DPDP Compliance for Automotive OEMs and Dealerships: Lead, Finance and Service Data

DPDP compliance for automotive businesses requires customer data to be governed across the manufacturer, dealer, lender, insurer and service network. Each organization needs to identify its processing purposes, role, consent requirements and retention duties. A single vehicle purchase can involve several independent customer relationships.

For OEM compliance teams, dealer principals, marketing heads and technology leaders, the practical objective is to carry the correct permissions from an enquiry to a test drive, finance referral, delivery and after-sales service. Connected-car services add data about vehicles and their users that needs a separate assessment.

When does DPDP apply to automotive customer data?

The core DPDP processing obligations are scheduled to commence on 13 May 2027. As at 2 November 2026, automotive businesses can use the transition to review notices, consent, rights, security and retention across their sales and service processes. Existing motor-vehicle, tax, consumer and financial-services requirements continue where applicable.

The Act covers digital personal data and offline information subsequently digitized. A showroom enquiry entered into a CRM, a driving-license scan and an identifiable service record can therefore fall within scope. A vehicle identification number, or VIN, can form part of personal data when linked to an identifiable person.

Your DPDP readiness review should distinguish the manufacturer, the dealership's legal entity and external partners. Shared branding or access to a common dealer-management system does not establish that all parties act in the same legal role.

Which automotive data flows should be mapped first?

You should map the customer journey and the systems receiving data at each step. Automotive customer data protection should cover the sales relationship and the operational copies created around it.

·       Lead and test drive: contact details, vehicle interest, preferred dealer, appointment, driving eligibility and supporting records.

·       Booking and delivery: buyer identity, address, registration information, payment references and authorized representatives.

·       Finance and insurance: application data, income documents, partner referral and the relevant sharing permissions.

·       Service and warranty: job cards, service history, complaints, invoices, warranty claims and recall-related records.

·       Connected services: user accounts, VIN associations, location, journeys, diagnostics and remote-access permissions where the product collects them.

Manufacturer privacy disclosures illustrate how customer information can move through digital platforms, authorized partners and finance facilitation. They provide sector context; another company's policy is not a substitute for assessing the particular data flow.

Your automotive customer data protection inventory should include dealer spreadsheets, call recordings, document uploads, agency lead forms and staff messaging tools. For each copy, record the purpose, owner, recipient, access rights and deletion or preservation rule.

How should DPDP compliance for automotive separate OEM and dealer roles?

You can determine each role by who decides why and how the data is processed. An OEM and dealer may each act as a Data Fiduciary for their own purposes. A provider processing data on another entity's instructions may act as a Data Processor.

Your dealer role assessment should establish who determines the customer-management purposes. The same dealer could perform a separate activity under an OEM's instructions. A software provider may host the records without deciding the sales purpose. Record these relationships at activity level.

Your dealer agreements should identify permitted fields and uses, security responsibilities, incident reporting, sub-processors and action on withdrawal or rights requests. A processor contract supports the instructed processing arrangement; it does not create unrestricted permission for independent use.

Section 8 places responsibility on the Data Fiduciary for processing undertaken on its behalf. The commercial arrangement should therefore identify who can demonstrate what notice was shown, what choice was made and what happened after a change.

How should dealers capture lead and test-drive consent?

You should present the purpose at collection and assess the appropriate processing ground. Section 4 provides for consent or specified legitimate uses under Section 7. Section 7(a) addresses voluntarily provided data for a specified purpose, subject to its conditions.

For a test-drive request, collect the information needed to arrange the appointment and assess driving eligibility. Explain the dealer receiving the request and the relevant use of the data. Further uses, such as unrelated partner promotions, need a separate assessment.

Where consent is the ground, Section 6 requires clear affirmative action and specific, informed permission. Rule 3 requires an independently understandable notice describing the personal data and purposes, with withdrawal and rights routes.

Your lead form should distinguish an enquiry follow-up from ongoing promotional permission. A practical record includes lead source, receiving entity, customer identifier, purpose, notice version, channel, timestamp and choice. Restrict access to driving-license details to staff who need them, and assess whether retaining a full copy is necessary.

Dealer lead consent management also needs communication controls. TRAI's September 2026 amendment addresses verifiable enquiry-based communications and conditions for legacy consent. Review applicable requirements and commencement provisions with the telecom provider before configuring campaign eligibility.

For a hypothetical lead sent from an OEM website to a selected dealer, both teams should be able to retrieve the relevant notice and purpose. If the customer later declines promotions, the workflow should update the systems handling that purpose and preserve evidence of the action.

What changes when the dealer refers finance or insurance?

Finance and insurance referrals require a defined purpose, recipient and data scope. A lender may need application documents that are unnecessary for a vehicle enquiry or service booking.

You should identify the receiving bank or NBFC before sharing the relevant data and establish the required permission. Limit access to staff handling the referral and examine how documents leave the dealership. A folder accessible to the full sales team can distribute far more information than the referral requires.

Where the arrangement falls within RBI's digital-lending framework, assess the directions applicable to the regulated lender and any Lending Service Provider role. Current NBFC credit-facility directions address need-based collection, explicit consent, audit trails, third-party sharing, limited LSP storage and data location. These requirements should be matched to the actual financing arrangement.

Motor-insurance distribution needs its own assessment. Regulation 15 of IRDAI's 2024 policyholder-protection regulations addresses confidentiality and explicit consent for sharing proposal information, with specified exceptions including underwriting and claims. It also prohibits proposal clauses that allow third-party sharing by default.

Your implementation should preserve the finance or insurance permission separately from vehicle promotions. A consent management platform can coordinate those records when the entities, purposes and integrations have been defined.

How should DPDP compliance for automotive address connected cars?

Connected-car data protection requires attention to the person using the vehicle and the person controlling the account. The registered owner, driver, app user and passenger may be different individuals.

Hyundai India's Bluelink privacy policy illustrates the range of possible connected data, including vehicle location, diagnostics, driving information and voice-related data. Its India FAQ also describes unenrolling a previous owner when a used vehicle is registered to a new user. These examples show why account lifecycle and vehicle lifecycle need to be connected.

Your connected-car review should establish which functions require which data, what is optional and who can access remote services. An owner's permission cannot be assumed to resolve every question involving other identifiable vehicle users.

Design ownership transfer to verify the new user's authority, remove previous remote access, review shared accounts and clear eligible personal settings. Keep legally required service or recall records under their approved retention rules. Separate those records from a former owner's destinations, contacts and promotional profile.

Vehicle diagnostics can also become identifiable through a VIN or account. A dataset described as technical still needs assessment where it relates to an identifiable person. Review any secondary analytics or insurer-sharing purpose separately.

How should dealerships retain service, warranty and recall records?

Automotive data retention depends on the record and its legal or operational purpose. A customer withdrawing marketing consent can still have an active warranty, unresolved complaint or statutory record that needs preservation.

MoRTH's recall framework, introduced through G.S.R. 173(E) in 2021, includes duties around owner notification, recall complaints, rectification information and recall records. Those obligations require a separate assessment from promotional preferences.

Tax records also have their own rules. CGST Act Section 36 generally requires relevant accounts and records to be retained for 72 months from the due date of the annual return for the relevant year. Its proviso can extend retention for proceedings or investigation. The trigger is different from the invoice date.

For DPDP, Section 8(7) preserves retention necessary for compliance with law. Final Rule 8(3) adds minimum one-year retention of personal data, associated traffic data and processing logs for specified purposes once effective.

Your schedule should distinguish abandoned leads, test-drive records, invoices, finance copies, service job cards and recall records. Assign each a purpose, trigger, legal reference, access restriction and review date. Preserving a service record does not automatically authorize promotional reuse.

How should automotive businesses handle Data Principal Rights?

Route requests to the entities and systems holding the person's data, with identity and authority checks appropriate to the request. A VIN alone should not authorize disclosure of previous owners' personal details.

For access or correction, identify which information concerns the requester and which belongs to another person. For erasure, identify eligible records and document necessary preservation. Sections 11 to 14 provide the relevant rights framework, subject to their terms.

Your security controls should address dealer portal access, staff departures, document downloads, outsourced call centers and connected-service administration. Define who handles a dealer incident involving information also processed by the OEM.

Under the scheduled DPDP breach regime, initial intimation to the Board and notice to affected individuals are required without delay. Detailed Board reporting follows within 72 hours, subject to an allowed extension. Contracts and escalation routes should support those duties when effective.

What should an automotive implementation demonstrate?

You can test DPDP compliance for automotive using one enquiry that becomes a purchase, a finance referral and a service relationship. Then test promotional withdrawal and ownership transfer.

Your review should confirm that the relevant parties can retrieve notice evidence, enforce purpose changes, restrict required archives and complete rights tasks across systems. DPDP compliance solutions are most useful when their records match the dealer and OEM operating model.

OneConsent lists data discovery, processing records, consent and preference management, rights and audit-trail modules. These can be evaluated against a defined dealer-network workflow, with the proposed integrations and responsibilities demonstrated during implementation planning.

The DPDPA readiness guide can help your team organize the wider implementation review.

Book a demo to discuss consent and customer-data governance across your automotive sales and service journeys.