Can a UK shop share customer phone numbers with a courier?

Your checkout collects a mobile number and the shipping integration sends it to the courier. That sequence can look routine until a customer asks why the courier has their number. You need an answer about the delivery service, the purpose of the contact and the basis for sharing it. Saying that the software asked for a number explains the input screen, but it does not explain the whole processing decision.

This article is for a UK online seller preparing delivery contact data. Official ICO pages and AirPost constants were checked on 14 October 2026. The UK framework has changed through the Data (Use and Access) Act. Some ICO pages are marked as under review, while the legitimate-interests page carries a March 2026 update. Use the current guidance for your actual service rather than copying an old statement that every disclosure requires consent.

What exactly will the courier do with the number? #

Start with the service you selected. Is a driver supposed to call when access is blocked? Does a collection service need to identify the recipient? Is the number only used for a delivery-window alert? These are different purposes even when the same phone field is used. Ask the provider to explain the function and check its privacy information. Do not infer the purpose from a generic contact field name.

Separate the disclosure from later use. Your shop decides whether to send the number; the receiving organisation must also be able to explain its processing. If the number is then used for surveys or promotional messages, that is not automatically covered by a delivery reason. Keep your assessment focused on the necessary delivery activity and investigate any additional use independently.

Apply the table to the actual option, whether you are comparing DPD, Evri or another provider. A company name alone does not tell you what every service requires. Preserve the service explanation with your decision so you can answer the customer accurately. If the explanation is unclear, resolve that question before importing a wider set of customer fields.

When does contract cover delivery contact? #

The ICO’s contract guidance says this basis concerns processing necessary to deliver the contractual service to the individual. It gives an online purchase and delivery address as an example. That example establishes why an address can be needed. It does not say that every available contact field is necessary for every delivery.

For a phone number, connect the proposed use to the particular contractual service. Explain what the delivery would require without it and whether a reasonable, less intrusive alternative exists. Writing the number into your terms does not by itself establish necessity. A convenience for your workflow and a targeted step integral to delivering the service are not automatically the same.

The contract must also be with the relevant individual. The ICO states that this basis does not apply to processing one person’s details where the contract is with someone else. That matters for gifts and orders placed by a buyer for another recipient. Identify whose phone number you have before deciding what basis covers its use. The order payment proves who bought the goods, not whose number was supplied.

How do you assess ordinary legitimate interests for a courier call? #

The updated ICO guidance separates purpose, necessity and balancing. For a delivery call, describe the concrete interest first: for example, enabling access needed for the selected delivery. Then ask whether using this number is proportionate and whether another reasonable approach would achieve the same result with less intrusion. Finally consider the person’s expectations and possible impact.

A short, expected contact about a delivery can differ from repeatedly calling an unrelated household number. A number belonging to a recipient who has not heard of your shop can differ from the buyer’s own contact number. Your record should explain these features of the use. A copied sentence about business interests is much less useful than a decision tied to the service, recipient and contact method.

Recognised legitimate interest is a separate basis for specified purposes in the current UK framework. Do not treat the word recognised as a general shortcut for ordinary commercial delivery. The ICO explicitly distinguishes the two bases. If your assessment relies on ordinary legitimate interests, document the full test and the relevant privacy information. A new basis appearing in the law does not remove the need to identify which one actually applies.

What should happen when a customer will not provide a phone number? #

Investigate what is genuinely required for the chosen service. If it can proceed without the number, make the workflow reflect that fact. If a service requires delivery contact for a reason you can justify, explain the reason and assess available alternatives. Do not invent a number, silently substitute an employee’s number or enter a random placeholder to bypass validation. Those actions can send information to the wrong person or obstruct a necessary delivery call.

If you rely on consent for a genuinely optional feature, your process must handle refusal and withdrawal consistently. If you rely on another basis, do not present a compulsory field as though it were an optional consent request. Decide the basis before processing and keep the explanation accurate. The customer should understand what is needed for delivery and what they can choose separately.

How should you handle gift recipients and changed contact details? #

A buyer may enter their own number beside the recipient’s address, or supply the recipient’s number without telling that person. Confirm what the field represents. Avoid promising that the courier will reach the recipient when it has only the buyer’s contact. If the recipient’s number is needed, assess the source, purpose and applicable information duties as part of your process rather than assuming the buyer’s purchase settles everything.

A last-minute update deserves the same care. Establish who is requesting the change and which shipment it belongs to. Replace the relevant dispatch contact through the agreed route, and check whether data has already been sent to the courier. Changing the shop record does not demonstrate that every earlier recipient has received the correction. Keep the correction traceable without circulating the whole customer profile.

What should your arrangement with the courier record? #

The ICO’s data-sharing agreement guidance describes an agreement as good practice between separate controllers and says it is not itself mandatory in that situation. The relevant roles still matter. Do not use that statement to dismiss processor-contract requirements or arrangements needed for joint control. First establish the actual function of each participant.

For the phone field, record the receiving party, service purpose, expected use and contact for problems. Set out how a wrong number is corrected and who investigates inappropriate contact. Include how the data moves between the shop, shipping platform and courier. Your explanation becomes more useful when it names the actual route instead of describing all suppliers as an unspecified third party.

1. 1

   Check the service requirement

   Ask what the number enables and whether a less intrusive route is reasonable for the delivery you are offering.

2. 2

   Identify the person and basis

   Distinguish buyer from recipient and document the appropriate basis for this person’s data. Complete the legitimate-interests test where that is the chosen basis.

3. 3

   Limit the transferred fields

   Share the justified delivery contact rather than a complete customer export. Verify the recipient and the secure route.

4. 4

   Prepare exceptions

   Give dispatch staff an instruction for missing numbers, corrections and customer objections. Review the decision when a service or purpose changes.

How does this apply when someone else packs your AirPost orders? #

AirPost’s product copy describes local senders holding your stock, packing orders and taking parcels to a parcel point. Its order copy identifies recipient email and phone as contacts for tracking and delivery messages. Before outsourcing your shop’s shipping, ensure that the selected service and your handling of those fields fit your assessment. This article does not promise an automatic lawful-basis check or a universal service without contact requirements.

The published euro components, checked in the constants on 14 October 2026, give a calculation of €2.25 recommended packing compensation plus €0.85 platform fee: €3.10 for those components. This is a euro calculation, not a converted sterling quote. Carrier postage, materials and stock transport are additional; the sender’s agreed compensation can differ. Price comparison does not decide which customer contact data may be shared.

If several senders may fulfil an order, also read how order broadcast works. Give the person carrying out the task a clear contact-data instruction. A wider choice of packers should not become a reason to distribute a larger customer file than the task needs.