GDPR access: which shipping recipients must your shop name?

A customer asks which companies received their address and delivery details. Your privacy notice says that you use logistics partners. Your order screen shows a courier brand. Neither necessarily tells the full story: the order may also have passed through a shipping platform and a separate packing provider. To answer properly, reconstruct what happened to this customer’s data rather than listing every supplier your shop has ever used.

This article addresses EU GDPR duties for an online seller, including a seller operating across EU markets. It does not apply the EU judgment as a statement of current UK law. The official regulation, Court communication and EDPB guidance were opened on 14 October 2026. The tables describe a practical response process; they do not claim that a shipping platform automatically produces a complete access-response export.

Why is a privacy-notice category not always enough? #

Article 15 gives the individual a right to information about the recipients or categories of recipients to whom their data has been or will be disclosed. In C-154/21, concerning Österreichische Post, the Court of Justice explained that the individual can obtain the actual identity of recipients. Where those recipients can be identified, the controller cannot simply choose the vaguer answer because it is easier.

The EDPB access guidelines, particularly paragraphs 116–118, reflect that distinction. A privacy notice describes the processing arrangements in advance. An access response concerns the individual’s actual circumstances. A category that was informative before dispatch can therefore be insufficient once you know which organisation received this order’s details.

Which shipping records should you search? #

Start with the customer’s identity and the scope of the request. Match relevant orders using the information you already hold, such as the account, order reference and delivery details. Check for changed addresses or multiple recipient contacts. A customer who asks for all shipping data may have more than one order or may have dealt with your support team about a failed delivery.

Do packing providers count even when they are processors? #

Article 4 number 9 defines a recipient by disclosure of personal data. Processor status does not make a provider disappear from the recipient question. If a separate packing provider receives the customer’s name and address to perform your order, consider that disclosure when preparing the answer. Distinguish the provider’s identity from irrelevant personal contact details of individual staff.

Describe the receiving party accurately. A platform, an independent packer and a parcel carrier can perform different functions. Explain which data each received and for what part of the order. Do not call everyone a warehouse when the order was packed elsewhere. Do not say an entire list of candidates received the address merely because several could potentially have taken the task.

What information belongs beside the recipient names? #

Article 15 also covers the processing purposes, data categories, retention period or criteria, relevant rights, complaint information and the source where data was not collected from the individual. Provide a copy of the personal data being processed. For a dispatch request, that can include the relevant order contact fields and personal information in associated records. A list of courier names is only one part of the response.

Make the answer understandable. Separate the address supplied at checkout from a later corrected address. Explain whether a number belongs to the buyer or a different recipient, rather than merging both into one unexplained field. If different records have different retention rules, describe those rules in relation to the records. A general phrase about keeping everything for statutory periods can leave the customer unable to understand the actual arrangement.

Avoid sending an unfiltered export containing other customers’ orders. Article 15 paragraph 4 protects the rights and freedoms of others in relation to the copy. Review shared documents and attachments, remove unrelated personal information where appropriate, and explain relevant limitations. The presence of another person’s data in one file is not a reason to abandon the whole request.

How do you manage the one-month response period? #

Article 12 paragraph 3 requires action without undue delay and within one month of receiving the request. One month is not a universal thirty-day period. Record the receipt date and the applicable deadline, then allocate the search immediately. The request does not need to arrive under a special legal heading for you to recognise that the customer is asking for access to personal data.

The period may be extended by two further months where necessary because of complexity and the number of requests. You must tell the customer about the extension and its reasons within the original month. Waiting for a packing provider is not automatically a sufficient explanation. Set a response route with your processors in advance so their assistance arrives early enough for you to assess and assemble the answer.

Article 12 paragraph 6 permits additional identity information where you have reasonable doubts. Make that request proportionate to the actual doubt. A parcel enquiry from a familiar authenticated account does not automatically justify collecting a passport scan. Check whether existing account and order information can resolve the issue safely. Sending customer data to an unverified requester would create a separate problem.

1. 1

   Recognise and record the request

   Note its date, scope and the customer identity information available. Assign one person to coordinate the answer and identify any genuine need for clarification.

2. 2

   Reconstruct the order’s disclosures

   Search dispatch, packing and relevant support records. Obtain provider assistance and distinguish actual receiving entities from merely available suppliers.

3. 3

   Prepare the data and explanation

   Provide relevant personal data and the Article 15 information. Check attachments for other people’s information and clarify unresolved factual limits.

4. 4

   Send and document the response

   Use an appropriate verified route. Record the response, any timely extension and its reason, and follow up separately on corrections or other rights the customer requested.

What if you cannot identify a recipient or the request is excessive? #

The Court’s rule permits categories where identifying recipients is impossible, and where the controller demonstrates a manifestly unfounded or excessive request. Do not treat an inconvenient search as proof of impossibility. Investigate records and provider assistance first. If a future recipient has not yet been selected, explain that position accurately rather than inventing a company name.

Article 12 paragraph 5 places the burden of demonstrating a manifestly unfounded or excessive request on the controller. A customer asking about several deliveries is not excessive merely because your records are spread across systems. Document the actual reasons for any restriction. Explain a refusal and the available complaint or judicial routes within the applicable period, as required by Article 12 paragraph 4.

Ordinary access information and the first copy are free. The regulation contains limited provisions for fees in specified circumstances, including certain additional copies and manifestly unfounded or excessive requests. Do not convert routine administrative work into an automatic access fee. A predictable search process is a better response to scattered shipping records than charging every customer who asks where their data went.

What changes if the customer asks you to correct shared shipping data? #

Article 19 requires communication of rectification, erasure or restriction to each recipient to whom the data was disclosed, unless impossible or involving disproportionate effort. It also requires information about those recipients if the individual asks. That is another reason to keep recipient information usable. A correction to your shop’s order table does not by itself establish that an earlier courier or packing record has been corrected.

How do you prepare recipient records for AirPost fulfilment? #

AirPost’s product copy describes local senders keeping stock, packing and handing over parcels. The order copy says the address appears after a sender takes the order. When you use local shipping for your shop, record the actual fulfilment assignment and relevant service providers. This is preparation for your response duty, not a claim that AirPost supplies a complete Article 15 report automatically.

For a regular parcel, the constants checked on 14 October 2026 give €3.00 recommended packing compensation plus €0.85 platform fee, totalling €3.85. Postage, materials and stock transport are outside this calculation, and the agreed packing compensation can differ. These are euro shipping components; they are not a fee for the customer’s access response or a claimed price for legal compliance.

The operational context is explained in order broadcast to multiple senders. Use the actual accepted assignment when reconstructing a disclosure. A possible packer and the person who received the customer details are different facts, and your answer should reflect the records for the order in question.