Smart cars' new crash test: Cybersecurity and customer data privacy

Transparency over customer data is becoming a core competitive advantage for brands

In the first episode of the Korean television drama When the Phone Rings, a kidnapper remotely takes control of a connected car and locks its occupant inside after hacking into the vehicle’s software. The scene is fictional but not far-fetched. Rather, it captures a growing concern around connected vehicles: What happens when a car is the target of a cyberattack? 

The question gained relevance earlier this month when electric rickshaws in Delhi were remotely shut down by manipulating their Bluetooth-enabled battery management units. 

Modern cars are “software on wheels,” offering a range of features enabled by connected platforms. These platforms are no longer just intelligent infotainment systems or digital in-vehicle experiences. A few taps on an app can switch on a car’s AC, cooling the cabin before the driver arrives — even after an hour in the sun. More taps can fetch the latest news and weather updates. 

Connected technology, artificial intelligence (AI) and machine learning (ML) enable cars to understand drivers while recording their location and behaviour. While the data helps improve cars and engines, experts worry about user privacy and the potential misuse of vehicle management software. 

As India rolls out its first data privacy and protection regime later this year, automakers will need to explain how they collect and use customer information. The scrutiny of where such data is stored and how it is processed will likely increase. 

Data consent 

Automakers across the board insist they have strict processes to protect customer data. 

Velusamy R, president of automotive business at Mahindra & Mahindra, said the company treats data privacy and cybersecurity as core to its connected-vehicle strategy. He said the company has “clear consent and data-governance processes, supported by access controls, encryption, monitoring, and incident-response mechanisms,” calling customer trust “an increasingly important industry differentiator”. 

Japanese automaker Nissan said it follows “very rigid processes” to protect customer data and complies with local regulations before rolling out connected technologies. Data is used to improve services and better understand customer behaviour, and it is retained internally, the company said. 

C S Vigneshwar, president of the Federation of Automobile Dealers Associations, however, believes that the industry needs “stronger safeguards and firewalls”. 

“If a different installation gets hacked, if huge banks are getting hacked, if nuclear installations are getting hacked, why not a car?" he said. 

Sven Patuschka, chief technology officer of Tata Motors Passenger Vehicles, believes that privacy cannot be bolted on to vehicles as an “after-the-fact” measure. 

Data governance should not be viewed merely as a compliance requirement, but customers should know what is collected, why and what they get in return, he said.  

Cybersecurity and data governance are inseparable, spanning “the vehicle, Cloud platforms, software and application layers, and the broader digital ecosystem," said Patuschka.  

Trust in data handling will soon rank alongside performance and quality as a reason Indian customers choose one brand over another, he said. 

Experts believe the full rollout of the Digital Personal Data Protection (DPDP) Act will prompt customers to demand detailed answers on privacy: How data is collected, where it goes, and whether it is shared without consent. 

Automakers will need much tighter control of the entire data lifecycle: Collection, consent, storage, sharing, retention and deletion across touchpoints that include connected vehicles, mobile apps, dealerships, service centres, financing partners and Cloud platforms, said Anurag Singh, chief executive officer of RAH Infotech. 

The DPDP framework will require “a mindset shift more than just a technology shift,” said Pratik Shah, partner at EY Parthenon.

Traditionally, connected vehicles collected as much data as possible — including location, behaviour and cabin diagnostics — before determining how to use it. The DPDP Act makes this approach unsustainable; automakers will have to justify each data category, link it to explicit consent, and purge the data once its original purpose is met. 

Shah noted that Indian automakers are early in this journey. They have historically lacked long-established privacy frameworks, partly because data privacy has sat with legal or information technology teams rather than being treated as a board-level risk.

Experts, however, downplay fears of cars being remotely hijacked, arguing that backend data exposure poses a far more realistic threat. 

The more realistic concern for Indian consumers is personal data being exposed through a breach of backend systems, Shah said. 

The “attack surface” extends beyond the vehicle itself to mobile apps, Cloud platforms, over-the-air update mechanisms, and third-party suppliers — any one of which could become a point of failure, Singh said. 

Connected safely 

Experts share one piece of advice for users: Treat your connected car’s app like a banking app. That means understanding permissions, keeping software updated, and avoiding untrusted third-party apps or accessories. 

As AI and ML reshape daily life, they are rapidly transforming the future of driving. In this new era, experts believe data privacy and cybersecurity will become the next major battleground for automakers. 

Cyber safety of connected vehicle platforms would be akin to crash safety tests and their rankings. It will no longer be an invisible baseline that customers don’t examine line by line, but something they will expect as standard, and they will punish companies for lacking it, Singh said. 

Brands that are transparent, let customers control their data, and respond promptly when incidents occur will build a trust advantage that price and features cannot buy, Shah said. 

Is the automotive industry prepared to handle customer data once the DPDP framework becomes effective? There are uneven pockets of maturity among large, export-oriented manufacturers, and a longer runway for "awareness-building" among smaller, domestic-focused players, according to Shah. 

Across the industry, consensus is clear: The era of unchecked data collection is ending. A carmaker’s transparency regarding where customer data lives and who accesses it is now just as vital to buyers as the vehicle’s performance. 

Driving safe 

• Backend data breaches pose higher risk to connected vehicles than remote physical hijacking, say experts
• Drivers should manage connected car apps with the same strict security caution as banking apps
• They should understand permissions, keep software updated, avoid untrusted third-party apps
• Automakers must embed cybersecurity directly into vehicle design