DIRECT CARRY · COURIER INDUCTION
Customer information: a short courier induction
Practical UK GDPR and data protection basics for Direct Carry jobs
Allow about 10 minutes to read the guidance and answer six short scenarios. Take longer if you need to; there is no countdown.
A courier can see names, addresses, phone numbers, travel details and identity documents. These can identify someone and are personal information. Protecting them is part of looking after the delivery.
Every new Direct Carry courier completes this induction, including couriers who have already had GDPR training. Read the six guidance cards, then choose one answer for each scenario. The examples apply ICO guidance to Direct Carry's working practices. Ask Operations if a real situation is unclear.
This is a Direct Carry induction exercise, not an accredited qualification, ICO certification or confirmation that a courier has been approved for assignments. It supplements the separate courier field handbook.
Your training record
Open your personal training link to record completion.
Read the six guidance cards
1. Use only what the job needs
Use customer information only to carry out the authorised job. Read the details you need; do not browse other people's information out of curiosity. A passport is valuable personal information even when it is being carried inside a sealed envelope.
Do not open or photograph confidential contents for convenience. Record only the handover evidence Operations has requested. A package reference, time and authorised recipient confirmation will often be more appropriate than an image of an identity document. Follow lawful screening instructions and tell Operations about any inspection.
2. Check who is receiving it
Match the recipient and destination to the current job brief using the agreed verification method. A convincing caller, receptionist or WhatsApp message does not authorise a different handover.
If the name, address or authority differs, keep the item secure and call Operations through a known contact route. Do not send more personal information to prove that you have the right package. Record facts accurately and ask Operations to correct an error rather than guessing.
3. Keep messages and your phone secure
Use the Operations contact or thread agreed for the job. Before sending, check the recipient, attachment and wording. Send only the information needed. Do not put customer documents, passport details, access codes or private links into public groups, social media or an unapproved app or AI chat.
Keep your phone updated and protected with a strong screen lock. Shield the screen and avoid discussing customer details where others can overhear. Do not forward an entire conversation when a short factual update will do. A messaging app's encryption does not make the wrong recipient safe.
4. Use your own portal access
Keep your personal courier code private. It opens the jobs assigned to you; it is not a shared team login. If a job is missing, ask Operations to check the assignment. Never borrow another courier's code.
Choose the milestone that has actually happened, add any needed explanation, then select Save delivery update. Wait for the saved confirmation. Notes can be visible to the customer, so exclude passport numbers, bank details and private incident reports.
Location sharing is your choice. Starting it shares your position with Direct Carry and the authorised customer tracker for that job. Stop it when it is no longer needed. Updates can stop when the page is hidden, the phone locks or the connection drops. Return and restart when appropriate. WhatsApp Live Location does not update this tracker.
5. Report mistakes or loss straight away
A lost phone or passport, a message sent to the wrong person, an exposed access code or an unauthorised handover can put someone at risk. Tell Operations immediately, even if you are unsure whether anyone saw the information.
Call the known support number. Give the job reference, what happened, when you noticed, what information may be involved and any containment already attempted. Keep the remaining item and information secure. Follow instructions to revoke access or contain the disclosure; do not forward sensitive evidence to a group or delete incident evidence to hide the mistake.
Operations records and assesses the incident and coordinates any notification. Reportable breaches must reach the ICO without undue delay and within 72 hours of awareness where feasible. This is not a 72-hour waiting period for couriers. People affected must also be informed promptly where the risk is high.
6. Finish without keeping extra copies
After the approved proof and job record are safely saved, follow Operations' retention instructions for any permitted local notes, downloads or photos. Do not keep a personal archive of customer documents or contacts. If a copy was authorised, check whether it also went into photo backup, downloads or recently deleted storage and follow the approved removal process.
Do not delete the official job history or incident evidence yourself. If someone asks for their information to be corrected, supplied or deleted, pass the request promptly to Operations. Do not promise a result or send records to an unverified requester.
Help and further reading
For a suspected privacy incident, call Operations immediately when safe. For immediate danger, use the local emergency service first.
020 8064 2664 · info@directcarry.co.uk
Read and sign your separate confidentiality agreement
Courier field handbook — The longer handbook covers custody, travel, safety, handovers and disruption. It remains separate from this short privacy exercise.