Company: ZCARW
Filing Date: 2025-11-14
Form Type: 10-Q
Source: 0001213900-25-110391
Chunk: 929

Company: Zoomcar Holdings, Inc.
Filing Date: 2025-11-14
Form: 10-Q
Item: Part II, Item 1
Chunk 929
---
 currently in flux and is likely to remain so for the foreseeable future. Practices regarding the collection,
use, storage, transmission, and security of personal information by companies operating over the internet have recently come under increased
public scrutiny. The European Union’s privacy and data security regulation, the General Data Protection Regulation (“GDPR”),
that went into effect in May 2018, requires companies to implement and remain compliant with regulations regarding the handling of personal
data, including its use, protection, and the ability of persons whose data is stored to correct or delete such data about themselves.
Other countries in Asia, Europe and Latin America have passed or are considering similar privacy regulations, resulting in additional
compliance burdens and uncertainty as to how some of these laws will be interpreted.

We receive, collect, and
store a large volume of personally identifiable data by processing car sharing transactions on our platform. This data is increasingly
subject to legislation and regulations in numerous jurisdictions around the world.

For example, the Indian Information
Technology Act, 2000, as amended, would subject us to civil liability to compensate for wrongful loss or gain arising from any negligence
by us in implementing and maintaining reasonable security practices and procedures with respect to sensitive personal data or information
that we possess in our computer systems, networks, databases, and software. India has also implemented privacy laws, including the Information
Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, which impose limitations
and restrictions on the collection, use and disclosure of personal information. The Digital Personal Data Protection Act, 2023 (“DPDPA”)
has been introduced in August of 2023 which has significant impact on the current regulatory environment with respect to the lawful use
of digital personal data, cross border data transfers and additional compliances that may be invoked for organizations collecting and/or
processing personal data.

Further, in India, the draft
of Digital Personal Data Protection Rules (“DPDP Rules”) which aims to operationalize the Digital DPDPA, in line with India’s
commitment to create a robust framework for protecting digital personal data, has been published in January 2025 for public comments.
While the DPDP Rules are yet to be finalized and formally adopted,  the entire framework for data protection legislation is fairly
new in India and going through the phases of implementation right now which may add to cost of compliances and operations for us and may
affect us in ways that we are currently unable to predict.

Any liability we