Company: ZCARW
Filing Date: 2025-05-12
Form Type: S-1/A
Source: 0001213900-25-041769
Chunk: 87

Company: Zoomcar Holdings, Inc.
Filing Date: 2025-05-12
Form: S-1/A
Chunk 87
---
 different periods, may result in materially different financial results, and may require that we change how we process, analyze, and report financial information and our financial reporting controls. We are subject to privacy laws and regulations, and compliance with these laws and regulations could impose significant compliance burdens. The regulatory framework for privacy issues worldwide is currently in flux and is likely to remain so for the foreseeable future. Practices regarding the collection, use, storage, transmission and security of personal information by companies operating over the internet have recently come under increased public scrutiny. The European Union’s privacy and data security regulation, the General Data Protection Regulation (“GDPR”), that went into effect in May 2018, requires companies to implement and remain compliant with regulations regarding the handling of personal data, including its use, protection and the ability of persons whose data is stored to correct or delete such data about themselves. Other countries in Asia, Europe and Latin America have passed or are considering similar privacy regulations, resulting in additional compliance burdens and uncertainty as to how some of these laws will be interpreted. 44 We receive, collect and store a large volume of personally identifiable data by processing car sharing transactions on our platform. This data is increasingly subject to legislation and regulations in numerous jurisdictions around the world. For example, the Indian Information Technology Act, 2000, as amended, would subject us to civil liability to compensate for wrongful loss or gain arising from any negligence by us in implementing and maintaining reasonable security practices and procedures with respect to sensitive personal data or information that we possess in our computer systems, networks, databases and software. India has also implemented privacy laws, including the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, which impose limitations and restrictions on the collection, use and disclosure of personal information. The Digital Personal Data Protection Act, 2023 has been introduced in August of 2023 which has significant impact on the current regulatory environment with respect to the lawful use of digital personal data, cross border data transfers and additional compliances that may be invoked for organizations collecting and/or processing personal data. Further, in India, the draft of Digital Personal Data Protection Rules which aims to operationalize the Digital Personal Data Protection Act, 2023 (DPDP Act), in line with India’s commitment to create a robust framework for protecting digital personal data, has been published in January 2025 for public comments. While the rules are yet to be finalized and formally adopted, the entire framework for data protection legislation is fairly new in India and going