Quick-commerce and delivery platforms collect precise customer location, continuous rider GPS tracking, and call-masking metadata across every order — this spans customer consent (Section 6), delivery-partner employment or gig-worker data handling (Section 7), and vendor obligations if a third-party logistics or call-masking provider is involved. This checker scores your delivery app data flow across customer, rider and vendor touchpoints.
Customer location, rider GPS tracking, call masking — check your quick-commerce or delivery platform DPDP compliance in 60 seconds.
A single order on a delivery or quick-commerce app touches personal data at multiple points: the customer's precise address and sometimes live location, the delivery partner's continuous GPS trail during the shift, and a masked-call or SMS record connecting the two. Each of these is processed under a different basis — customer consent for the order, an employment or gig-work legitimate-use basis for rider tracking under Section 7(i), and often a third-party vendor relationship for call masking or route optimisation — and each needs to be handled correctly on its own terms.
The rider tracking piece deserves particular attention: Section 7(i) permits processing for employment purposes, but it is not an unlimited licence for surveillance. Continuous, always-on location tracking of gig workers without clear notice of scope and purpose sits in a grey zone that regulators are likely to scrutinise as gig-economy platforms scale, especially given growing public attention on gig-worker data rights in India.
The practical fix is to scope location tracking tightly to the active-order window by default, give riders clear notice of any broader tracking with a stated purpose, formalise data processing agreements with every logistics and call-masking vendor, and stand up a simple rights-request process for both customers and riders. Niti Bharat's Delivery Partner DPA Template gives quick-commerce and delivery platforms a ready-to-use data processing agreement for logistics and call-masking vendors, plus rider notice language that scopes tracking appropriately.
A one-page PDF mapping consent and data-agreement requirements across customer, rider and vendor touchpoints for delivery apps.
One real DPDP development explained in plain English, one practical how-to, one number from our own assessment data. Nothing else — no daily noise, no sales pitch.
No spam. Unsubscribe with one click, anytime.
