Home addresses, shift times and live location make commute data sensitive. See how Zooper protects it and what India's DPDP Rules mean for transport vendors.
If a vendor knows where your people are, it had better know how to protect that.
A transport platform knows more about your employees than most business systems: where they live, when they work and where they are right now. For women on night shifts, that information is especially sensitive. That is why data security is now one of the first questions enterprise buyers ask an employee transport vendor.
What has changed in India
India's Digital Personal Data Protection Rules were notified on 13 November 2025. The main obligations, including notice and consent, security safeguards and breach reporting, take effect 18 months later, around May 2027 [Source: MeitY]. Two things stand out for anyone buying transport technology:
- The company that decides why and how personal data is used stays responsible even when a vendor processes it on its behalf.
- Penalties under the DPDP Act can reach ₹250 crore for specified breaches.
Vendor due diligence is no longer a formality.
What a commute platform holds
- Personal details: names, addresses and phone numbers
- Schedules: shift timings and pickup and drop locations
- Live location data captured for safety
- Billing information for transport services
How Zooper protects it
- ISO 27001:2022 certification. Independent certification of our information security management system, covering risk assessment, access control and incident response, with regular audits.
- Penetration testing. The platform has been tested against real attack methods, not only reviewed on paper.
- Encryption. Data moving between our servers and user devices is encrypted.
- Role-based access. Only authorised people can view or change data, based on their role.
- Incident response plan. A defined process for acting quickly and informing affected parties if something goes wrong.
- Privacy by design. We work to GDPR principles: transparency about what is collected and why, collecting only what is needed, and giving people ways to access, correct or delete their data.
- Anonymisation where possible, so that personally identifiable information is not exposed unnecessarily.
Questions to ask any transport vendor
- Which security certifications do you hold, and when were you last audited?
- When was your last independent penetration test?
- Who can see employee addresses and live location, and is that access logged?
- How long do you keep trip and location data, and can it be deleted on request?
- What is your breach-notification process and timeline?
- Where is our data hosted and who else can access it?
Security teams are welcome to review our documentation as part of evaluation. Talk to us about your security requirements.