Every shipment file holds personal data: consignee names, home addresses, phone numbers, sometimes a passport or tax ID number. Three points matter under the EU, UK, Malaysian and Singapore rules. A forwarder is often a controller in its own right, not merely a processor. Sending a manifest to an overseas agent is usually an international transfer that needs a legal basis. And a misdirected email can start a breach clock of about 72 hours. This guide is current to November 2026. For technical controls, see cybersecurity basics for small forwarders; for payment diversion, see business email compromise in freight.
What personal data does a forwarder actually hold?
- Customer contacts: names, emails and phones of people at shippers and importers.
- Consignees: see who counts as consignee and notify party. A company name alone is generally not personal data; a named contact, sole trader or residential delivery is.
- Identity numbers: some destinations want an ID for clearance. Carrier and seller notices mention Brazil's CPF, South Korea's personal customs code and Indonesia's tax or ID number, sometimes a passport number for foreigners. Check the current requirement.
- Drivers and agents' staff: names, phone numbers, licence copies, plates and any ID copies gathered at onboarding, plus your own HR files.
Controller or processor: which is a forwarder?
Under the GDPR, a controller decides why and how personal data is used; a processor handles it on the controller's behalf. Many forwarders assume they are "just a processor". The European Data Protection Board (EDPB) rejects that shortcut in Guidelines 07/2020: the role follows what you actually do and can differ for each set of data. Where handling personal data is not the target of the service and the provider sets its own data practices, it may be a separate controller. The EDPB's example is a taxi firm given an employee's name by a company booking a pick-up. We found no regulator ruling on forwarders, so this is our reading by analogy:
- Your own customer contacts: you are the controller.
- Consignee data on a normal job: you are probably a controller, because you choose the agent, the systems and the retention period.
- Fulfilment or returns run on a client's order data and instructions: you may be a processor, which under Article 28 requires a written contract.
A contract label does not settle it, because the EDPB treats these as functional concepts. Agree the role in writing anyway, then make practice match.
Lawful basis: "contract" often does not cover the consignee
GDPR Article 6 needs a lawful basis for each use. Two assumptions need correcting:
- Contract (Article 6(1)(b)) applies only where the individual is party to the contract. The consignee on a commercial order is usually not party to your contract with the shipper, so legitimate interests (Article 6(1)(f)) is often the better fit, with a short written assessment.
- Legal obligation (Article 6(1)(c)) must be laid down in EU or Member State law under Article 6(3), or in domestic law under the UK GDPR. Your own customs declarations can qualify. A foreign customs rule does not qualify by itself, so an ID number collected for another country's clearance needs a different basis.
Malaysia differs. Its general principle starts from consent, with exceptions including a contract with the individual and a legal obligation, and Linklaters' country guide lists no legitimate-interests ground. Ask a Malaysian adviser how to handle consignees who never dealt with you.
Why a manifest sent to an overseas agent is a transfer
The EDPB treats something as a transfer when three tests are met: the exporter is subject to the GDPR for that processing; it makes the data available to a separate controller or processor; and that recipient is in a third country. A manifest emailed to your Shanghai agent meets all three. So does a login to your freight system, because remote access counts, even view-only. The ICO's UK test is similar. Chapter V then offers three routes:
- Adequacy. As of November 2026 the European Commission's list includes the UK, Japan, South Korea, Switzerland, Brazil, Canada (commercial organisations) and US organisations in the EU-US Data Privacy Framework. Malaysia, Singapore, China, India and the UAE are not on it. The UK keeps its own list.
- Safeguards. For the EU, the standard contractual clauses in Implementing Decision (EU) 2021/914. For the UK, the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU clauses. Since 5 February 2026 the UK test is that protection must be "not materially lower" than under UK law. The ICO has signalled updates to both documents, so check for the current versions.
- Derogations (Article 49). One covers a transfer necessary for a contract made in the individual's interest, which suits a consignee. It is limited to occasional transfers, and the EDPB says those occurring regularly within a stable relationship do not qualify. A one-off job may fit. Weekly consolidations through your regular agent do not, so put the clauses in place with every regular agent outside an adequate country.
If you are outside the EU and UK, the GDPR reaches you directly only under Article 3, for example if you offer services to individuals in the EU. More often you meet it by contract: your European agent is the exporter and will ask you to sign the clauses, which bind you as importer.
Malaysia: the PDPA 2010 after the 2024 amendments
The Personal Data Protection (Amendment) Act 2024 commenced in stages, per Rajah and Tann's note on the gazetted notice:
- 1 April 2025: "data users" became "data controllers", the security principle reached data processors directly, the top penalty rose to RM1,000,000 or three years in prison, and the transfer whitelist was removed.
- 1 June 2025: mandatory breach notification (section 12B), data portability and data protection officers. The Commissioner's guideline requires a DPO above 20,000 data subjects, above 10,000 for sensitive data including financial information, or for regular and systematic monitoring. A long consignee history can pass 20,000.
Transfers now run under section 129 and Guideline 3/2025 of 29 April 2025. One condition is enough, including a substantially similar law or adequate protection (a transfer impact assessment lasts up to three years), consent, necessity for a contract, or reasonable precautions such as contractual clauses. "Necessary" cannot rest on industry practice; the guideline's proper example is a travel agency booking accommodation abroad. You must also keep a record of each recipient.
Singapore at a high level
Singapore's PDPA 2012 allows transfers overseas only under prescribed requirements (section 26). The 2021 Regulations look to legally enforceable obligations, such as a contract, or specified certifications, and the PDPC recognises the ASEAN Model Contractual Clauses. Section 4(5) takes business contact information out of most duties, which covers many shipper contacts but not a consignee's home address.
Retention: customs records versus deleting personal data
These rules do not conflict, but only part of the file gets the longer period. GDPR Article 5(1)(e), Malaysia's retention principle and Singapore's section 25 all say to keep personal data no longer than needed, and a legal duty to keep a record is a good reason. The US generally requires five years from entry under 19 CFR 163.4, and periods elsewhere vary (see the import records you must keep). That does not justify keeping a passport scan in a mailbox for a decade. Check with your broker, then set one schedule by document type that also covers email and shared drives.
Breach response: who must be told, and how fast
| Regime | Notify the regulator when | Deadline | Tell individuals |
|---|---|---|---|
| EU and UK GDPR, Articles 33 and 34 | Any breach, unless unlikely to create risk | Where feasible, within 72 hours of becoming aware | If high risk, without undue delay |
| Malaysia, section 12B and guideline of 25 February 2025 | Significant harm, including financial loss, identity fraud risk, or more than 1,000 people | As soon as practicable and within 72 hours | If significant harm (scale alone is not enough), within 7 days of notifying the Commissioner |
| Singapore, Part 6A | Significant harm, or 500 or more people | 3 calendar days after assessing it as notifiable (assess within 30 days) | As soon as practicable where required |
The Malaysian guideline says 72 hours "from the occurrence", but its worked examples and the notification form count from when the controller knows. Work to the earlier time. In the EU, the Digital Omnibus proposal would lengthen the deadline (reported as 96 hours). The Council agreed its position on 21 October 2026, but it is not law, so Article 33 still says 72 hours.
A breach does not need a hacker. Malaysia's guideline gives a customer statement emailed to the wrong person as a notifiable example, so a manifest sent to the wrong agent needs assessing too. A compromised mailbox is usually also a personal data breach, and one incident can start several clocks. Under the GDPR a processor tells its controller without undue delay. Malaysia's guideline makes controllers require the same by contract and keep a breach register for at least two years.
What to put in agent agreements
Add a short data annex to your agency agreement, and ask about these points when vetting an overseas agent:
- Each party's role, and the purposes the agent may use the data for.
- The transfer mechanism: clauses attached, or the reason none is needed.
- Breach notice within a fixed time. 24 hours is a commercial choice, not a legal rule, and it protects your 72.
- Security basics, limits on subcontractors, and deletion when the relationship ends.
Cheap steps that cut most of the risk
- Email discipline: turn off address autocomplete, send one line instead of a whole manifest, and share ID documents by secure link.
- Access limits: agents see only their own shipments, and only customs staff open the ID folder.
- Delete ID scans: ask only when the destination requires it, then remove them monthly once clearance is complete, unless a retention rule applies.
- Tell people: name consignees and overseas agents in your privacy notice.
What to do next
- Draw a one-page map: what data, where it sits, who receives it and in which country.
- List regular agents outside adequate countries and put clauses in place, busiest lanes first.
- Write a one-page breach plan: who decides, and which regulators apply.
- Set a retention schedule, delete old ID scans, and take local advice if you handle many residential deliveries.
When you need agents in a new market, more than 29,300 logistics companies are searchable by country and service in the CargoLinked directory, and the public requests board lists freight that shippers have posted for forwarders to quote on directly.
This article is general information as of November 2026, not legal advice. Confirm your position with the relevant regulator or a qualified lawyer.
