DPDP compliance for logistics and supply chain companies
Logistics companies handle delivery addresses, real-time location data, and employee records at scale. Here is how the DPDP Act applies across your operations.
What personal data do logistics and delivery companies process under DPDP?
The personal data footprint of a logistics company is larger than many realise. On the customer side: full names, delivery addresses, phone numbers, email, payment data, and delivery preferences. On the delivery-partner side: name, contact details, vehicle information, real-time GPS location, earnings, ratings, and performance data. In the warehouse: employee identity, biometric attendance, health and safety records. And across vendors and partners: contact persons' names and emails. Every one of these is personal data under the Act, and every processing activity needs a lawful basis.
Is real-time GPS tracking of delivery partners permitted under DPDP?
Real-time location tracking of delivery partners is one of the most sensitive data types in the logistics sector. It reveals movement patterns, working hours, home locations, and personal habits. The Act requires that processing of location data be clearly disclosed in your privacy notice and that you collect only the minimum data needed for the operational purpose. Continuous 24/7 tracking of delivery partners, including when they are off-duty, is likely to be disproportionate — design location tracking to be active only during work assignments.
What lawful basis do logistics companies need for processing driver and customer data?
For customers: consent is the natural lawful basis for processing delivery data, and contract performance covers the data needed to execute the delivery. For delivery partners: you have a mix of contract performance (the delivery assignment) and statutory compliance (tax, EPF), but any monitoring beyond what is needed for the assignment needs its own lawful basis. For employees: employment contract and statutory obligations cover most processing, but biometric attendance and health monitoring need explicit consent or statutory justification.
How long can logistics companies retain delivery and location data under DPDP?
Logistics companies accumulate delivery records, location histories, and customer data rapidly. You need a retention schedule that distinguishes: data needed for active operations; data retained for dispute resolution (typically 30–90 days); data retained for statutory purposes (tax records for 7 years); and data that should simply be deleted. Location histories of delivery partners are particularly sensitive — retaining them indefinitely serves no operational purpose and creates unnecessary risk.
What does DPDP say about monitoring and rating delivery partners?
Delivery partner monitoring — tracking, rating systems, algorithmic work allocation — is a form of automated decision-making that directly affects livelihoods. The DPDP Act gives individuals the right to access the personal data held about them. A delivery partner has the right to know what data you hold, how their performance rating is calculated, and to dispute incorrect data. Build a mechanism for delivery partners to exercise these rights, and ensure your rating and allocation algorithms use accurate, correctable data.
Does DPDP apply to vendor and supplier contact data in logistics?
Logistics companies also process data about individuals at vendor and client organisations — procurement contacts, operations managers, billing contacts. While B2B data is often assumed to be outside DPDP scope, any individually identifiable information about a natural person — including a business contact — is personal data under the Act. Ensure your vendor management systems and email lists are covered by your privacy notice and have a valid lawful basis.
Frequently asked questions
Do I need consent to track my delivery partners' location during a delivery?
Location tracking during an assigned delivery is covered by the contract performance lawful basis — you need to know where the delivery is to manage the assignment. You do not strictly need separate consent for this. However, tracking outside working hours, or for purposes beyond managing the delivery assignment, requires an additional lawful basis, and delivery partners must be clearly informed of what is tracked in your privacy notice.
How do I handle a customer's request to delete their delivery address?
You can delete delivery addresses from your marketing database on request. However, if you have a statutory obligation to retain records of a completed transaction — for example, for GST compliance — the address in the invoice record can be retained for the statutory period. What you should not do is retain a delivery address in your marketing database or analytics system beyond the customer's consent period.
We use a third-party courier for last-mile delivery. Are we responsible for their data practices?
Yes. When you share customer personal data with a last-mile delivery partner, that partner is a Data Processor and you remain responsible as the Data Fiduciary. You must have a Data Processing Agreement with the courier covering what they can do with the data, prohibiting onward sharing, requiring deletion on completion, and mandating breach notification. Due diligence on your delivery partners' data practices is part of your DPDP obligation.
Assess your logistics DPDP readiness
Niti Bharat's DPDP Readiness Assessment covers location data, delivery partner rights, employee monitoring, and vendor DPAs — the specific issues logistics companies face.
Start DPDP Readiness Assessment