gdpr germany
Is the ZIP Code allowed as part of a ordernumber
<p>We have a Webshop and want to have the Customers ZIP Code within our Order Number.
Is this against the GDPR?</p>

<p><strong>Potentially, yes.</strong> I assume you're intending to use a combination of ZIP+sequence.</p>

<p>If the ZIP code is unique to that customer, then no problem.</p>

<p>If the ZIP code is common to a large number of possible customers, or your sequence runs over a large number of ZIP codes, then possibly not a problem.</p>

<p>If the ZIP code is common to a <em>few</em> possible customers, and possibly to an identifiable premises (such as an apartment building), and you only run the sequence within that ZIP code, then you definately have a problem.</p>

<p>Alice looks at her order history and sees her orders are numbered ZIP001, ZIP002, and ZIP004.</p>

<p>She may then surmise that someone else in her ZIP code has placed order number ZIP003. </p>

<p>Alice concludes that Brenda downstairs also buys what you sell. She's rather upset, because she realises that Brenda downstairs also probably knows that Alice buys what you sell. </p>

<p>You have two customer complaints, and a data breach. </p>

<p><strong>Other problems include customer history</strong> - if you retain your order number in your customer history you may be storing customers' previous addresses, which may be <strong>excessive data gathering</strong>. If a customer was in hospital, a refuge, or similar establishment, for a while and placed an order from that location, that may be <strong>sensitive personal data</strong> which you emphatically should not store for longer than necessary. It may also cause a customer distress if she looks through her previous order history and is reminded by the ZIP code in the order number that she placed that order from hospital, refuge, or similar. </p>

<p><strong>You also have other practical problems using ZIP</strong> (or equivalent, ie postal) <strong>codes within your internal order number</strong>:</p>

<ul>
<li>worldwide, many customers don't have ZIP codes or equivalent</li>
<li>some customers have multiple ZIP codes for different buildings or delivery points</li>
<li>some customers have different ZIP codes for delivery by postal service or delivery by courier</li>
<li>in some countries, ZIP codes or equivalent will <em>not</em> be in your local character set. You <em>must</em> preserve the local character set in the address for reliable delivery. Your accounting system may not accept your order number automatically from your order processing system. In some countries, ZIP codes or equivalent will be written right-to-left with the significant data at the right. In some countries ZIP codes have one or more leading zeroes. These zeroes must be retained for postal delivery.</li>
</ul>

<p><a href="https://www.mjt.me.uk/posts/falsehoods-programmers-believe-about-addresses/" rel="nofollow noreferrer">https://www.mjt.me.uk/posts/falsehoods-programmers-believe-about-addresses/</a></p>
