Gig and Platform Companies: A DPDP Act Impact Study

Executive summary

Overall impact: High.

This study covers the businesses the Code on Social Security, 2020 calls aggregators: food and grocery delivery apps, ride-hailing platforms, home-services marketplaces and online freelance marketplaces. Each connects a customer with a worker who is not its employee, and each runs on data about both.

Under the Digital Personal Data Protection Act, 2023 (the DPDP Act), the platform is the data fiduciary, the business that decides why and how personal data is used. The people the data is about are data principals. The sector's distinctive feature is a third participant: Central and State welfare bodies now receive worker data by law.

Six of the twelve areas on our scorecard rate High. The three biggest changes:

• Workers hold the full set of rights. Platform workers are not employees, so the employment ground in section 7(i) does not reach them. The grounds that do, consent and voluntary provision under section 7(a), carry the rights of access and correction. A delivery partner can ask what the platform holds about her, ratings included, and have errors fixed.
• Data sent to the State must be right. Rule 48 of the Social Security (Central) Rules, 2026 requires aggregators to register new workers and report exits in real time or daily. Karnataka, Telangana, Rajasthan and Bihar have legislated for their own boards and feeds. Section 8(3) demands accuracy when data is disclosed to another fiduciary, and these feeds now decide who qualifies for benefits.
• Every worker who sees a customer's address is, in our view, the platform's processor. A data processor handles data on a fiduciary's behalf. The platform answers for what partners do with customers' numbers, addresses and homes.

Trayambic's guide to driver and rider location data covers the grounds for tracking, and our article on background checks and employee monitoring covers verification. This study does not repeat them.

Background

Business models. Delivery platforms take orders for restaurants, dark stores and shops and hand the last mile to delivery partners. Ride-hailing platforms match riders with drivers of cars, autos and bike taxis. Home-services marketplaces send beauticians, cleaners and technicians into customers' homes. Freelance marketplaces connect professionals in India with clients who may be anywhere.

Data principals. Customers; workers, including applicants who never finish onboarding and workers who have left; and third parties, such as the neighbour who accepts a parcel or the family at home during a repair.

Worker data. Identity documents, driving licence and vehicle papers, bank details, selfies for face matching, police verification results, location trails, acceptance and cancellation rates, earnings, complaints, ratings and deactivation history.

Customer data. Phone numbers, addresses and live location, order and trip histories, payment tokens, ratings given and received, call recordings and, in home services, photographs of rooms taken for estimates.

Flows and vendors. Merchants, number-masking and messaging providers, maps, verification vendors, insurers, lenders to workers, cloud hosts, government portals and State welfare boards.

Legal framework

The DPDP Act and Rules

• Grounds (sections 4, 6, 7). Processing needs consent or a listed legitimate use; there is no legitimate-interests ground. Section 7(a) covers data a person voluntarily provides for a specified purpose. Section 7(d) covers disclosures a law requires to be made to the State or its instrumentalities. Section 7(i) covers employment.
• Notice (section 5; Rule 3). Every consent request needs a standalone notice listing the data and purposes, with the means to withdraw consent, exercise rights and complain to the Data Protection Board.
• Fiduciary duties (section 8). The fiduciary answers for its processors "irrespective of any agreement to the contrary" (8(1)) and may engage them only under a valid contract (8(2)). It must keep data complete, accurate and consistent where it drives a decision about the person or is disclosed to another fiduciary (8(3)), keep it secure (8(5)), report breaches (8(6)) and erase it when the purpose ends (8(7)).
• Rights (sections 11 to 13; Rule 14). Access and correction run against a fiduciary to whom the person gave consent, including under section 7(a). Grievances must be answered within 90 days at most.
• Security and breach (Rules 6 and 7). Masking, access control and logs kept a year; breach notice to each affected person and the Board, with a detailed report within 72 hours.
• Dormant accounts (Rule 8). E-commerce entities, as the Consumer Protection Act, 2019 uses the term, with two crore or more registered users must erase data after three years without engagement. The largest delivery and ride-hailing platforms are likely covered.
• Reach (section 3(b)). A freelance marketplace run from abroad is covered when it serves people in India.

The main obligations commence on 13 May 2027. The Board had no members as of October 2026.

Labour and sector instruments

Section 2(47)(ix) of the Consumer Protection Act, 2019 makes disclosing personal information given in confidence an unfair trade practice. CERT-In's 2022 Directions require listed incidents to be reported within six hours.

How they fit together

Section 38 makes the DPDP Act apply alongside these laws and prevail in a conflict. Conflicts are few. The Central and State feeds are disclosures required by law to the State or its instrumentalities, which section 7(d) covers without consent. The labour laws limit the recipients in turn: Karnataka and Bihar confine the data to their Acts' objects (s.10(4) proviso and s.10(5) proviso), Karnataka and Telangana require their payment systems to comply with data protection law (s.21(4) in both), and Bihar's section 30 requires workers' consent "unless otherwise required under law", which covers the database aggregators must hand over.

Section 16(2) preserves stricter rules on transfers abroad. Little here triggers it: the Aggregator Guidelines ask where servers are located but, in the copy we reviewed, set no localisation requirement.

Analysis

The Trayambic DPDP Impact Scorecard

Overall impact: High

Workers are data principals with full rights

The Code on Social Security defines gig work and platform work as arrangements outside the traditional employer-employee relationship. Section 7(i) of the DPDP Act speaks of employment and of "a Data Principal who is an employee". A platform worker fits neither, so the platform needs another ground for each use of her data.

Section 7(a) is the natural fit for documents a worker uploads to start work and for the data generated by each job. It runs out when the same data feeds fraud models, insurance offers or a lending partner's underwriting. Those need consent that a worker can refuse and still get jobs, because section 6(1) requires consent to be free and specific.

The ground has a consequence employers do not face. Employees processed only under section 7(i) may lack statutory access and correction rights. Platform workers, processed under consent or section 7(a), have them in full:

• Access. A worker may ask for a summary of her data and the processing, and for the identities of every fiduciary and processor it went to. Insurers, lenders, the Central portal and State boards all belong on that list. Section 11(2) exempts only written requests from bodies authorised by law to obtain data for preventing or investigating offences.
• Correction. A cancellation logged against her that the customer caused, or a rating attached to the wrong job, is inaccurate data she can have corrected. A harsh but genuine rating is not.

Karnataka's section 13 adds a duty to tell workers how to obtain information about automated parameters affecting their work, naming fares, earnings and customer feedback; Telangana's section 12 is similar. One self-service view of the worker's own record can meet all of these.

Feeds to the State: accuracy with consequences

Rule 48(2) of the Social Security (Central) Rules, 2026 turns the platform into the Government's source of truth. Aggregators had 45 days from commencement to share details of existing workers so that each can receive a Universal Account Number. New workers must be registered, and exits reported, in real time or daily through an API, with monthly updates.

The same rule makes the data decisive. Benefits may depend on 90 days' engagement with one aggregator, or 120 across several, in the previous financial year, and a worker counts as engaged on any day she earns anything. A missing day, a duplicate identity or an exit triggered by a wrongful deactivation can push her below the line. Section 8(3) applies twice over: the data is disclosed to another fiduciary and it drives a decision about her.

The State Acts add their own channels as they come into force: Karnataka's per-transaction Payment and Welfare Fee Verification System and quarterly returns, Telangana's real-time equivalent, Rajasthan's transaction system and Bihar's database. A platform active in all four States could run five feeds with different identifiers and formats.

The answer is a single regulatory data layer: one canonical worker record, only the fields each feed needs, daily reconciliation against the platform's ledger, transmission logs kept a year under Rule 6, and API credentials guarded like payment keys. Every feed belongs in worker notices and access responses.

Ratings and deactivation

A rating is the worker's personal data, and often the customer's too. Combined with acceptance rates and complaints, it decides who gets work and who is removed. Section 8(3) requires the data behind that decision to be complete, accurate and consistent. In practice that means:

• excluding ratings for delays the worker did not cause, such as kitchen waits or app outages;
• detecting retaliatory or abusive ratings, and customers who rate everyone low;
• applying the same thresholds across cities; and
• recording which data each deactivation relied on.

The State Acts add procedure. Karnataka requires an exhaustive list of termination grounds in the contract, written reasons and 14 days' notice, with immediate action allowed only where the ground involves bodily harm (s.14). Its definition of termination covers blocking, suspension or ineligibility "irrespective of the duration", so an automatic 24-hour lock-out counts (s.2(o)). Telangana requires seven days' notice (s.14).

For ride-hailing, the Aggregator Guidelines require drivers rated below the 5th percentile to complete quarterly refresher training before continuing (cl. 11.2(v)), an inquiry within three days of a passenger complaint before action (cl. 11.2(vi)), and immediate off-boarding, pending inquiry, on a drug or alcohol complaint (cl. 14.10).

Workers rate customers too. A "difficult rider" flag or a free-text note is the customer's personal data, open to her access request. Keep such notes factual and short-lived.

Customer data in partners' hands

A delivery partner sees a name, phone number, address and sometimes a gate code. A technician sees the inside of a home. The worker is not the platform's employee, so when she handles a customer's data for the platform she acts as its processor. Section 8(1) makes the platform answerable for her, and section 8(2) requires a valid contract: the partner agreement must say what she may see, that she may not keep or reuse it, and what happens if she does.

Masked numbers and expiring addresses, covered in Trayambic's location data guide, do most of the technical work. Home services add one more: estimate photographs should be captured inside the app and held on the platform's servers, never saved to the technician's own gallery, where the contract cannot reach them.

One rule pulls the other way: the Aggregator Guidelines keep a driver's contact details available to the passenger for at least seven days after the journey (cl. 14.11), so masking must route calls, not cut them off. A partner who messages a customer after delivery exposes the platform under the DPDP Act and consumer law alike.

Worked example: a home-services marketplace

An unnamed marketplace in Bengaluru and Hyderabad has about 25,000 beauticians, cleaners and technicians. Customers rate every job, and the app suspends anyone whose average falls below a threshold.

1. 1.Grounds. Onboarding documents and job data rest on section 7(a). Police verification, selfie re-checks and location while travelling to a job rest on consent with Rule 3 notices. Insurance offers get a separate opt-in. The rule 48 and State feeds rest on section 7(d).
2. 2.State feeds. One integration serves the Central portal, Karnataka's board and Telangana's board. Engagement days are reconciled monthly, and exits are reported only after a deactivation is final.
3. 3.Suspensions. Automatic suspension is replaced by a review queue. Ratings from cancelled jobs, and from jobs where the professional raised a safety concern, are excluded. The company applies Karnataka's 14-day notice in both States; immediate action is reserved for threats of bodily harm.
4. 4.Customers. Numbers are masked; addresses and photographs leave the professional's app 24 hours after the job. The partner agreement adds processor terms and a no-contact clause.
5. 5.Rights. Professionals can download their ratings history, aggregated so customers are not identifiable, and the reasons for any suspension.
6. 6.Retention. After exit, the company keeps what tax law, exit reporting and likely claims need and erases the rest, with logs kept for one year.

Compliance framework

Phased roadmap

• Now to December 2026: ground map; feed integration and reconciliation.
• January to March 2027: notices and consents; partner agreements; masking; deactivation review.
• April to May 2027: rights tooling; erasure runs; breach rehearsal.
• Ongoing: track the s.114(5) contribution notification, State rules, court challenges and SDF notifications.

Recommendations

1. 1.Stop borrowing the employer's playbook. Platform workers sit outside section 7(i), so map each use of their data to consent or section 7(a).
2. 2.Treat State feeds like payroll. Reconcile, log and correct them, because a worker's benefits now depend on them.
3. 3.Put a person between the algorithm and a deactivation, and keep a file showing what data it relied on.
4. 4.Write processor terms into every partner agreement and let the app enforce them.
5. 5.Give workers one place to see their ratings, scores, feeds and deactivation reasons, which meets the DPDP Act and the State Acts at once.
6. 6.Clear customer data from partner apps when the job ends, and clear a departed worker's file once tax, exit reporting and likely claims no longer need it.

Key takeaways

• Platform workers are not employees, so section 7(i) does not apply; consent and section 7(a) do, and they give workers full access and correction rights.
• Rule 48 of the Social Security (Central) Rules, 2026 and four State Acts make aggregators the source of worker data for welfare schemes; section 8(3) makes its accuracy a legal duty.
• Ratings and deactivations need accuracy checks, records and, in Karnataka and Telangana, written reasons and notice.
• Workers who handle customers' data act as the platform's processors and need contract terms and technical limits.
• The sector rates High on the Trayambic scorecard, with six High areas.