Ola

Overview

Ola (ANI Technologies Private Limited) is a leading mobility platform in India, facilitating ride-hailing and other transportation services. Given the extensive personal and location data collected from millions of users and drivers, its privacy practices are critically assessed against the stringent requirements of India’s Digital Personal Data Protection Act 2023 (DPDP Act).

DPDP Readiness: Section-by-Section Analysis

Section 6 — Consent & Notice ⚠️

Ola’s privacy policy explicitly states: “BY ACCEPTING THE CUSTOMER TERMS AND CONDITIONS, YOU AGREE TO THE TERMS OF THIS PRIVACY POLICY”. This constitutes a bundled consent mechanism, meaning users must accept the entire policy to use the services. This approach does not meet the DPDP Act’s requirement for consent to be “freely given, specific, informed, and unconditional,” as mandated by Section 6. There is no clear provision for granular consent for different processing purposes.

What the policy says: “By accepting the Customer Terms and Conditions, you agree to the terms of this Privacy Policy.”

DPDP requirement: Consent must be unbundled, specific to each purpose, informed, and capable of being withdrawn.

Gap: The policy presents a “take it or leave it” scenario, failing to offer data principals genuine choice over specific data processing activities.

Section 7 — Certain Legitimate Uses ⚠️

The policy outlines various purposes for data processing, some of which may exceed the narrow scope of “legitimate uses” defined under Section 7 of the DPDP Act. For instance, purposes such as “To improve our Services and conduct research”, “To communicate with you; including to send you information about our Services and events; To develop new programs and services”, and “to protect the safety of the public for any reason” are broadly stated. While some of these might fall under legitimate interests in other jurisdictions, under DPDP, these could require specific consent if not directly fulfilling a state function, medical emergency, or employment-related necessity.

Gap: Several processing activities claimed under broad legitimate interests would likely require explicit consent under the DPDP Act.

Section 8 — Obligations of Data Fiduciary ✅

Ola’s policy acknowledges the importance of data security. It states, “We take reasonable measures to protect the information you provide to us from loss, theft, misuse and unauthorized access, disclosure, alteration and destruction”. Specific measures mentioned include the use of “Secure Socket Layer (SSL) technology to encrypt your credit card number”. Additionally, for related entities, it refers to using Amazon Web Services (AWS) with “state-of-the-art security measures”, indicating a general commitment to industry-standard security practices across the group.

Strength: The policy demonstrates an awareness of the need for security safeguards in line with Section 8.

Section 9 — Data Retention 🔴

Critical gap. The policy employs vague language regarding data retention, stating, “We retain personal data only as long as necessary for the purposes described in this policy or as required by law”. Similarly, another snippet notes, “We will only retain your Personal Data for as long as it is necessary to fulfill the purposes outlined in this Policy or the purposes of which You have otherwise been informed”. This generic phrasing lacks specific retention periods for different categories of personal data, which is a key requirement under Section 9 of the DPDP Act to ensure data is erased once the purpose is fulfilled or consent is withdrawn.

Gap: No specific timelines for data retention or automated deletion triggers, leaving data principals unclear about the duration their data is stored.

Section 11 — Rights of Data Principal ⚠️

Ola’s policy mentions the Data Principal’s right to “access and update your information”. A significant strength is the explicit mention of “Your right to be forgotten” and the ability to “restrict or prevent processing your personal information” under specific conditions. However, the policy does not explicitly address the right to nominate another person to exercise these rights in case of death or incapacity, as outlined in Section 14 of the DPDP Act. While mechanisms for requesting updates exist, a self-service portal for all rights is not clearly indicated.

Partial compliance. Basic rights are acknowledged, but DPDP-specific rights like nomination are missing.

Section 12 — Right of Grievance Redressal ✅

The policy provides a mechanism for grievance redressal. For Ola Maps (part of ANI Technologies), it specifically mentions a Data Protection Officer (DPO) at support@olakrutrim.com, with a commitment to address issues “as soon as possible and within a maximum period of one month”. Crucially, it also states, “if you are still of the opinion that we are processing your personal data in violation of data protection laws and regulations you have the right to lodge a complaint with the supervisory authority”. This aligns well with DPDP requirements for a clear grievance process and escalation path to the Data Protection Board.

Strength: Clear grievance contact, response timelines, and escalation to supervisory authority (even if specific DPO email might vary across Ola’s services).

Section 16 — Cross-Border Data Transfer ⚠️

The policy states that information may be transferred “to the United States or Canada or other countries outside of where you live”, and also to “recipients in countries outside India that may have differing data protection laws”. While Ola Electric’s policy mentions ensuring appropriate safeguards for transfers, the general Ola Cabs policy lacks the specific detail required by the DPDP Act. Under Section 16, transfers are permitted only to countries notified by the Central Government, and the policy does not explicitly confirm adherence to such a ‘white list’ or detail specific safeguards for all such transfers.

Gap: The cross-border transfer provisions lack the necessary specificity and alignment with the DPDP Act’s framework for restricted jurisdictions and explicit safeguards.

Risk Assessment