DPDP Act for Logistics, Manufacturing & Gig-Work Platforms
Logistics companies, warehouses, manufacturers, delivery platforms and gig-work marketplaces hold two kinds of personal data at scale: customers' names, addresses and phone numbers, and the identity, location and performance data of the workers who move the goods. The Act applies to both.
Supply chains split data across shippers, carriers, marketplaces, 3PLs and subcontractors, so mapping roles is the first job. For workers, tracking and monitoring must stay tied to a stated purpose, and algorithmic ratings need accuracy and fairness safeguards. Customer addresses and phone numbers need protection end to end, including at the doorstep. Most duties take effect on 13 May 2027.
Who this covers
Courier, express and freight companies are Data Fiduciaries for consignee and shipper data, and for their staff and riders.
Warehousing and 3PL providers are often processors for the brands they serve, and fiduciaries for their own workers.
Manufacturers and industrial firms hold employee, contractor, supplier-contact and visitor data, and sometimes customer data.
Gig and delivery platforms are fiduciaries for customers, merchants and gig workers.
Fleet, telematics and route-optimisation vendors are usually Data Processors.
Personal data you are likely to hold
Key provisions for Logistics, Manufacturing & Gig Platforms
The parts of the Act and Rules that matter most here. Select a reference to read the full explanation.
Data voluntarily provided for a delivery, and employment-related processing, are legitimate uses for those purposes.
Itemised notice, and consent for optional uses such as marketing and monitoring beyond the job.
Accuracy where data drives decisions, security, breach intimation, erasure and processor contracts.
Large platforms could be notified as Significant Data Fiduciaries.
A grievance route for customers, riders and workers.
Children's data rules apply to any under-18 data.
Penalties up to ₹250 crore for security failures.
01Roles across the supply chain
One parcel can touch a brand, a marketplace, a 3PL, a line-haul carrier, a last-mile partner and a delivery rider. For each hand-off, decide who determines the purpose. A carrier delivering a parcel on a brand's instructions acts for the brand. A marketplace that uses delivery data to build advertising profiles decides its own purpose.
Section 8 requires a written contract whenever a fiduciary uses a processor, and the fiduciary stays responsible. Put purpose limits, security, sub-processor rules, breach notice and deletion into carrier, 3PL and subcontractor agreements.
02Customer addresses, phone numbers and proof of delivery
Delivery data is exposed at many points: shipping labels, rider apps, call centres and tracking pages. Reduce what is printed or shown, mask phone numbers in rider-customer calls, limit how long rider apps keep customer details, and avoid showing full addresses to anyone who does not need them.
Proof-of-delivery photos and OTPs are personal data. Use them for confirming delivery and resolving disputes, keep them for a set period and delete them. Do not reuse them for other purposes.
03Drivers, riders and workers
Gig workers, drivers and warehouse staff are Data Principals. For employees, Section 7 allows processing for employment purposes. For gig workers who are not employees, rely on data they voluntarily provide for onboarding and payouts, and on consent for optional uses.
- Tracking. Track location only while a worker is on a job, tell them, and do not keep detailed histories without a reason.
- Biometrics and cameras. Use the least intrusive method that works and secure the data. Aadhaar authentication has its own legal limits.
- Ratings and algorithms. Section 8 requires accuracy where data is used to make decisions about a person. Give workers a way to question ratings and deactivations. Significant Data Fiduciaries must also check algorithms do not put rights at risk (Rule 13).
- Payouts and documents. Protect bank details and identity documents with strong access control.
04Manufacturing, plants and visitors
Manufacturers hold employee and contractor records, contract-labour data, visitor logs, safety and incident reports, and CCTV. Apply the same discipline as any employer: a notice, purpose limits, retention periods and secure systems. Contract-labour vendors and staffing agencies handle workers' data for you, so use written contracts. Safety and statutory records have legal retention periods that continue to apply.
05Security, telematics and breaches
Fleet trackers, handheld scanners, rider apps and warehouse systems are all entry points. Apply the Rule 6 baseline and keep processing logs for at least one year (Rule 8). A breach means telling affected customers, workers and the Board, with a detailed report within 72 hours (Rule 7).
Penalties
The Data Protection Board decides actual penalties after an inquiry. These are the maximum amounts in the Schedule to the Act and apply to every Data Fiduciary, whatever the sector.
A breach of a voluntary undertaking accepted by the Board carries the penalty applicable to the matter the undertaking covered.
Common situations
Limit retention in the app, mask numbers and show only what the delivery needs.
Make sure the data is accurate, allow the rider to challenge it and review the algorithm for errors and bias.
Document why it is needed, check for a less intrusive method, tell workers and secure the data.
The fiduciary remains responsible. Start the breach plan and review the carrier contract.
Delete what is not required by tax or commercial law, and tell the customer what is kept.
Compliance checklist
Common mistakes to avoid
Printing full personal details on labels that anyone can read.
Tracking riders continuously when they are off duty.
Treating subcontractors as outside the privacy programme.
Deactivating workers on opaque scores with no review route.
Keeping delivery photos and OTPs indefinitely.
Common questions
Are gig workers Data Principals?
Yes. Gig workers, drivers and riders are people whose personal data you process, so notice, safeguards and rights apply.
Can we track riders' location?
While they are working and for the stated purpose, yes, with notice. Tracking off duty or keeping long histories needs a clear reason and a proper basis.
Is a 3PL a processor?
Often, when it handles data on a brand's instructions. If it uses the data for its own purposes it is also a fiduciary for that use.
Do manufacturers have to comply?
Yes, for employee, contractor, visitor and any customer data they hold in digital form.
What about customer phone numbers on delivery apps?
Protect them: mask numbers in calls, limit retention and show them only to those who need them.
Who reports a breach when a subcontractor is at fault?
The Data Fiduciary reports to the Board and affected people. The subcontractor must tell the fiduciary promptly under the contract.