Do You Need A Data Processing Agreement For Fulfilment?

Using a warehouse or fulfilment partner can make your online store feel much more manageable. Orders go out faster, stock is easier to track, and you can spend less time packing boxes at the kitchen table.

But there's one legal question that often gets missed: what happens to your customers' personal data when you send it to that fulfilment provider?

If your warehouse can see names, delivery addresses, phone numbers, email addresses or order details, UK data protection law is likely in play. The good news is that this doesn't have to be complicated, but you do need to get the paperwork right.

Do I Need A Data Processing Agreement With My Fulfilment Provider?

Yes, you usually need a data processing agreement with your fulfilment provider if they handle customer personal data for you and follow your instructions.

Under the UK GDPR and the Data Protection Act 2018, a business that decides why and how personal data is used is usually the controller. A business that handles that data on the controller's instructions is usually the processor.

For many online retailers, the position looks like this:

• You collect customer details through your ecommerce store.
• You decide what data is needed to process and deliver the order.
• You send the order details to your warehouse or fulfilment partner.
• Your fulfilment provider uses that data to pick, pack and dispatch the order.

In that situation, you're likely the controller and your fulfilment provider is likely your processor.

Article 28 of the UK GDPR says that when you use a processor, you need a written contract with certain mandatory data processing terms. This is often called a data processing agreement, or DPA. It can be a standalone agreement or a data processing schedule within your wider warehouse and fulfilment agreement.

Say Maya runs an online skincare brand in Manchester. She uses a third-party warehouse to store products and send orders to customers across the UK. The warehouse receives each customer's name, address, mobile number, email address and product order. Maya's business decides why that data is collected. The warehouse uses it only to fulfil orders. Maya should have processor clauses in place with the warehouse.

Without the right written terms, you may find it harder to show the ICO that you've taken proper steps to protect customer data. You may also have gaps if there's a data breach, a customer complaint or a dispute with the fulfilment provider.

Who Is The Controller And Who Is The Processor?

It depends on who decides the purpose and means of the data use, but in a typical ecommerce fulfilment setup you're the controller and the warehouse is the processor.

The labels matter because they decide what obligations each party has under the UK GDPR. They also affect what your contract needs to say.

When You're Likely The Controller

You're likely the controller for your customer order data if you decide:

• what customer information to collect at checkout
• why you need that information, such as taking payment, delivering goods or handling returns
• which fulfilment provider will receive the information
• how long customer records will be kept in your systems
• how customers are told about your data practices in your privacy policy

Most ecommerce retailers fit this description. Even if your fulfilment partner has a slick platform or automated processes, you're still usually the business deciding why the data is being used.

When The Fulfilment Provider Is Likely The Processor

Your fulfilment provider is likely your processor if it only uses personal data to provide services to you, such as:

• receiving order data from your website, marketplace or order management system
• printing packing slips or shipping labels
• packing and dispatching products
• helping with returns
• providing order tracking updates through your chosen systems

A processor shouldn't use your customer data for its own marketing, analytics or unrelated business purposes unless there's a clear lawful basis and the right privacy information has been given. If a provider wants to use your customer data for its own database or promotions, that's a different risk profile.

What About Delivery Providers?

A delivery provider can be a processor or an independent controller, depending on the setup.

If your fulfilment provider appoints a courier purely to deliver your orders on your behalf, the courier may be treated as a sub-processor under your arrangement. In that case, your contract with the fulfilment provider should control how sub-processors are approved and managed.

If you contract directly with a courier, or the courier decides key parts of how delivery data is used for its own legal and operational purposes, the courier may be an independent controller. You may not need a processor clause with that courier, but you may still need a data sharing agreement or data sharing terms, and your privacy policy should explain that customer data is shared with delivery partners.

What Customer Data Does A Fulfilment Provider Usually Handle?

A fulfilment provider usually handles personal data connected to processing and delivering orders, so you should map exactly what you share before you sign the contract.

Common examples of warehouse fulfilment customer data include:

• customer names
• delivery addresses
• billing addresses, if shared for order checks or documentation
• email addresses
• phone numbers
• order numbers
• product details
• delivery instructions, such as safe place notes
• returns information
• tracking details

Most of this information is ordinary personal data. Sometimes, though, order details can reveal something more sensitive. For example, products linked to health, religion, disability support, adult goods or political causes may tell you something about a customer that needs extra care.

You don't need to over-share.

A helpful rule is to ask: what does the provider actually need to dispatch the order? If they don't need a customer's date of birth, full purchase history or marketing preferences, don't send it. This also helps with the UK GDPR principle of data minimisation.

What Should Processor Clauses Under The UK GDPR Include?

Processor clauses should include the mandatory Article 28 terms, plus practical details that make sense for ecommerce fulfilment.

A good data processing agreement with a fulfilment provider usually covers the following points.

Processing Only On Your Instructions

The provider should agree to process customer personal data only on your documented instructions. For example, they can use the data to pick, pack, dispatch and manage returns, but not to market their own services to your customers.

Confidentiality

The provider should make sure staff and contractors who access customer data are under confidentiality obligations. This matters where warehouse staff can view packing slips, shipping labels or customer notes.

Security Measures

The contract should describe appropriate technical and organisational security measures. For fulfilment, that might include:

• restricted access to order management systems
• unique logins for staff
• secure printing and disposal of packing slips
• controls around handheld scanners and warehouse devices
• staff training on handling customer data
• procedures for lost parcels, mislabels and misdirected orders

Templates can be a useful starting point, but generic wording often misses the practical risks of fulfilment work. Your clauses work best when they reflect how orders actually move through your systems and warehouse.

Help With Data Subject Requests

Customers may contact you to exercise their UK GDPR rights, such as access, deletion or correction. Your provider should agree to help you respond where the request involves data held in its systems.

For example, if a customer asks you to delete old address details, you may need your warehouse to remove or anonymise those details from archived order records, unless there's a legitimate reason to retain them.

Audit And Information Rights

You should have the right to receive enough information to check that the provider is meeting its obligations. For larger providers, this may be handled through security summaries, certifications, questionnaires or audit reports rather than you visiting the warehouse yourself.

The point isn't to create busywork. It's to make sure you can show you chose and monitored your processor responsibly.

Do I Need To Approve Sub-Processors?

Yes, if your fulfilment provider uses sub-processors for your customer data, your data processing agreement should deal with how they're approved.

Sub-processors are other businesses that your processor uses to help process personal data. In ecommerce fulfilment, these might include:

• couriers and delivery networks
• warehouse management software providers
• shipping label platforms
• returns portal providers
• customer notification tools
• cloud hosting providers

The UK GDPR doesn't require you to approve every sub-processor one by one in all cases. You can give general authorisation, but your provider must tell you about intended changes so you have a chance to object.

Practically, your agreement should say:

• whether you give specific or general authorisation for sub-processors
• how you'll be notified about new sub-processors
• how much notice you'll receive before changes take effect
• what happens if you reasonably object
• that the provider must impose equivalent data protection obligations on sub-processors
• that the provider remains responsible to you for its sub-processors' failures

This is especially useful where your fulfilment provider uses a chain of delivery providers. You may not know every driver or depot involved, but you should know the main systems and service providers handling your customer data.

What Happens If There Is A Data Breach?

Your fulfilment provider should tell you about a personal data breach without undue delay, because you may have a strict reporting deadline under the UK GDPR.

A personal data breach isn't just a hacker breaking into a system. In fulfilment, it could include:

• orders being sent to the wrong customer
• a parcel label showing the wrong address
• packing slips being mixed up
• a staff member emailing an order file to the wrong person
• a warehouse device with order data being lost or stolen
• unauthorised access to a fulfilment platform

If a breach is likely to risk people's rights and freedoms, you may need to notify the ICO within 72 hours of becoming aware of it. If the risk is high, you may also need to tell the affected customers.

Your DPA should set out a clear breach process, including:

• who the fulfilment provider must notify
• how quickly they must notify you
• what information they must provide
• how they will help investigate and contain the issue
• who handles customer and regulator communications
• how costs and responsibilities are managed if the provider caused the breach

Try to avoid vague wording like as soon as practicable on its own. A clearer clause might require notice immediately, and in any event within 24 hours of the provider becoming aware of the breach. That gives you enough time to assess the risk, speak to the provider and decide whether any ICO or customer notification is needed.

Key Takeaways

• If your fulfilment provider handles customer names, addresses, contact details or order information on your instructions, you'll usually need a data processing agreement.
• Most ecommerce retailers are controllers, while warehouses and fulfilment partners are often processors.
• Your agreement should cover Article 28 requirements, including instructions, confidentiality, security, sub-processors, assistance with rights requests and breach support.
• Only share the customer data your provider actually needs to pick, pack, dispatch and manage returns.
• Your privacy policy should clearly explain how you use fulfilment and delivery partners to process orders.

If you'd like help with data processing agreements, fulfilment contracts, privacy policies and data breach processes, you can reach us at 08081347754 or team@sprintlaw.co.uk for a free, no-obligations chat.