India's fleet operators are driving into a legal minefield over who owns and controls the biometric data captured by a rapidly growing network of safety dashcams. As video telematics and Advanced Driver Assistance Systems (ADAS) become operational essentials on Indian roads, the integration of cabin-facing cameras is sparking a high-stakes industry debate: who bears legal liability under the country’s new Digital Personal Data Protection (DPDP) Act?
For heavy-industry commercial fleets in cement, steel, mining, and construction, these tracking systems are vital for preventing accidents, lowering insurance premiums, and saving lives. However, they also capture continuous biometric and behavioral video feeds of drivers.
Pali Tripathi, Chief Executive Officer of Taabi Mobility, notes that the regulatory boundaries under the new law are demanding but clear. Tripathi, who brings nearly two decades of expertise in strategy, business incubation, and scaling new-age technology solutions, leads the company's strategic direction, product roadmap, and market expansion, into data-driven decision-making for fleet operators.
"In our case, it is very, very specific. All the data is the customer data," explains Tripathi, whose technology-led mobility and logistics intelligence company is a subsidiary of the RPG Group and focuses on applying AI, IoT, and advanced analytics to solve real-world fleet and supply chain challenges. "That data is protected, encrypted. It is not something that is available for anyone to use except the customer," she adds.
DPDP Act Puts Data Liability on Fleet Operators, Not Software Providers
Under India’s DPDP framework, the legal liability rests squarely on the employer rather than the software provider. Tripathi emphasizes that whether it is driver or customer data, "it is the fleet operators or the customers, if it is an enterprise, that is the data fiduciary in this case," while Taabi acts strictly as a processor that is acting on the function.
While commercial vehicle operators in the U.S. have faced class-action lawsuits over biometric privacy violations, India’s legal terrain is still evolving. Unlike Europe's GDPR, India's DPDP Act does not feature a separate, distinct category for sensitive data, making the compliance landscape a grey area to work on.
How Edge-AI Keeps ADAS Compliant Without Cloud Uploads
To mitigate this compliance liability, Taabi Mobility is leveraging 'edge-AI' technology to process behavioral risks locally inside the vehicle rather than uploading constant biometric feeds to the cloud. This localized edge-computing approach allows operators to enforce strict safety policies without crossing critical driver privacy boundaries.
"What happens is when we do like our ADAS, let's say we'll do a drowsiness detection," Tripathi says. "That footage that is done, on the basis there is on the edge alert to the driver that you may be at the risk of accident." Ultimately, the deployment remains under the fleet operator's control. "All the decisions and the instruction is given by the customer first... So it's the customer that decides how it is going to be used," says Tripathi, a strong advocate for digital transformation in logistics industry.