DPDP for Ports, Logistics, Transport and Warehousing

Whose data is the consignee's name and address, ours or the sender's?

It is the consignee's data. The question you are really asking is which role you occupy. Where the sender decides why the delivery happens and you carry it out on those instructions, you are its processor and there has to be a contract. Where you decide things for your own purposes, you are a fiduciary.

Either way you hold personal data, so security, breach handling and retention apply to you.

ACT · Sections 2, 8(1) and 8(2).

Do we need driver consent to track vehicles?

No. Tracking a driver in the course of work is processing for the purposes of employment, and it is also related to safeguarding the employer from loss or liability. Neither route runs on consent.

Asking for consent anyway is a trap. If you rely on it, the driver can withdraw it with comparable ease and your tracking loses its basis. Rely on the legitimate use and say so plainly in your policy.

ACT · Sections 4 and 7(i).

A driver lost a printed manifest with fifty consignee names. Is that reportable?

A purely paper document sits outside the Act, which applies to digital personal data and to non digital data that is digitised subsequently. So the printed sheet alone is not the trigger.

In practice it almost always is digital too, sitting in your system and often photographed on a phone. Once it is, an accidental disclosure or loss of access is a personal data breach, and there is no minimum size below which reporting is excused.

ACT · Sections 2(u), 3 and 8(6); RULES · Rule 7.

Can we keep delivery history to offer the consignee our own services later?

Not on the delivery basis. Those details reached you so a consignment could arrive, and voluntary provision is limited to the purpose for which the data was provided.

Marketing to that person is a fresh purpose. It needs her consent, obtained for that purpose, and if you are acting as the sender's processor you would also be stepping outside your instructions by doing it.

ACT · Sections 6(1), 7(a) and 8(2).

The consignee is our customer's customer, so their details are not our problem.

If you hold it, you process it. Whether you are the fiduciary or the processor decides which duties you carry, not whether you carry any at all.

Tracking our drivers needs their permission.

Tracking a driver during work is employment processing, and it is also related to safeguarding the employer from loss. Permission is not the basis, so asking for it and then relying on it leaves you worse off, because it can be taken back.

A lost delivery sheet is not a data breach, it is a piece of paper.

The Act covers digital personal data, so a purely paper record sits outside it. The moment it is scanned, photographed or keyed into a system it is inside, and an accidental disclosure of it is a reportable breach with no minimum size.

We can pass the consignee's number to anyone in the chain.

Only where each hand in the chain has its own basis, and where anyone acting on your behalf is bound by the contract the Act requires. Passing it onward without either is unauthorised processing.