What is DPDP Act?
Digital Personal Data Protection Act
Definition
The Digital Personal Data Protection Act is India’s data-protection law governing how personal data is collected, processed, and stored, with obligations on data fiduciaries and rights for individuals.
Why it matters for Indian fleets
Fleet platforms handle driver and location data. Hosting data in India and following DPDP obligations reduces compliance and breach risk.
The vocabulary, and why fleets sit on both sides of it
The Digital Personal Data Protection Act, 2023 governs the processing of digital personal data in India. Three roles carry most of the meaning.
- Data Principal, the individual the data is about. For a fleet this is the driver, and often the customer contact receiving delivery notifications.
- Data Fiduciary, whoever determines the purpose and means of processing. A fleet operator deciding to track its drivers is a Data Fiduciary.
- Data Processor, who processes on a Fiduciary’s behalf. A telematics platform is typically a Processor for its customers, and a Fiduciary for its own employee data.
The point most fleets miss is that buying compliant software does not make the fleet compliant. The obligation to have a lawful purpose and to tell drivers what is collected sits with the fleet, because the fleet decided to collect it.
Which fleet data is personal data
Vehicle data is not automatically personal data, but most fleet data becomes personal the moment it is linked to an identified driver, and linking it is precisely what makes it operationally useful.
- Location tied to a named driver is personal data, and continuous movement history is among the more sensitive forms of it.
- Driver behaviour scores are personal data, and they are used to make decisions about people.
- DMS camera footage of a driver’s face is personal data, captured continuously inside the cab.
- Licence and verification results from Sarathi checks are personal data about an identified individual.
Cab-facing video deserves particular care. It is the most intrusive collection in a normal fleet deployment, and the one drivers most often object to, so purpose, retention and access should be settled explicitly rather than by default.
What a fleet should actually do
The obligations reduce to a short list that is mostly discipline rather than technology.
- State the purpose for each category collected, and collect only what serves it.
- Give notice to drivers in language they understand, covering what is collected, why, and for how long. A clause in an English employment contract is weak notice to a driver who does not read English.
- Set retention periods and delete on schedule. Indefinite retention of cab video is difficult to justify against any stated purpose.
- Scope access, so that continuous location and cab footage are available to the people who need them for the stated purpose, not to everyone with a login.
- Be able to respond to a Data Principal asking what is held about them.
- Have a breach process, which overlaps with CERT-In reporting obligations.
Hosting data in India helps with residency expectations and with customer assurance, but it is not the same as compliance. A well-hosted system collecting more than it can justify is still a problem.
Frequently asked questions
Does the DPDP Act apply to fleet tracking data?
It applies wherever digital personal data is processed, and fleet data becomes personal data once it is linked to an identified driver. Vehicle location alone may not be, but location tied to a named driver, behaviour scores and cab-facing footage are.
Who is the Data Fiduciary, the fleet or the software vendor?
The fleet operator is normally the Data Fiduciary, because it determines why the data is collected. The telematics platform is typically a Data Processor acting on the fleet’s instructions. Buying compliant software does not transfer the fleet’s own obligations to the vendor.
Do drivers need to consent to GPS and camera monitoring?
Drivers must at minimum be given clear notice of what is collected, why and for how long, in a language they understand. Cab-facing video is the most intrusive element and warrants explicit treatment of purpose, retention and who can view footage, rather than being covered by a general clause.
Does hosting data in India make a fleet DPDP compliant?
No. Indian hosting addresses residency expectations and helps with customer assurance, but compliance also requires a lawful purpose, proper notice, data minimisation, defined retention, scoped access and a way to answer requests from the individuals concerned.
Related MoboSafe workflows
Review the documented product scope and setup requirements for these related operational tasks.
Organisation & Access Controls
Configure organisations, branches, roles, permissions, company policies, notifications, security, privacy, billing, and module settings.
Fleet APIs & Integrations
Configure MoboSafe integrations, API access, device connections, connection tests, usage monitoring, and dashcam backup settings.
Related terms
Begin
Ready to connect your whole operation?
Explore tracking, trips, assets, fuel, inventory, accounting, and payroll with the MoboSafe team. Build a rollout around the workflows your fleet needs.