The regulator also directed Grab to put in place a data protection by design policy.