Customer data on shipping labels and packing slips: what the DPDP Rules change from 13 May 2027

A shipping label is the most public document a D2C brand prints.

It carries the name, full address and phone number of a customer in large type. Then it passes the packer, the dispatch desk, the courier pickup boy, two or three hubs and the delivery person. Anyone in that chain can photograph it.

Checked against official sources on 28 October 2026.

My short answer: the Digital Personal Data Protection (DPDP) Rules apply in full from 13 May 2027. From that day a dispatch floor needs four things in place. Print only what each document needs. Control who sees order data. Decide how long you keep labels, manifests and packing videos. And know what to do in the first 72 hours after a leak.

We make the tape, mailers and void fill that go into D2C parcels, and the ecommerce arm of our group sells online. So we print these labels in our own group too. I am not a lawyer. What follows is how we would set up a dispatch floor, with the rule behind each step.

What changes on 13 May 2027, and what already applies?

The DPDP Act, 2023 comes into force in three steps. The Ministry of Electronics and IT set them in the DPDP Rules, 2025 (G.S.R. 846(E), Gazette of India, 13 November 2025):

1. 13 November 2025: definitions and the rules for the Data Protection Board.
2. 13 November 2026: the rules for Consent Managers.
3. 13 May 2027: notice, security safeguards, breach intimation, retention and erasure, data of children and the rights of customers (Rules 3, 5 to 16, 22 and 23).

The third step is the one that reaches the warehouse floor, and it is the one I would plan around.

In early 2026 MeitY consulted on bringing that date forward by six months. It was a proposal, reported by S.S. Rana & Co., and no amending notification had been found by 28 October 2026. Plan for 13 May 2027.

The penalties sit in the Schedule to the Act itself (Gazette of India, 11 August 2023). The fine can go up to ₹250 crore for failing to take reasonable security safeguards, and up to ₹200 crore for failing to report a breach. Breaking any other provision can cost up to ₹50 crore.

Does the Act cover a printed label at all?

I think it does, and I would plan as if it does.

Section 3 of the Act applies to personal data collected in digital form, and an online order is collected that way. The Act defines processing to include "disclosure by transmission, dissemination or otherwise making available". In my reading, printing an address from your order system onto a label is part of processing that data.

The definition of a personal data breach in the Act is also wide. It covers "accidental disclosure" and "loss of access" as well as hacking.

Ask your lawyer to confirm this for your business. I would not wait for the answer before tidying the labels, because every step below is cheap.

Can we still use the address and phone number to deliver?

Yes.

Section 7(a) of the Act allows processing for a purpose for which the customer voluntarily gave her data, as long as she has not said she does not consent. The illustration in the Act is a pharmacy that texts a receipt to the number the customer gave. Delivering the order she placed is the same kind of use.

The limit is the purpose. Sending marketing messages to the delivery phone number is a different purpose, and it needs its own consent.

Which documents on a dispatch floor carry customer data?

Before changing anything, list every place where customer data appears between order and delivery. I call this the data map. Count the copies too. I expect the number will surprise you.

Answer the last column for your own floor. I would do it standing on the floor, not in the office. That sheet becomes your plan.

What should a shipping label show from 2027?

Only what the courier needs to deliver. This is where I would begin, because the label is the copy that leaves your control.

1. Name, full address and pin code. The delivery person needs them.
2. A phone number the delivery person can call. If your courier or shipping platform offers a masked or virtual number, use it. Rule 6 of the DPDP Rules names masking as one of the minimum security measures.
3. Your order number and the courier barcode. Never the customer email address.
4. A neutral description of the contents. A label that says "pregnancy test kit" tells every hub what is inside and who ordered it. An SKU code does the same job for your team.

Here is a check you can do this afternoon. Pull ten labels from the dispatch pile right now. With a highlighter, mark every field. Next to each, write who needs it and why. Any field with no answer comes off the template.

If you fulfil marketplace orders, the platform controls most of its own label. Your website orders are where you decide everything.

Pick lists and packing slips

A picker needs the order number, the SKU and the bin location. A picker does not need a customer name or address. Most order and warehouse systems let you edit the pick-list template, so you change it once and it applies to every order after.

Packing slips need one more thought: gift orders. When a buyer sends a gift, the slip goes to the receiver. If it prints the phone number, email and billing address of the buyer, you have shown the data of one person to another. Print the gift message and the items, and leave the contact details of the buyer off.

The tax invoice is different. GST law sets its fields, so do not remove anything from the invoice without your CA.

How long should we keep manifests, videos and old labels?

Two rules pull in opposite directions here.

Section 8(7) of the Act says personal data must be erased once its purpose is served, unless a law needs it kept. Rule 8(3) of the DPDP Rules then says you must keep personal data, traffic data and processing logs for at least one year from the date of processing, for listed purposes such as investigating a breach. The Rules give an example. An online store keeps the order confirmation, payment and delivery events for at least a year, even if the customer deletes her account.

So our working rule for a dispatch floor is this:

1. Order data and system logs: at least one year, and longer where GST or another law needs it. Your CA sets that period.
2. Paper copies of manifests and labels: keep them only if your process needs them, in a locked file, and shred on a fixed date.
3. Packing videos: write down a retention period and delete on schedule. Ask your lawyer whether Rule 8(3) covers your videos before you choose anything shorter than a year.
4. Misprints and old return labels: shred them the same day. A bin full of labels is a breach waiting for a windy afternoon.

The Rules also have a three-year erasure clock (the Third Schedule). It applies to e-commerce platforms with at least 2 crore registered users in India, and it excludes sellers on a marketplace. Most D2C brands are far below that line.

What counts as a breach on a warehouse floor?

Hackers are the smaller worry. On a dispatch floor, we would treat these as possible breaches:

1. A printed manifest left in a pickup van or lost on the way.
2. A staff phone with label photos, lost or stolen.
3. A shared login used to export the full customer list.
4. Two labels swapped, so one customer receives a parcel carrying the name and address of another. That is a mis-shipment, and in my reading it is also an accidental disclosure.

Rule 7 sets two clocks. Each affected customer must be told without delay, in plain language: what happened, what it means for her, what you are doing about it and whom to contact. The Data Protection Board must also be told without delay, and then, within 72 hours, given a detailed report with the causes, any findings about who caused it and the fixes.

The Rules set no minimum size for a breach. We see that as the biggest change for a small dispatch team. A team that has never practised this will lose most of those 72 hours deciding who is in charge. Name that person now, and keep a one-page breach log at the dispatch desk.

What about couriers, 3PLs and software vendors?

They handle your customer data on your behalf, so the Act treats them as your data processors. Section 8 makes you responsible for what they do with it, and says you may use a processor only under a valid contract. Rule 6 adds that the contract must provide for security safeguards.

We suggest asking each courier, 3PL, shipping platform and CCTV vendor four questions:

1. Where is our customers' data stored, and who in your company can see phone numbers?
2. How do you delete our data when the contract ends?
3. How many hours after a breach will you tell us? Our 72 hours start when we become aware, so your delay becomes ours.
4. Will you put all of this into the contract?

If you are still choosing a partner, add these to the questions in choosing a 3PL or courier partner.

What to do between now and 13 May 2027

1. November and December 2026: draw your data map. Walk the floor with the table above in hand.
2. January 2027: change the label, pick-list and packing-slip templates. Ask your couriers about masked numbers.
3. February 2027: send the four questions to every processor, and update the contracts.
4. March 2027: remove shared logins. Restrict full exports to named people. Write a short rule for staff phones and chat groups.
5. April 2027: set retention periods, start the shredding routine and run a one-hour breach drill with the dispatch desk.
6. By 13 May 2027: publish on your website the contact of a person who can answer data questions (Rule 9), and a way to raise a grievance. Rule 14 asks you to answer grievances within a period of not more than 90 days.

None of this needs new software. Most of it needs one honest afternoon with the people who run the floor, and we would start with the label.

This guide is general information, not legal advice. Please confirm the details for your business with a lawyer.

If you try the highlighter test, I would like to know how many fields came off your label. Write to us through the contact page.