Travel & Transit Apps · Rideshare (SE Asia) · Regulatory action + Data breach
Grab
Headline
Grab shows a repeat-offender pattern rather than a single incident - its GrabCar subsidiary was fined by Singapore's regulator, and repeat penalties are a different signal from a one-off breach because they indicate…
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
Grab shows a repeat-offender pattern rather than a single incident - its GrabCar subsidiary was fined by Singapore's regulator, and repeat penalties are a different signal from a one-off breach because they indicate the fine was absorbed as a cost rather than treated as a correction. Grab is a superapp combining ride-hailing, food delivery, payments and financial services, so the profile it holds is movement plus consumption plus financial behaviour in one account. Superapps make the aggregate profile invisible by design: the user experiences separate features and the company holds one record.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass — standard binding arbitration + class action waiver expected; governed primarily by Singapore's Personal Data Protection Act (PDPA) given Grab's Singapore headquarters, rather than US consumer-protection frameworks.
Data sharing
REPEAT-OFFENDER PATTERN: Grab's ride-hailing subsidiary GrabCar was fined by Singapore's Personal Data Protection Commission for a data breach — notably the FOURTH SEPARATE privacy-related fine issued against Grab entities by Singapore regulators, though individual fine amounts have been relatively modest (e.g., SG$10,000/~US$7,300 in September 2020, over a 2019 GrabHitch update that exposed data of more than 21,500 users; the PDPC called it Grab's fourth violation in two years. Any later PDPC actions were not checked in this review). The pattern of repeated violations, rather than any single incident's severity, is the more notable finding here.
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy grab.com/sg/privacy/ | Not fetched yet | NO (HTML only) |
| Terms of service grab.com/sg/terms-of-service/ | Not fetched yet | NO (HTML only) |
| Website No URL recorded | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.