- Home
- Industries
- DPDP for logistics
Industry
DPDP for logistics
A parcel label carries a name, phone number and address. A rider's app streams live location all day. Both are personal data under DPDP.
Short answer
Customer addresses, phone numbers, proof-of-delivery photos and riders' live location are all personal data under DPDP. A logistics company that delivers for a merchant on its instructions usually acts as a Data Processor (s.8(2)), but it is the Data Fiduciary for its own riders, employees and direct customers. Security safeguards (Rule 6), breach intimation (Rule 7) and erasure when the purpose ends (s.8(7)) apply from 13 May 2027.
Where personal data sits in logistics
- Shipments: names, phone numbers, addresses, PIN codes and delivery instructions.
- Live tracking: rider location shared with customers, and customer location for pickups.
- Proof of delivery: doorstep photos, signatures, OTP confirmations and recipient names.
- Riders and drivers: driving licence, vehicle registration, Aadhaar, bank details, location history and ratings.
- Hubs and dark stores: CCTV, staff attendance and printed manifests.
- Contact centre: call recordings and complaints.
- Partners: last-mile fleets, aggregators, franchise hubs, and the merchants who send you orders.
Location history is the most revealing item here. A rider's pings show where she starts and ends each day; a customer's pickup pins show home and work. Keep it only as long as its purpose needs.
DPDP duties that bite hardest
| Duty | Section or rule | What it means in this sector |
|---|---|---|
| Purpose limits | s.6, s.8(7) | An address given for a delivery serves that delivery. Reusing it for marketing or analytics products needs its own ground. |
| Live location | s.4, s.7(i), s.6 | Tracking employee riders for work may fall under s.7(i). Gig partners may not be employees, so check the ground with counsel. Customers need a purpose they understand. |
| Security safeguards | s.8(5), Rule 6 | Rule 6 lists masking as a safeguard: mask customer phone numbers from riders, control access to manifests, and keep logs for a year. |
| Notice in your own apps | s.5, Rule 3 | Where you are the fiduciary and rely on consent, the notice lists location, phone and address data and why you collect each, with links to withdraw consent and complain to the Board. |
| Rights requests | Rule 14 | Publish how to make requests for data you control. When you act as a merchant's processor, route requests to the merchant, which answers them. |
| Proof-of-delivery retention | s.8(7) | Keep photos and signatures as long as disputes or a law need them, then erase. |
| Processor contracts | s.8(2) | Franchise hubs and fleet partners handling data for you need valid contracts with security terms. |
| Breach intimation | Rule 7 | A leaked manifest is a personal data breach. Intimate affected people and the Board without delay, or tell the merchant fast if you are its processor. |
Roles: fiduciary or processor
For B2B deliveries, the merchant usually decides why customer data is collected, so it is the fiduciary and you are its processor. For your own consumer app, riders and staff, you are the fiduciary.
Watch for drift. If you start using merchants' customer addresses for your own marketing or analytics, you decide a new purpose and become a fiduciary for that use. The processor contracts guide covers what merchants will ask you to sign.
s.7(i) is a legitimate use for employment purposes. Whether it covers delivery partners engaged on a gig basis depends on the relationship. Settle the ground for their location and ratings data with counsel, and record it.
A 90-day starting plan
- 01Days 1 to 30: map the flow
Trace shipment data from merchant to hub to rider to proof of delivery, and list every partner that sees it.
- 02Days 31 to 60: minimise and mask
Mask customer phone numbers, limit what riders can see after delivery, and set retention for photos and location history.
- 03Days 61 to 90: contracts and response
Sign processor contracts with merchants and partners, set a fast breach reporting path to merchants, and publish the Rule 9 contact.
How TruePrivacy helps
- Classification detects addresses and PIN codes, Indian mobile numbers, driving licence and vehicle registration numbers, and Aadhaar, with masked samples.
- Data security posture flags open links and outside domains on buckets that hold proof-of-delivery photos, with a remediation flow.
- Retention rules expire photos and location history after N days from a date field, with an executions log.
- Vendors and processors tracks fleet and hub partners, and breach management records incidents and runs the Rule 7 clocks where you are the fiduciary.
Is a delivery address personal data?
Yes. Personal data is any data about an individual who is identifiable by or in relation to it (s.2), and an address with a name identifies a person.
Can we track riders' live location?
You need a lawful ground and a clear purpose. For employees, s.7(i) may cover it; for gig partners, check with counsel. Limit tracking to working time.
How long can we keep proof-of-delivery photos?
As long as the purpose, such as handling disputes, needs them, or a law requires. Then erase them (s.8(7)).
Are we the merchant's processor?
Usually, for data you handle to deliver its orders on its instructions. You are a fiduciary for any use you decide yourself.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin