Logistics and Supply Chain: A DPDP Act Impact Study

Executive summary

Logistics businesses hold personal data about millions of people who never signed up with them. A courier knows a recipient's phone number and doorstep; a delivery app tracks its riders; a fleet camera watches a driver's face for signs of sleep.

The Digital Personal Data Protection Act, 2023 (the DPDP Act) and the DPDP Rules, 2025 reach all of it from 13 May 2027. A data fiduciary decides why and how personal data is processed; a data principal is the person the data is about; a data processor acts on a fiduciary's behalf. A courier is often its client's processor and a fiduciary for its own purposes on the same parcel.

Headline rating: Overall impact High. Five of the twelve areas in the Trayambic scorecard below are rated High for a typical express parcel company, third-party logistics (3PL) provider, trucking fleet or last-mile operator.

The three biggest changes:

• Recipients become a compliance category. The Act has no "legitimate interests" ground, and the ground for data a person has "voluntarily provided" fits poorly when someone else typed in her address.
• Evidence trails need limits. Proof-of-delivery photos, one-time passwords (OTPs), in-cab video and fatigue alerts each need a stated purpose, tight access and a deletion date.
• Government data pipes stay, with DPDP duties added. E-way bills, customs know-your-customer (KYC) checks, tracking feeds and gig worker records are legal obligations. The disclosures continue, but the copies a business keeps carry full DPDP duties.

Background

Four overlapping models make up the sector:

• Express parcel and courier companies collect, sort through hubs and deliver to doorsteps, often through franchisees and sub-contracted partners; cross-border operators also clear shipments through customs.
• 3PL and warehousing providers store, pack and ship on a brand's order data.
• Freight and trucking fleets often hire market vehicles through brokers or freight platforms, so the driver is neither employee nor customer.
• Last-mile operators deliver with gig riders, for their own platform or for retailers.

The data principals include senders, recipients, people who accept parcels for others, employed and contracted drivers, gig riders, warehouse staff and contract labour, and importers and exporters whose identity customs requires to be verified.

The data spans addresses and phone numbers, live location, delivery photos and signatures, OTPs, identity document copies, licence and vehicle details, telematics, video and payout bank details. It moves through transport and warehouse software, client APIs, telematics, dashcam, call-masking and verification vendors and cloud hosts, and to the State through e-way bills, customs, tracking servers and the social security portal.

Legal framework

The DPDP provisions that matter most

• Grounds (ss.4, 6, 7). Consent, or a listed legitimate use: s.7(a) for data a person has voluntarily provided for a specified purpose, s.7(d) for disclosures the law requires to be made to the State, s.7(i) for employment.
• Notice and consent (ss.5–6; Rule 3). An itemised, standalone notice with every consent request; withdrawal as easy as giving.
• Fiduciary duties (s.8; Rules 6–7). Responsibility for processors "irrespective of any agreement to the contrary"; accuracy where data drives a decision (s.8(3)); security safeguards with logs kept at least a year; breach notice to each affected person and the Data Protection Board, with a detailed report within 72 hours; erasure once the purpose is served unless law requires retention (s.8(7)).
• Rights (ss.11–14; Rule 14). Access and erasure run only against a fiduciary to whom the person gave consent or s.7(a) data; every fiduciary must answer grievances, within 90 days at most.
• Significant Data Fiduciaries (s.10; Rule 13). A designated Significant Data Fiduciary (SDF) needs an India-based Data Protection Officer, independent data audits and annual impact assessments.

Penalties reach ₹250 crore for security failures and ₹200 crore for breach-notice failures.

Sector law that applies alongside

• Post Office Act, 2023 (Act 43 of 2023, in force 18 June 2024) governs India Post, not private couriers; its interception power (s.9) covers only items "in course of transmission by the Post Office". On 1 December 2025 the Department of Posts consulted on amendments backing DHRUVA, a digital addressing system built on DIGIPIN codes: address identifiers would be used only "upon the consent of the user" (in the DPDP sense), through registered Address Service Providers, with penalties up to ₹1 crore for unregistered operators. As far as we can find, they have not been enacted.
• CGST Rules, 2017, rule 138. Goods worth over ₹50,000 move on an e-way bill: Part A carries the recipient's GSTIN, place of delivery and PIN code, document number, value and HSN code; Part B the transport document and vehicle number. Under s.36 of the CGST Act records are kept 72 months from the annual return's due date, longer while proceedings are pending.
• Courier Imports and Exports (Electronic Declaration and Processing) Regulations, 2010. Regulation 12(1)(iv) requires an authorised courier to "verify the antecedent, correctness of Importer Exporter Code (IEC) Number, identity of his client and the functioning of his client in the declared address" using "reliable, independent, authentic documents, data or information". Circular 7/2015-Customs (12 February 2015) lets an individual use one document showing both identity and address, and adds Aadhaar. For some consignments a consignee's authorisation may be taken at delivery and kept one year or until customs audit, whichever is earlier (Notification 26/2011-Customs (N.T.)).
• Central Motor Vehicles Rules, 1989, rule 125H (G.S.R. 1095(E), 28 November 2016, in force 1 April 2018). Public service vehicles carry an AIS-140 vehicle location tracking device (VLTD) and emergency buttons, reporting to government-authorised servers; two- and three-wheelers, e-rickshaws and vehicles needing no permit are exempt. G.S.R. 617(E) of 3 August 2022 extends tracking to N2 and N3 vehicles carrying dangerous or hazardous goods.
• MoRTH Policy for Data Sharing from the National Transport Repository (August 2025) covers Vahan, Sarathi, e-Challan, accident and FASTag data and names transporters, aggregators and VLTD vendors among recipients. Personal data is masked unless the person consents through an Aadhaar-authenticated OTP. Recipients need an annual CERT-In empanelled audit, India storage, a year of access logs and purpose limits, must erase on MoRTH's request and are treated as data fiduciaries.
• National Logistics Policy, 2022 (launched 17 September 2022) and its Unified Logistics Interface Platform (ULIP) link ministries' logistics systems; private users sign a non-disclosure agreement. Neither sets personal data rules.
• Code on Social Security, 2020 (in force 21 November 2025) treats gig and platform workers as distinct from employees. Under the Social Security (Central) Rules, 2026 (G.S.R. 344(E), 8 May 2026), rule 48 requires aggregators to share their gig workers' details with a Central Government portal and report joiners and exits in real time or daily. Karnataka's Platform-Based Gig Workers Act, 2025 adds transparency on automated monitoring (s.13) and 14 days' notice of termination (s.14(2)).
• CERT-In Directions of 28 April 2022: incidents reported within six hours; logs kept in India for 180 days.

How sections 38 and 16(2) fit them together

Section 38 makes the DPDP Act additional to these laws and gives it priority only in a conflict, which is rare here. Disclosures to tax, customs and labour authorities fall within s.7(d), and records they require may be kept under s.8(7). The Act adds discipline over the copies a business keeps: KYC scans on branch drives, e-way bill spreadsheets, tracking data reused for marketing. Section 16(2) preserves stricter transfer rules; no logistics statute localises data, but the transport repository policy makes India storage a condition of access.

The dates

Consent manager provisions commence on 13 November 2026; the main duties, rights and penalties on 13 May 2027. No compression of the timeline has been notified, and no Board members have been appointed, as of October 2026.

Analysis

The Trayambic DPDP Impact Scorecard

Overall impact: High

Recipients: data principals who never signed up

Sort shipments first, because the answer differs:

• A brand's e-commerce order. The shopper gave her address to the brand. The brand is the fiduciary, relying on s.7(a); the courier is its processor and should not reuse the address without a ground of its own.
• An individual's booking. The sender is the courier's customer, but the recipient's details came from someone else. Section 7(a) speaks of data the data principal herself voluntarily provided, so it does not comfortably cover her, and the Act has no ground written for this case.
• The courier's own uses. Address-quality models, return-risk scores and branded tracking pages that push the courier's app are the courier's own purposes, so it is a fiduciary.

For individual bookings, design narrowly: use the recipient's data only to deliver, tell her in the dispatch message who holds her details and how to object, and erase them after the claims window. For the courier's own uses, take consent from recipients who choose to engage, and keep delivery data out of marketing and model training unless the client's notice covers it.

Two consequences are easy to miss. Because ss.11 and 12 run only against a fiduciary that received consent or s.7(a) data, a recipient may have no statutory access right against a courier, though the courier must still answer grievances (s.13) and erase (s.8(7)). And a guard or neighbour who accepts a parcel becomes a data principal once their name or photo is recorded.

Trayambic's e-commerce impact study covers gift recipients from the retailer's side.

Proof of delivery: photos, OTPs and signatures

Proof of delivery settles disputes, and each method leaves a record: an image that can catch a face, a door number or the inside of a flat; a signature; an OTP log; the name of whoever took the parcel. Each needs a purpose, minimisation and a clock:

• Photograph the parcel, not the person. Frame the package at the door, blur faces before storage, and keep images out of the phone's gallery.
• Prefer OTPs for high-value deliveries. Record that verification succeeded and when, not the code.
• Limit access. The rider app should lose the address and photo once the delivery closes; support sees proof only in a dispute.
• Retain for the dispute window. Keep proof for the contractual claims period plus a buffer. Tax record-keeping concerns accounts and supply documents, not doorstep photos; where a dispute is live, s.17(1)(a) allows the relevant proof to be kept until it ends.

Where proof decides something about a person, such as rejecting a non-delivery complaint or penalising a rider for a false scan, s.8(3) requires the photo, geotag and timestamp to be accurate enough to bear the decision.

Cameras in the cab

Trayambic's blog on driver and rider location data covers the grounds for GPS tracking. Cameras go further.

Fleets increasingly fit dual-facing dashcams that watch the driver's face and upload clips to the cloud. The vehicle standard is far lighter: AIS-184, on drowsiness and attention warning, requires the system to work "without the use of biometric information", in a closed loop that is overwritten and does not identify the vehicle or holder, with personal data processed in line with data protection law.

Aftermarket cameras are a business choice, and the DPDP Act treats them so:

• Ground. Safety monitoring of employed drivers fits s.7(i). Owner-drivers and hired market vehicles need consent, which must be "free" and "unconditional"; making a cabin feed a condition of every load will be hard to defend where a lighter option exists.
• Minimisation. Process on the device, upload event clips only, and switch the cabin lens off outside duty and in sleeper berths.
• Decisions and retention. Fatigue scores used for discipline or pay must be accurate and open to challenge (s.8(3)). Overwrite routine footage within days; keep event clips only while an incident or claim is open.

Road-facing cameras also record pedestrians and number plates; keep that footage for incidents, not analytics.

Government data pipes and the copies you keep

E-way bills, customs declarations, tracking feeds and gig worker records flow to the State under s.7(d). The risk lies in what stays behind:

• Customs KYC. Store scans centrally, mask Aadhaar numbers, restrict branch access and delete after the customs period unless a proceeding is pending. On 9 September 2026 the Chennai bench of the Customs, Excise and Service Tax Appellate Tribunal set aside penalties on an express company (FedEx Express Transportation and Supply Chain Services (India) Pvt. Ltd. v. Commissioner of Customs, Final Order No. 41016/2026), holding that the KYC regulation then in force did not itself require two identity documents. The appeal dated from 2015: KYC records can be evidence for a decade.
• Licence and registration lookups. Under the transport repository policy, unmasked data needs the person's Aadhaar-authenticated OTP consent and brings audit, storage and logging duties. Verify, store the result, discard the full record.
• Downloads. E-way bill and customs exports belong in a controlled system for the tax period, not in email.

Worked example (illustrative): a regional express parcel company

A mid-size express company in western India runs 40 hubs and 600 franchise counters, delivers for marketplaces and brands, books walk-in parcels, runs an export desk for online sellers, uses 2,500 gig riders and hires market trucks for linehaul. It has fitted AI dashcams to its own trucks.

Roles. For marketplace and brand shipments it is a processor under data terms limiting use to delivery and returns. For walk-in bookings, export KYC, riders, dashcams and its own analytics it is a fiduciary.

Riders and drivers. Rider tracking rests on consent and stops at logout; disclosures to the social security portal fall within s.7(d). Employed drivers are monitored under s.7(i); hired-truck drivers consent, and only event clips are uploaded.

A breach. A franchisee's shared login is used to scrape the tracking API, exposing names, numbers and addresses of 1.2 lakh recipients. For walk-in bookings the company tells each affected recipient and the Board without delay, files the 72-hour report and reports to CERT-In within six hours. For client shipments the brands are fiduciaries: the company alerts them within the hours its contracts set, and they notify their customers. The fix is individual logins, rate limits and masked numbers on tracking pages.

Retention. Waybills and invoices for the tax period; consignee authorisations for a year or until audit; delivery photos for 90 days unless a claim is open (an internal choice, not a legal period); dashcam clips until the incident closes.

Compliance framework

Roadmap to 13 May 2027

• Now to December 2026: data map; vendor and franchise inventory; audit transport-data API use; stop new marketing uses of recipient data.
• January to March 2027: contracts; proof-of-delivery and camera redesign; masking and logins; retention schedule.
• April to May 2027: breach drill with two large clients; grievance channel live; deletion jobs on.
• Ongoing: track the DHRUVA amendments, driver-assistance rules and SDF notifications; audit franchisees yearly.

Recommendations

1. 1.Decide your role for each shipment type and write it into every client contract.
2. 2.Treat recipients as data principals with their own ground and deletion date, and keep them out of marketing unless they opt in.
3. 3.Make proof of delivery prove the parcel, not the person.
4. 4.Benchmark any driver camera against AIS-184: on the device, event-based, no face recognition unless strictly necessary.
5. 5.Hold customs KYC scans and e-way bill exports in one controlled system, with Aadhaar masked and deletion dates set.
6. 6.Replace shared franchise logins and rate-limit tracking APIs before May 2027.
7. 7.Rehearse a breach with your largest clients so each recipient gets one clear notice, not three.

Key takeaways

• Recipients are data principals; a courier is the client's processor for delivery but a fiduciary for its own uses, and the Act has no ground written for recipients of individual bookings.
• Proof-of-delivery photos, OTP logs and cab video need a stated purpose, restricted access and a deletion date tied to the dispute window.
• Driver cameras should follow AIS-184's privacy design: on the device, closed loop, no biometrics; contracted drivers need consent, not the employment ground.
• E-way bills, customs KYC, tracking feeds and gig worker records are legal disclosures under s.7(d), but the copies a business keeps carry full DPDP duties.
• A breach in a franchise or client chain needs one runbook covering the Board, affected recipients, CERT-In within six hours and each client.