What is DPDP Act?

The Digital Personal Data Protection Act, 2023 governs the processing of digital personal data in India. Three roles carry most of the meaning.

• Data Principal, the individual the data is about. For a fleet this is the driver, and often the customer contact receiving delivery notifications.
• Data Fiduciary, whoever determines the purpose and means of processing. A fleet operator deciding to track its drivers is a Data Fiduciary.
• Data Processor, who processes on a Fiduciary’s behalf. A telematics platform is typically a Processor for its customers, and a Fiduciary for its own employee data.

The point most fleets miss is that buying compliant software does not make the fleet compliant. The obligation to have a lawful purpose and to tell drivers what is collected sits with the fleet, because the fleet decided to collect it.

Vehicle data is not automatically personal data, but most fleet data becomes personal the moment it is linked to an identified driver, and linking it is precisely what makes it operationally useful.

• Location tied to a named driver is personal data, and continuous movement history is among the more sensitive forms of it.
• Driver behaviour scores are personal data, and they are used to make decisions about people.
• DMS camera footage of a driver’s face is personal data, captured continuously inside the cab.
• Licence and verification results from Sarathi checks are personal data about an identified individual.

Cab-facing video deserves particular care. It is the most intrusive collection in a normal fleet deployment, and the one drivers most often object to, so purpose, retention and access should be settled explicitly rather than by default.

The obligations reduce to a short list that is mostly discipline rather than technology.

• State the purpose for each category collected, and collect only what serves it.
• Give notice to drivers in language they understand, covering what is collected, why, and for how long. A clause in an English employment contract is weak notice to a driver who does not read English.
• Set retention periods and delete on schedule. Indefinite retention of cab video is difficult to justify against any stated purpose.
• Scope access, so that continuous location and cab footage are available to the people who need them for the stated purpose, not to everyone with a login.
• Be able to respond to a Data Principal asking what is held about them.
• Have a breach process, which overlaps with CERT-In reporting obligations.

Hosting data in India helps with residency expectations and with customer assurance, but it is not the same as compliance. A well-hosted system collecting more than it can justify is still a problem.