DPDP Insights › Questions › Connected vehicles and product registration: what can we do with the data?

Connected vehicles and product registration: what can we do with the data?

Reviewed by InfraVeritas360 ResearchFirst published 10 October 2026Last reviewed 11 October 2026

Sources: DPDP Act, 2023 and DPDP Rules, 2025 (MeitY) · Ministry of Labour and Employment (PIB) · India Code; PRS summary

Short answer: For the service the buyer chose; anything more needs consent

Connected vehicles and smart products send location, usage and driving data, and registration gives you the buyer's contact details. Use it for what the buyer signed up for: warranty, recalls, safety and the services in the app. Sharing with insurers, finance partners or for marketing needs specific consent. Location data shows where people live and go, so keep only what each service needs.

Why it matters

Section 6 needs specific consent for each purpose. Section 5 needs a notice. Section 16 applies if telematics data goes abroad.

Section 5 · Rule 3: When you ask for consent, give a clear notice that stands on its own: what data, for what purpose, how to withdraw consent, how to use the rights and how to complain to the Data Protection Board. For data collected before the Act, a notice is due as soon as reasonably practicable.
Section 6: Consent must be free, specific, informed, unconditional and unambiguous, given by a clear action, limited to the data needed for the purpose, and as easy to withdraw as it was to give.
Section 8(5) · Rule 6: Protect personal data with reasonable security safeguards. Rule 6 lists the minimum: encryption, masking or tokenisation; access control; logs and monitoring; backups for continuity; keeping logs for at least one year; and security terms in contracts with processors.
Section 8(7) · Rule 8: Erase personal data when its purpose is over or consent is withdrawn, unless a law requires you to keep it, and have your processors erase it too. Rule 8(3) asks every Data Fiduciary to keep personal data, traffic data and logs for at least one year for purposes listed in the Rules.
Section 16 · Rule 15: Personal data may go outside India unless the government restricts a country. A sector law or regulator that sets a stricter rule still applies. No country had been restricted when this page was last reviewed.
Sections 11–14 · Rule 14: People can ask for a summary of their data and who it was shared with, ask for correction, completion, updating or erasure, complain, and nominate someone to act for them. You must publish how to do this.

A worked example

A vehicle buyer opens the app and finds a separate switch for sharing driving data with an insurer. She leaves it off. Her location history is kept only as long as the trip feature needs, and the telematics vendor's contract says where data is stored.

Steps

List the data each connected feature sends and why.
Show the notice in the app and at delivery, by feature.
Ask separately for insurer, partner and marketing sharing.
Set retention for location history and trip data.
Check where the telematics vendor stores and supports data.

Evidence to keep

Feature and data list
App notice and consent screens
Retention settings
Telematics vendor schedule

Common mistakes

Location kept for years by default
Dealer handing buyer lists to insurers
Telematics support from abroad with no contract terms

Who does what

DPO / Privacy lead: Buyers will ask who received their data. Keep a sharing log by partner.
CISO / Security head: Telematics platforms need named access, logs and tested deletion.
CIO / IT head: Build retention into the telematics platform, not as a later clean-up.
HR head: If employee vehicles or pool cars are tracked, tell staff in the notice.
Operations head: Service centres see vehicle data daily. Access by job card only.
Plant head / factory manager: Plant test fleets and employee vehicles send data too; include them.
Customer service department: Explain sharing settings to buyers who call.

What a good answer from management sounds like

“Each connected feature has a notice. Partner sharing is a separate choice the buyer can switch off. Location history is kept only as long as the service needs.” Effort and time: Medium · 8 to 12 weeks.