DPDP Guide for Used-Car Platforms
Used car platforms handle driver licenses, bank details, and RC transfers. Learn how to manage this data under India's DPDP Act.
Discuss this page with an LLM
DPDP Action Sheet
Use this before your next workflow goes live. It keeps the useful parts visible and turns DPDP into checks your team can actually answer.
For DPDP Guide for Used-Car Platforms, the DPDP question is how personal data enters the workflow, where it is stored, which tools touch it, what purpose was explained, and how deletion or withdrawal will work.
1. Lead Forms
Check:
- What data are you collecting?
- Is the purpose clear at the point of collection?
- Is marketing consent separate from service communication?
- Can the user withdraw consent later?
Common mistake: one checkbox that silently covers newsletters, sales calls, partner sharing and remarketing.
2. Email and WhatsApp
Check:
- Who is on the list?
- Where did consent come from?
- Is the list imported from a vendor, event, webinar, scrape or old CRM?
- Can you prove the source of consent?
Common mistake: treating every lead as permanently marketable.
3. Ads and Retargeting
Check:
- Are pixels or ad platforms receiving identifiable user behavior?
- Are audiences built from customer lists?
- Are lookalike or remarketing audiences using personal data?
Common mistake: assuming "the ad platform handles it" means your company has no DPDP responsibility.
4. Website Analytics
Check:
- Which tools run on the site?
- Are IP address, device identifiers, session IDs or form fields being captured?
- Is analytics used only for measurement, or also for profiling and targeting?
Common mistake: installing tools first and asking privacy questions later.
5. Vendor List
Make a quick list:
- CRM
- Email platform
- WhatsApp provider
- Analytics
- Ad pixels
- Form tool
- Landing page builder
- Webinar tool
For each vendor, answer: what data goes there, why, who can access it and how deletion works.
6. This Week's Action
Map one campaign from first click to final follow-up. Mark every place personal data is collected, enriched, shared, uploaded or used for targeting.
If your team cannot answer where the data came from and where it goes next, start with a data flow map before rewriting policy copy.
Book a DPDP clarity callWant all of this handled, end to end? Sanctum is the all-in-one DPDP compliance programme behind this site: legal position, data map, gap analysis, implementation, tooling, training, readiness opinion, and breach cover under one accountable owner. How all-in-one DPDP compliance works or see the Sanctum programme.
Managing Seller and Buyer Documentation
Used car platforms collect Aadhaar, PAN, and address proofs to facilitate RTO Form 29 and 30 filings. This data is tied to engine and chassis numbers, making it highly identifiable. Storing these document scans on unencrypted dealer tablets or sharing them through unmonitored messaging groups creates a significant security risk. Under DPDP, you must ensure these documents are only accessible to the specific employees handling the transfer.
Test Drive and Lead Tracking
When a lead requests a test drive, you collect their name, phone number, and a digital copy of their driver’s license. DPDP requires this data to be used strictly for the test drive and insurance verification. You cannot use this license data to build a long-term marketing profile or share it with third-party car accessory sellers without separate, specific consent from the driver.
Third-Party Data Sharing for Financing
Platforms often pass buyer data to multiple banks or NBFCs to secure car loans. You must track exactly which finance partner received the data. If a customer is rejected by one lender, you need clear consent before sending their KYC documents and bank statements to a different lender. Each sharing instance must be recorded to fulfill your obligations if a customer asks for a summary of their data transfers.
| Workflow | Personal Data Involved | DPDP Risk |
|---|---|---|
| Lead Capture | Name, phone number, car preference | Medium |
| Test Drive | Driver’s license copy, GPS location logs | High |
| Vehicle Valuation | Seller’s name, RC copy, home address | High |
| RTO Transfer | Aadhaar, PAN, digital signature, photos | Very High |
| Loan Processing | Bank statements, salary slips, ITR | Very High |
Data Retention and Lead Ghosting
The biggest conflict for used car platforms is “Lead Ghosting.” Dealers often keep phone numbers and license copies of people who browsed a car but never purchased it. DPDP mandates deleting this data once the purpose—the sale or the test drive—is over. Holding onto test drive logs for years for “future marketing” without specific permission is a violation of the Act.
This week
Review your “Book a Test Drive” and “Check Valuation” web forms. Add a specific, un-ticked checkbox that asks for permission to share data with finance or insurance partners, separate from the general website terms of service.
Now think about your work. Where does personal data enter your workflows? Where does it sit? Who else touches it?
Frequently asked questions
Can I share test drive leads with insurance brokers?
Only if the customer gave specific consent for insurance quotes. You cannot bundle this into the general platform terms or privacy policy without a clear opt-in for third-party sharing.
How long can I keep a copy of a seller's Aadhaar or PAN?
Only until the RTO transfer is finalized and the legal record is confirmed. Once the transfer is legally complete, the platform must delete the digital scans unless a specific financial law requires longer retention.
Do I need a contract with the local car dealers listed on my platform?
Yes. Since you are sharing buyer leads with them, you must have a Data Processing Agreement. This ensures the local dealer also follows DPDP rules when handling your users' personal information.