An area often overlooked in data protection discussions is the modern automobile. Increasingly connected and data-driven, vehicles collect vast amounts of personal and behavioural data, from location tracking and driving patterns to biometric identifiers and in-car communications.

Usually thought of as private spaces, cars have been transformed by connectivity in such a way that privacy can no longer be reasonably assumed. Actions as simple as connecting a phone may pose significant data protection risks involving consent, data ownership, and data sharing with third parties such as insurers and manufacturers.

While vehicle data may seem impersonal at first, they reveal much about the individuals using the vehicle. Automobiles may collect a variety of data, including location and GPS history, steering and acceleration patterns, infotainment preferences and voice recordings. Such information falls within the definition of personal data and will be regulated by the Digital Personal Data Protection Act, 2023 (DPDPA), once in effect.