Driver and Rider Location Data: DPDP Basics for Logistics

A delivery van's GPS unit records more than where the van is. It records where its driver stopped for lunch, how fast they drove and what time they went home. A rider app knows the same about a delivery partner, plus the address of every customer they visited. Under the Digital Personal Data Protection Act, 2023 (the DPDP Act), much of that is personal data.

Location is personal data when it points to a person

The Act covers any data about an individual who can be identified by or in relation to it. A vehicle trace linked to a duty roster, a rider ID or a customer order identifies a person. Fleet data that is genuinely aggregated, such as average transit times on a route, is not personal data.

Employees and delivery partners are different cases

Employed drivers. Section 7(i) lets an employer process employee data without consent "for the purposes of employment" and to safeguard against loss or liability. Tracking a company vehicle during duty hours, for safety, routing and theft prevention, fits comfortably. Tracking the same driver's phone after their shift does not.

Delivery partners and gig drivers. Since 21 November 2025, the Code on Social Security, 2020 has defined gig work, platform work and aggregators in their own terms, outside the employment relationship. That makes the employment ground a poor fit for riders. Location tracking of partners should rest on consent, collected in the partner app with a clear statement of when tracking runs. One could argue that a partner who switches on "available for orders" is volunteering their location for that purpose under section 7(a), but that argument is untested and does not stretch to tracking after logout. In Karnataka, the Platform-Based Gig Workers Act, 2025 also requires platforms to explain how workers can obtain information about the automated systems that monitor them and allocate work (section 13).

Customers' addresses and live tracking

Customers' addresses and live order tracking are personal data too. Two practical points:

• Mask what partners see. Drivers need a delivery address and a way to call the customer. Masked phone numbers, and removing the address from the partner app after delivery, reduce what can leak.
• Treat shared links as data. A live-tracking link forwarded by a customer can show another person's location. Links should expire when the trip ends.

Tracking the law requires

Some tracking is mandatory. Rule 125H of the Central Motor Vehicles Rules, 1989 requires vehicle location tracking devices and emergency buttons on specified public service and goods vehicles.

Mandatory tracking still needs DPDP handling. Section 7(d) covers disclosures the law requires to be made to the State, which may include sending device data to a state command centre. The tracking itself still needs a ground: section 7(i) for employed drivers, consent for others. The data must be secured (section 8(5)) and used only for the purpose the law sets. Location trails collected for safety compliance should not quietly feed productivity scoring.

Keep the trail short

Section 8(7) requires erasure once the purpose is served, unless the law requires retention. Rule 6 sets a one-year minimum for security logs. Beyond those, location trails rarely need to live long. Set a documented period, for example 90 days for detailed trip traces, with aggregated statistics kept longer. Delete the rest.

Five steps for logistics and mobility businesses

• Classify who you track: employees, contracted drivers, gig partners, customers.
• Match a ground to each: section 7(i) for on-duty employees, consent for partners, and the customer's order and consent for customers.
• Switch tracking off outside duty, in both the app and the telematics platform.
• Separate safety data from performance data, and tell workers which is which.
• Set and enforce retention periods for raw traces, with automatic deletion.

Close

A location trail can show where someone lives, worships and seeks medical care, and it costs almost nothing to collect more of it. The DPDP Act's main obligations begin on 13 May 2027; setting duty-hour limits and retention periods now is cheap compared with retrofitting them later.

Key takeaways

• Vehicle and app location data is personal data when it can be linked to a driver, rider or customer.
• Section 7(i) covers on-duty tracking of employees, not off-shift tracking.
• Gig and platform workers are a separate category under the Code on Social Security; consent is the safer ground for tracking them.
• Legally mandated tracking under the CMVR still needs DPDP security and purpose limits.
• Keep raw location trails for a short, documented period and delete them automatically.