GDPR and logistics: what every carrier must know

Why logistics is exposed to the GDPR

At every delivery, a carrier collects a significant volume of personal data: recipient name and address, phone, electronic signature, proof photo, driver GPS position, time-stamp. All are subject to the GDPR (Regulation (EU) 2016/679). It's not a legal detail, it's the heart of the business.

The data involved

• On the recipient side: name, address, phone, email, signature, drop-off photo.
• On the driver side: real-time and historical GPS position, hours, performance.

The key obligations

Legal basis and information

Collecting recipient data rests on performance of the delivery contract. You must still inform the person (a note on the docket, a link to your privacy policy).

Retention period

Data isn't kept indefinitely. For driver geolocation, France's CNIL sets clear limits: 2 months in principle, up to 1 year when used to optimise routes or prove interventions, up to 5 years for working-time tracking.

Access and erasure rights

Anyone can request access to or deletion of their data. The GDPR requires a reply within one month (Article 12). That assumes a system where data isn't scattered across spreadsheets and disconnected tools.

Geolocation and hosting

Drivers must be able to switch off location off-duty (CNIL). And hosting matters: data held outside the European Economic Area poses a compliance problem. Check EU hosting and a data processing agreement (DPA) with your provider.

dropfleet and compliance

dropfleet is hosted in Europe, offers configurable retention periods, a "privacy" mode for drivers, and export and deletion functions. Compliance is designed in, not bolted on.

A GDPR-compliant platform, hosted in Europe. Try dropfleet free for 14 days, no credit card, ready in 5 minutes.