A self-drive car rental host has my licence, ID and number, and is misusing them

Plain-language help for ordinary people. General information, not legal advice. Helplines, portals and screen names were checked against official Government and regulator pages on 1 November 2026. Portals change: if a screen looks different, follow the words on the screen and the official guide linked in each step.

Self-drive rental platforms ask for your driving licence, a Government ID, a selfie and your phone number, and track the car's GPS location. On host based platforms many cars belong to private owners (hosts). After the trip, the host keeps calling, shares your documents, or uses your number for other things. Who is responsible, and what can you do?

Safety first. Threatened or in danger: call 181 (women) or go to the nearest police station. Lost money: call 1930 at once.

Related situations covered on this page

• After booking, an unknown person called asking personal questions. A single reported case. Ask the platform in writing who received your number for that booking.

Not legal advice. This page explains the rules in plain words so you can act. Consult a lawyer before you sue anyone or send a legal notice. Laws and portals change; check the linked official source.

Step 1: stay safe and find out who it is

1. Check the booking in the app: host name, car and dates.
2. Confirm the person contacting you is that host.
3. Do not send more documents outside the app.

If it is genuine: hold the company accountable

What the company says, in its own words

"Zoomcar is merely a facilitator between Hosts and guests and does not sell, hire, manage, and/or control the vehicle."

"ZOOMCAR only shares Personal Information with third parties in the following limited circumstances: i) To provide other businesses or persons for the purpose of processing personal information on our behalf. We require that these parties agree to process such information based on Our instructions and in compliance with this Policy and any other appropriate confidentiality and security measures."

"Zoomcar may provide any information necessary to the Hosts, insurance companies, or law enforcement authorities to assist in the filing of a stolen car claim, insurance claim, vehicle repossession, or legal action."

"Your location information will be confined to ZOOMCAR'S service, and we endeavour not to make your location or movements' public unless it is required under personal, medical and legal (recovery and insurance) exigencies."

These are the company's own words from its policy pages, checked on 1 November 2026. A company's terms cannot take away your rights under the law. The policy text we read does not describe everyday sharing of your ID documents with hosts beyond the clauses above, so ask the platform in writing exactly what the host received. We could not open Revv's privacy policy on that date, so we do not quote it.

Which rules this may break

• E-Commerce Rules, 2020, rule 4(4) and 4(5): the platform's grievance duties.
• Consumer Protection Act, 2019: deficiency in service. A platform's own terms cannot take away your rights under the law.
• SPDI Rules, 2011: financial details are sensitive; disclosure to a third party needs prior permission (rule 6). IT Act section 43A until 13 May 2027.
• DPDP Act from 13 May 2027: a Data Fiduciary is whoever decides why and how your data is processed (section 2(i)); a Data Processor processes it on a fiduciary's behalf (section 2(k)). Our reading, not a ruling: where the host only uses your data to hand over the car under the platform's rules, the host acts on the platform's behalf; where the host uses it for its own ends, the host may be a separate fiduciary, and answerable to you directly.
• IT Act section 72A and BNS section 78 if the host misuses your details or stalks you.

Who is liable

• The platform: collected your documents, chose the host and decides what the host sees. It answers to you under consumer law now and, from 13 May 2027, under DPDP section 8(1) for processing on its behalf.
• The host: personally liable for crimes such as disclosure in breach of contract (IT Act section 72A), identity misuse (66C) or stalking (BNS section 78).

What the company must do, and by when

• Acknowledge in 48 hours and resolve in one month.
• Tell you what it shared with the host and why.
• Tell the host to delete your documents, and confirm it.
• Suspend the host's listing while it investigates misuse.
• From 13 May 2027: answer for the host under section 8(1).

Letter 1: ask them to confirm who the caller is

Send it through the official channel. Keep a copy and the acknowledgement.

To: The Grievance Officer, [Platform name]
Subject: Please confirm whether this person works for you

Dear Sir or Madam,

I am your customer. My booking ID: [number].

On [date] at [time] I received a call or message from [phone number]. This is not an official number. The person said they were [name], [role or employee ID], from the platform. They knew my [list the details they knew].

Please confirm in writing within 7 days:
1. Whether this person is your employee, agent, host, owner, partner or partner.
2. If yes, their name, role and the agency they work for.
3. Whether you allow staff or agents to contact customers from personal numbers.
4. If they are not connected with you, please say so, so I can report the number.

Name:
Registered mobile number:
Date:

Letter 2: ask how your data got there

To: The Grievance Officer, [Platform name]
Subject: How did my personal data reach a personal phone? Complaint number [if any]

Dear Sir or Madam,

On [date] a person connected with you, [name if known], contacted me from a personal number [number] and knew my [details]. [Describe what they did.]

Please tell me in writing:
1. What personal data about me this person could see, and through which system or app.
2. Whether you shared my data with any agency, host, owner, partner, partner or processor, and their names.
3. How my data reached a personal phone or account outside your official systems.
4. What action you have taken against the person or agency, including suspension while you investigate.
5. What you have done to stop this happening again.
6. Exactly which of my documents and details you shared with the host, when, and under which term.
7. Whether the host may keep copies, and for how long.
Under the Consumer Protection (E-Commerce) Rules, 2020 the platform must have a grievance officer who acknowledges a complaint within 48 hours and resolves it within one month (rule 4(4) and 4(5)). Card and bank details are sensitive personal data under the SPDI Rules, 2011.

From 13 May 2027, sections 8 and 11 of the Digital Personal Data Protection Act, 2023 also apply.

Please reply within one month (acknowledgement within 48 hours). If I do not hear from you, I will escalate to the National Consumer Helpline and the Consumer Commission.

Name:
Registered mobile number:
Date:

Evidence to keep

• Booking ID, host name, car number, dates.
• Screenshots of calls and messages from the host.
• Proof of any misuse of your documents (for example, your licence photo sent to someone else).
• The platform's replies.

More in the evidence checklist.

Can you sue? What realistically happens

• Consumer Commission: the most practical route for compensation. Cheap, no lawyer needed, file within 2 years.
• IT Act section 43A (until 13 May 2027): if the company was negligent with sensitive personal data (passwords, bank or card details, health records, biometrics) and that caused wrongful loss or gain, it must pay compensation. Claims up to Rs 5 crore go to your State's IT Secretary acting as Adjudicating Officer (section 46); larger claims go to a court. Appeal within 45 days (section 57). Your phone number and address alone are not sensitive data under the 2011 Rules.
• Civil suit for damages: possible, but slow and costly. Section 61 of the IT Act bars civil courts from matters the Adjudicating Officer can decide.
• Police: only where there is a crime, for example a person who disclosed your information in breach of a contract to cause wrongful loss or gain (IT Act section 72A, up to 3 years), identity theft (66C), cheating by impersonation (66D), stalking or threats.
• Realistic outcome: most people get results from a firm written complaint and the regulator or ombudsman. Courts take years. Consult a lawyer before suing.

From 13 May 2027: the Data Protection Board

From 13 May 2027 the DPDP Act's duties apply. The company is responsible for processing done by it or by anyone processing on its behalf (section 8(1)), may use a processor only under a valid contract (section 8(2)), must protect your data with reasonable security safeguards (section 8(5)), and must tell you and the Board about a breach (section 8(6)). It may use your data only for the lawful purpose you agreed to (sections 4 to 6). Section 44(2) removes IT Act section 43A from that date. Complain to the company first; if it does not resolve it, complain to the Data Protection Board. The Board can impose penalties up to Rs 250 crore, but penalties go to the Government (the Consolidated Fund of India, section 34), not to you. For money, use the ombudsman or the Consumer Commission. Appeals from the Board go to TDSAT within 60 days (section 29).

If it is fake: urgent steps

1. If someone claiming to be a host asks for money or an OTP outside the app, it may be fraud.
2. Call 1930 if money was lost.
3. Report the number on Chakshu.

Step by step guides:

Related guides

• Travel: airlines, trains, hotels and booking sites Bookings, ID copies at hotels, Digi Yatra, fake helplines and complaints.
• E-commerce and quick commerce apps Online shopping and 10 minute delivery apps: orders, returns, fake calls and your data.

See also when a platform shares your data with a third party and the escalation ladder.

Official sources

Checked on 1 November 2026. Company pages are labelled as the company's own words.

• Zoomcar guest policy: Information Sharing (company page)
• Zoomcar guest policy: Collection, Storage and Use of Personal Information (company page)
• Zoomcar guest policy: Registering and creating your account (company page)
• Zoomcar Host: platform terms of use (company page)
• National Consumer Helpline FAQ: Consumer Protection (E-Commerce) Rules, 2020
• IT (Reasonable Security Practices and Sensitive Personal Data) Rules, 2011 (India Code)
• IT Act section 43A: compensation for failure to protect data (India Code)
• Digital Personal Data Protection Act, 2023 (MeitY copy of the Gazette)
• National Consumer Helpline (Department of Consumer Affairs)
• e-Jagriti: file a case before a Consumer Commission