dealers are usually separate data fiduciaries, not the OEM's processors; contracts must allocate duties both ways.
• Connected features beyond safety, security and warranty need per-feature consent that can be withdrawn without disabling the vehicle.
• Resale is a data event: the OEM must unlink the seller's app and the vehicle must be wiped, under the erasure and security duties.
• Cabin and driver cameras should follow AIS-184's privacy design: no biometrics, closed loop, on the device.
• MoRTH's 2025 data-sharing policy conditions access to registration and licence data on Aadhaar-OTP consent, audits and India storage.