Delivery addresses should not become a permanent marketing database

A delivery address can be essential at ten in the morning and unnecessary to a marketing team by the afternoon. The fact that the business legitimately needed it to complete an order does not answer whether it should later be used to build neighbourhood campaigns, enrich a customer profile or remain in a driver’s personal messages.

Follow the address through the fulfilment process. That usually reveals more useful work than simply adding another sentence to the privacy policy.

Define the fulfilment purpose clearly

Ask which details are needed to get the item to the correct place: a delivery name, address, relevant contact route and perhaps a limited instruction. Distinguish an instruction such as which entrance to use from unrelated details about a household. Free-text notes deserve attention because people may disclose more than the delivery needs.

As of 22 October 2026, the substantive DPDP duties discussed here are scheduled for 13 May 2027 under the commencement notification. In the future framework, sections 4 and 7(a) will be relevant to the processing route, including the defined situation in which a person voluntarily supplies data for a specified purpose without indicating refusal. That provision is not a general contractual-necessity ground and does not authorise every later use of an order record.

Assess each proposed purpose. If the business wants to use delivery history for an additional activity, determine the appropriate basis and explanation before that activity begins.

Limit the handoff to the courier

List the fields the courier receives and what the courier needs to return. A carrier may need the destination and delivery contact; it may not need the customer’s full shopping history or internal service notes. Consider the provider’s role for each activity instead of assuming that every function is performed solely on your instructions.

The future section 8(1) accountability framework and rule 6 safeguards make the provider relationship important. As preparation, agree access, permitted use, incident escalation, working-copy treatment and the end of the engagement. Check whether the real delivery workflow matches those instructions.

If a staff member sends details through an informal channel during a busy period, bring that route into the map. A process does not become low risk merely because the official integration is well controlled.

A hypothetical furniture delivery

A furniture shop sends a delivery team the customer’s name, address, order reference and instruction to use the side entrance. The dispatch team initially also attaches the entire customer account export. On review, the owner removes that attachment because it adds information unrelated to the delivery task.

After delivery, the team records completion without taking an unnecessarily wide photograph of the home. Any proof image needed for the business process is stored in the approved system, with access limited to the people handling fulfilment and disputes. The shop checks that local working copies are treated according to the agreed process.

When a marketer asks for all addresses in a particular colony, the owner treats that as a new proposed use. The delivery spreadsheet is not handed over merely because it is convenient and already exists.

Separate active use from retained evidence

The end of delivery is a useful review event, but it does not automatically mean every related record can be destroyed. Returns, disputes and legal obligations may affect the decision. Under the future section 8(7), erasure is subject to legal retention, and rule 8(3) with the Seventh Schedule contains purpose-limited retention requirements that must also be considered.

Create a record of what remains, why it remains, who can access it and when it will be reviewed. Restrict retained information to its justified purpose. Keeping a transaction record for a required reason does not turn it into an unrestricted campaign resource.

Avoid vague retention labels such as ‘as long as useful’. Identify the event or obligation that starts and ends the relevant period. If the answer requires specialist input, record the open question and owner rather than inventing a universal number of months.

Check the places a policy may miss

Review dispatch exports, route-planning tools, proof-of-delivery attachments, shared folders and staff devices. Include backup and restoration behaviour in the broader retention process. A future restoration should not quietly reactivate an address list that has already left operational use.

The common failure is a well-managed main database surrounded by unmanaged copies. Choose one completed order and trace it through those locations. Use what you find to narrow the fields, close unnecessary access and make the purpose boundary visible to every team that handles the address.