Location and driving data from a vehicle telematics device is personal data under the DPDP Act from 13 May 2027

From 13 May 2027, the location and driving records that a vehicle telematics device produces are personal data under the Digital Personal Data Protection Act, 2023 (DPDP Act) whenever the vehicle can be tied to the person driving it. The fleet operator that decides why the data is collected is the data fiduciary, and the telematics provider that holds it for the fleet is a data processor, until the provider uses it for its own ends. Consent and notice (sections 5 and 6), the employment ground in section 7(i), erasure (section 8(7)) and breach notice within 72 hours (rule 7 of the DPDP Rules, 2025) then apply to each trip record.

When does a vehicle's position become personal data?

Section 2(t) of the Digital Personal Data Protection Act, 2023 defines personal data as "any data about an individual who is identifiable by or in relation to such data". A telematics device reports a position, a speed, a time and a device number, and none of those names anyone. The test is whether the individual is identifiable "by or in relation to" the record, and a fleet operator holds the other half of the key: the vehicle register, the duty roster and the driver's login or key tag. A record that one vehicle was at one place at 02:10 is, in the operator's hands, a record of where a named driver was.

Section 3(a) applies the Act to processing within India of data collected in digital form. Section 3(b) reaches processing outside India "in connection with any activity related to offering of goods or services to Data Principals within the territory of India", so a platform hosted abroad is not outside the Act merely because its servers are. Section 3(c)(i) excludes personal data processed by an individual for a personal or domestic purpose, which covers a private owner's tracker on her own car and not a business that fits devices to vehicles others drive.

The commencement notification G.S.R. 843(E) and the Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E)), both of 13 November 2025, set the clock. Sections 3 to 17 of the Act (other than section 6(9)) and the Board's enforcement and penalty provisions in sections 27 to 34 start eighteen months after publication, on 13 May 2027, with rules 3 and 5 to 16. Until then none of what follows binds.

Who is the data fiduciary and who is the processor?

Section 2(i) makes a data fiduciary the person who "alone or in conjunction with other persons determines the purpose and means of processing of personal data". Section 2(k) makes a data processor a person who processes "on behalf of" a fiduciary. The fleet operator that decides to track its vehicles, for dispatch, proof of delivery or safety, sets the purpose and is the fiduciary. The telematics provider that supplies the device and platform and does what the operator configures is the processor.

The label follows function, not the contract heading. A provider that keeps trip data after the subscription ends to build a driver-behaviour score, price insurance or train a routing model is deciding a purpose of its own. On the words of section 2(i) it is then a fiduciary for that use, with notice and consent duties of its own.

The Act puts the responsibility in one place. Section 8(1) makes the fiduciary responsible "irrespective of any agreement to the contrary", including for processing by a processor, and section 8(2) permits a processor only "under a valid contract". Rule 6(1)(f) requires that contract to carry provisions for reasonable security safeguards. The operator therefore answers for a breach at the provider, and the contract is where it secures the provider's duty to cease, erase and report.

What do consent and notice require when the device has no screen?

Where consent is the ground, section 5(1) requires a notice with or before the request, stating the data, the purpose, how rights are exercised and how to complain to the Data Protection Board of India. Rule 3 requires an itemised description of the data and of each specified purpose, and the means of withdrawing consent. Section 5(3) requires the notice in English or a language in the Eighth Schedule to the Constitution.

A vehicle has no screen for this, and the Act does not relax the notice for a device. A notice at onboarding, in English or the Eighth Schedule language the driver chooses, listing position, speed, harsh braking, idling and any in-cabin camera feed as separate items with their purposes, is what rule 3 describes. Section 6(1) limits consent to data "necessary for such specified purpose", and the Act's own illustration of a telemedicine app that also asks for a contact list shows the result: consent is limited to the necessary part. A feed collected for dispatch does not become consent to a score sold to an insurer.

Withdrawal must be comparable in ease to giving consent (section 6(4)). Under section 6(6) the fiduciary must then cease, and cause its processors to cease, within a reasonable time, so the withdrawal has to reach the provider's platform.

Can an employer track an employee-driver without consent?

Section 4(1) allows processing on consent or for "certain legitimate uses". Section 7(i) lists one: processing "for the purposes of employment or those related to safeguarding the employer from loss or liability", and for any service or benefit sought by a Data Principal "who is an employee". Where it applies no consent is needed, and section 5(1) ties the notice to a request for consent, so on its words it does not attach to a section 7 use.

Three limits come from the text. The ground is for employment purposes: a shift-time feed to dispatch the nearest truck or recover a stolen load fits, while a feed running after the shift, because the driver takes the vehicle home, is a separate question. The words "who is an employee" qualify the limb on a service or benefit the Data Principal seeks. Whether the employment limb reaches an independent contractor or aggregator partner is not stated, and consent is the ground that does not depend on the answer. And section 4(1) still requires a lawful purpose, which section 4(2) defines as one "not expressly forbidden by law".

How long may the records be kept, and what must be kept?

Section 8(7) requires erasure on withdrawal of consent or "as soon as it is reasonable to assume that the specified purpose is no longer being served, whichever is earlier", unless law requires retention, and requires the fiduciary to cause its processor to erase. The fixed three-year period in rule 8 and the Third Schedule is for e-commerce entities, online gaming intermediaries and social media intermediaries of stated sizes. A fleet operator or telematics provider is in none of those classes, so its test is the open one in section 8(7). Each purpose carries its own end date: a dispatch feed ends soon after the trip closes, a delivery proof when the customer's dispute window ends.

Two floors sit under that. Rule 6(1)(e) requires logs and personal data needed to detect and remedy unauthorised access to be kept for a year. Rule 8(3) requires a fiduciary to retain personal data, traffic data and logs of processing for at least one year from processing, for the Seventh Schedule purposes, and then erase them. The rule's illustration of a cloud provider says the fiduciary must ensure the processor "also retains" them for that year.

What happens after a breach?

Section 2(u) defines a personal data breach to include accidental disclosure and loss of access, so a dashboard misconfigured to expose live positions, or ransomware that locks the history, is within it. Rule 7 sets two clocks. Each affected Data Principal is told without delay what happened, its likely consequences for her and what she can do. The Board gets a description without delay and, "within seventy-two hours of becoming aware of the breach" or a longer period it allows in writing, the detailed account, the measures taken and a report on the notices to Data Principals. The Schedule to the Act sets the ceilings: up to INR 250 crore for failing to take reasonable security safeguards and up to INR 200 crore for failing to give notice of a breach.

What does a timeline look like?

An illustration. The fleet, the dates and the events below are hypothetical. The statutory dates come from G.S.R. 843(E) and rule 7.

A regional fleet of 200 vehicles, with a telematics provider as processor
  13 May 2027           Sections 3 to 17 (other than section 6(9)) and 27
                        to 34, and rules 3 and 5 to 16, start; each driver
                        engaged on consent needs a rule 3 notice
  Mon 17 May 2027       09:00, the operator learns that the provider's
                        dashboard exposed live positions; drivers and the
                        Board are told without delay
  Thu 20 May 2027       09:00, 72 hours on: the detailed report to the
                        Board falls due, unless extended in writing
  31 July 2027          A driver withdraws consent; the live feed stops
                        within a reasonable time and the provider is made
                        to cease
  1 June 2028           A log made on 1 June 2027 reaches the one year
                        floor of rule 8(3) and may be erased

The 72 hours count from becoming aware of the breach, not from the exposure and not from the end of the investigation.

What remains unsettled?

Four points.

Whether a bare vehicle position is personal data where the operator never matches it to a driver. Section 2(t) turns on identifiability "by or in relation to" the data, and the Act does not say whose means of identification count.

Whether section 7(i) reaches a driver who is not an employee in law but is under the fleet's control in practice, or location records outside shift hours. The Act defines neither "employment" nor "employee".

How the one-year floor in rule 8(3) sits with the erasure duties in sections 6(6) and 8(7). Rule 8(3) speaks of retaining "such personal data" as well as logs, and it is not stated whether a withdrawn driver's position history must be kept for the year or only the log of its processing.

Whether a provider that uses fleet data to improve its own product is a fiduciary for that use or a processor acting beyond instructions. The Act defines each by function and says nothing of a mixed role.