DPDP Compliance for Zomato, Swiggy & Delivery Apps

DPDP Compliance for Zomato, Swiggy & Delivery Apps

Delivery apps like Zomato, Swiggy, Dunzo, and Zepto handle vast amounts of personal data daily. This includes customer names, addresses, payment information, order history, live location, and even dietary preferences. The Digital Personal Data Protection Act (DPDP Act) directly impacts how these companies collect, process, and store this data.

Sushant Pasumarty, founder of Meridian Bridge Strategy, has worked with numerous tech companies to establish robust data governance frameworks. The DPDP Act introduces specific obligations that require a structured approach to compliance, especially for businesses with high data volumes and frequent data subject interactions.

Are Zomato, Swiggy, and other delivery apps required to comply with DPDP?

Yes, absolutely. Any entity processing personal data in India must comply with the DPDP Act. Delivery apps collect and process extensive personal data from millions of users, delivery partners, and restaurant partners. This places them firmly under the Act's purview.

For instance, collecting a user's address for delivery is processing personal data. Storing their past orders to recommend new restaurants is also processing. Each interaction requires a lawful basis and adherence to data protection principles.

What is the current enforcement reality for delivery apps?

While the DPDP Act has been notified, the specific implementation rules are still being finalised. However, companies should not wait for full enforcement to begin their compliance journey. The India government's intent is clear: strict data protection is a priority.

The penalties for non-compliance are significant, ranging up to ₹250 crore. Proactive compliance demonstrates good faith and mitigates future risks. Early adopters will have a competitive advantage and build greater trust with their user base.

What should delivery apps do for DPDP compliance?

Here are the key steps delivery apps must undertake:

1. Identify and Map All Personal Data Flows: Understand every piece of personal data collected, where it comes from, where it goes, who has access, and for how long it's stored. This includes data from customers, delivery partners, and employees.
2. Establish Lawful Basis for Processing: For every data processing activity, determine the specific lawful basis (e.g., consent, legitimate interests, legal obligation). Consent mechanisms, especially for sensitive data like dietary preferences, need to be explicit and easily withdrawable.
3. Implement Robust Security Measures: Protect personal data from breaches, unauthorised access, and misuse. This involves technical and organisational measures like encryption, access controls, and regular security audits.
4. Ensure Data Principal Rights: Establish processes for users to access, correct, erase, or port their data. Delivery apps must have clear channels for users to exercise these rights effectively within specified timeframes.
5. Conduct Data Protection Impact Assessments (DPIAs): For high-risk processing activities, such as profiling customers or using AI for recommendations, conduct DPIAs to identify and mitigate risks to data principals.
6. Update Privacy Policies and Terms of Service: Clearly communicate data practices in simple, understandable language. Users must be informed about what data is collected, why, and their rights concerning that data.
7. Train Employees and Partners: Educate all personnel, including delivery partners, on DPDP requirements and their responsibilities in handling personal data. Data security is a collective effort.

What is the cost of DPDP compliance for a delivery app?

The cost varies based on the size and complexity of your data operations. Meridian Bridge Strategy (MBS) offers productised services tailored to different stages of compliance. Below are the estimated costs and durations:

These ranges reflect the effort required for a typical delivery app, from identifying data sources to implementing solutions. For a comprehensive engagement, the 'Full DPDP Consulting' option provides end-to-end support.

When should delivery apps start their DPDP compliance journey?

The best time to start was yesterday. The next best time is now. Delaying compliance increases risk and makes the process more complex and costly down the line.

While specific rules are pending, the core principles of data protection are clear. Proactive steps taken today will position your delivery app favorably when full enforcement commences. Sushant Pasumarty advises establishing a foundational compliance program immediately.

What is the next step for my delivery app?

Start with a clear understanding of your current data landscape. Consider MBS's Data Mapping or DPDP Readiness Audit services. This provides a baseline and identifies immediate areas for improvement.

Contact us to discuss which MBS service best fits your delivery app's needs. We offer tailored guidance to ensure your compliance journey is smooth and effective.