Plain-language help for ordinary people. General information, not legal advice. Helplines, portals and screen names were checked against official Government and regulator pages on 1 November 2026. Portals change: if a screen looks different, follow the words on the screen and the official guide linked in each step.
Many apps connect you to someone else: a car host, a driver, a delivery partner, a hotel, a seller, an agent. To make that work, the platform passes some of your data to them. When that person leaks or misuses it, who answers to you? The same pattern applies across all of them.
Your rights
- Right to know what was shared and with whom. Ask the platform in writing now. From 13 May 2027 it is a legal right (DPDP section 11).
- Right to have the platform answer for people acting on its behalf. From 13 May 2027 a Data Fiduciary is responsible for processing done by it or by a processor on its behalf (section 8(1)), and may use a processor only under a valid contract (section 8(2)).
- Right to a grievance officer with deadlines. E-commerce platforms: acknowledge in 48 hours, resolve in one month (E-Commerce Rules, rule 4(4) and 4(5)). Ride apps: also a Grievance Officer and 24x7 call centre (Aggregator Guidelines, 2025).
- Right to compensation for deficiency in service before a Consumer Commission, and under IT Act section 43A for negligence with sensitive data until 13 May 2027.
- Right to police help against the person who misused your data: IT Act section 72A, section 66C, BNS section 78 (stalking).
How to fight it, step by step
- Save the evidence before you block or delete anything.
What to write: A short note with the date, time, number used, and exactly what was said or what details they knew.
What to attach: Screenshots of the call log, SMS, WhatsApp chats (with the number visible), and any payment screen.
What you get back: A record that cannot later be denied.
How long to wait: Do this the same day. - Open the booking in the app and use its help or support option. Menu names differ by app.
What to write: Booking ID and what the host did. Ask the platform to stop the host contacting you and to suspend the listing while it investigates.
What to attach: Screenshots.
What you get back: A ticket number.
How long to wait: 48 hours for acknowledgement. - Write to the platform's grievance officer.
What to write: Letter 2 below, including questions 6 and 7 about what the host received.
What to attach: Ticket number and evidence.
What you get back: Acknowledgement in 48 hours.
How long to wait: One month. - Send one written follow up to the grievance officer.
What to write: Your complaint number, the date you complained, and: "I have had no reply (or an incomplete reply). Please reply in writing within 7 days, or I will escalate to the National Consumer Helpline, the Consumer Commission and the police."
What to attach: Your first complaint and its acknowledgement.
What you get back: Proof that you gave the company a fair chance. Regulators and Commissions ask for this.
How long to wait: 7 days, then go to the next step. - File a police complaint, or ask for an FIR.
What to write: A signed complaint to the officer in charge of your local police station, or online at cybercrime.gov.in. Say what happened, when, the numbers used, and that the host misused your documents or keeps contacting you (IT Act sections 72A and 66C; BNS section 78 if a woman is being stalked).
What to attach: Printouts of your screenshots and a copy on a pen drive. Your ID proof.
What you get back: An FIR copy, or at least a written acknowledgement of your complaint. Online, you get an acknowledgement number.
How long to wait: Do this at once if you feel unsafe. Do not wait for the company. - Call the National Consumer Helpline on 1915, or file on consumerhelpline.gov.in.
What to write: The company's name, your complaint number with it, what went wrong, and what you want (for example: action against the person, written confirmation, compensation).
What to attach: Your complaint, the company's replies, and screenshots.
What you get back: A docket number. The helpline takes your complaint up with the company. It is free and comes before a court case.
How long to wait: Give it a few weeks. If nothing changes, go to the Consumer Commission. - File a consumer case for deficiency in service on e-Jagriti.
What to write: Who you are, the company, what service you used, what went wrong, the loss and distress caused, and the compensation you claim.
What to attach: Everything above: evidence, letters, replies, helpline docket.
What you get back: A case number and hearing dates. You can argue the case yourself. The District Commission hears cases where the value of what you paid is up to Rs 50 lakh, the State Commission up to Rs 2 crore, and the National Commission above that (2021 Rules).
How long to wait: File within 2 years of the problem. - If your card or bank details were mishandled and you lost money, consider a claim under IT Act section 43A before your State's IT Adjudicating Officer (until 13 May 2027).
What to write: The claim and amount.
What to attach: Everything.
What you get back: A case number.
How long to wait: Appeal within 45 days if you lose. - Get a lawyer if the stakes are high.
What to write: Nothing yet. Take your full file to the lawyer.
What to attach: All of the above.
What you get back: Advice on a legal notice, a claim before your State's IT Adjudicating Officer, or a civil suit for damages.
How long to wait: Before you send any legal notice or file a suit. This page is not legal advice.
Not legal advice. This page explains the rules in plain words so you can act. Consult a lawyer before you sue anyone or send a legal notice. Laws and portals change; check the linked official source.
Who is responsible: the platform, the third party, or both?
- Data Fiduciary: whoever, alone or with others, decides why and how your data is processed (DPDP section 2(i)). The platform that collects your ID and decides who sees it is usually one.
- Data Processor: whoever processes data on behalf of a fiduciary (section 2(k)). A host or partner that only uses your data to deliver the platform's service, on the platform's rules, acts on its behalf. Our reading, not a ruling.
- Independent fiduciary: a third party that uses your data for its own ends (its own marketing, its own records) decides its own purpose, so it can be a fiduciary itself and answer to you directly. Swiggy's policy, for example, says restaurants may use your information under their own privacy policies.
- Both can be liable. The platform for choosing and controlling the partner and for its own security; the partner personally for crimes.
- Until 13 May 2027: IT Act section 43A covers negligence with sensitive data (cards, bank details, health, biometrics). Consumer law covers deficiency in service by the platform. The E-Commerce Rules set grievance duties for e-commerce entities.
- Contract terms: a platform calling itself 'merely a facilitator' in its terms does not remove its duties under consumer law or, from 2027, the DPDP Act. Consult a lawyer for your case.
Similar across all: what each platform says it shares, and who answers
Each entry in the middle column quotes or summarises the company's own policy page, checked on 1 November 2026. It is their description, not ours.
| Platform | Third party | What the platform says it shares | Who answers for a leak |
|---|---|---|---|
| Self-drive car rentals (Zoomcar) | Private car hosts | Says it may give hosts information needed for a stolen car or insurance claim, repossession or legal action, and that businesses processing data for it must follow its instructions. Source | The platform (consumer law now; DPDP section 8(1) from 2027). The host personally for crimes. |
| Ride apps (Uber) | Drivers | Says it anonymises rider and driver contact details and does not share them without prior consent. Source | The platform (Aggregator Guidelines, consumer law; DPDP from 2027). The driver personally for stalking or threats. |
| Food and grocery delivery (Swiggy) | Restaurants, merchants, delivery partners | Says it gives your information to the restaurant or merchant you order from, which may use it under its own privacy policy, and shares with delivery partners and other service providers. Source | The platform for its processors. A restaurant that uses your data for its own purposes answers for that itself. |
| Hotels (OYO) | Hotel and property owners | Says it shares information such as your name and expected check-in time with accommodation managers. Its partner terms say guest data is shared with the property only for the agreement. Source | The platform, and the property for what it collects at check-in. |
| Home stays (Airbnb) | Hosts | Says that once a booking is confirmed, information such as your profile photo and phone number is shared with the host. Source | The platform, and the host for misuse of what it received. |
| Property portals (NoBroker) | Owners, tenants, partner service providers | Says it shares names or other personal information a partner needs to provide a service you sign up for, and its contracts restrict other use. Source | The portal for its partners; the other party personally for misuse. |
| Home services (Urban Company) | Service professionals | Says it shares personal data with service professionals so they can provide the service, and does not allow its service providers to use your data for their own purposes. Source | The platform for its professionals and vendors. |
| Insurance marketplaces (Policybazaar) | Insurance companies (business partners) | Says information is shared with authorised business partners for policy solicitation, servicing and claims. Source | The broker and the insurer, under IRDAI's 2024 Policyholders' Interests Regulations. |
| Loan marketplaces and DSAs | Banks, NBFCs, DSAs, recovery agents | RBI's rules, not only the company's policy, apply here: the bank stays responsible for its DSAs and recovery agents and for the confidentiality of the data they hold. Source | The regulated lender, under RBI's rules; RBI Ombudsman for complaints. |
| Healthcare aggregators | Doctors, clinics, labs, pharmacies | We have not checked a specific company's sharing clause. Health data is sensitive personal data under the SPDI Rules, and disclosure needs prior permission. Source | The platform and the clinic or lab that held the data. |
Related situations
- A self-drive car rental host has my licence, ID and number, and is misusing them You rented on a platform like Zoomcar where the car belongs to a private host, and the host now contacts you or misuses your documents.
- A ride app driver keeps calling and texting me from different numbers after the ride After a trip, the driver sends messages like 'Hi' or 'call me' on SMS or WhatsApp, from more than one number.
- A delivery person or courier kept my number and is contacting me A delivery person messages or calls you after delivery, or a 'courier' calls about a parcel.
- A seller from a shopping app contacted me on WhatsApp or by phone After an order, a seller messages you directly, to sell, ask for reviews, or offer refunds outside the app.
- An insurance agent knows my policy details and keeps calling An agent or 'advisor' knows your policy, sum assured or renewal date.
- A loan app or recovery agent is calling my relatives and friends A recovery agent calls your family, friends or contacts, or threatens you.
- A caller from a personal number knew all my bank details: genuine bank staff or fraud? Someone said they were from your bank or its agent, called from a personal mobile, and knew your details.
From 13 May 2027
From 13 May 2027 the DPDP Act's duties apply. The company is responsible for processing done by it or by anyone processing on its behalf (section 8(1)), may use a processor only under a valid contract (section 8(2)), must protect your data with reasonable security safeguards (section 8(5)), and must tell you and the Board about a breach (section 8(6)). It may use your data only for the lawful purpose you agreed to (sections 4 to 6). Section 44(2) removes IT Act section 43A from that date. Complain to the company first; if it does not resolve it, complain to the Data Protection Board. The Board can impose penalties up to Rs 250 crore, but penalties go to the Government (the Consolidated Fund of India, section 34), not to you. For money, use the ombudsman or the Consumer Commission. Appeals from the Board go to TDSAT within 60 days (section 29).
Sources
- Digital Personal Data Protection Act, 2023 (MeitY copy of the Gazette)
- National Consumer Helpline FAQ: Consumer Protection (E-Commerce) Rules, 2020
- Ministry of Road Transport and Highways: Motor Vehicle Aggregator Guidelines, 2025
- IT Act section 43A: compensation for failure to protect data (India Code)
- IT (Reasonable Security Practices and Sensitive Personal Data) Rules, 2011 (India Code)
- Bharatiya Nyaya Sanhita, 2023, section 78: stalking (India Code)
- Information Technology Act, 2000, updated text (India Code)
- Zoomcar guest policy: Registering and creating your account (company page)
- Uber India: rider customer support and call anonymisation (company page)
- Swiggy privacy policy (company page)
- OYO privacy policy (company page)
- Airbnb: how personal information is shared between Guests and Hosts (company page)
- NoBroker privacy policy (company page)
- Urban Company privacy policy (company page)
- Policybazaar privacy policy (company page)
- RBI (Commercial Banks: Managing Risks in Outsourcing) Directions, 2025 (28 November 2025)
- Zoomcar guest policy: Information Sharing (company page)
- Zoomcar Host: platform terms of use (company page)
- OYO partner terms of service, clause 13 (company page)