Not long ago, the UK automotive industry and its in-vehicle data protection practices – or lack thereof – felt like a regulatory free-for-all, writes Martin Wilson, VP of UK & EU partnerships at Privacy4Cars.
Only recently has it become more concrete what UK automotive businesses’ obligations truly are under GDPR: controllers of vehicles must delete personal data in vehicles before onward use.
But, the obligations weren’t always properly understood or implemented, and the complexity created real risk for individuals, businesses and the industry as a whole.
In fact, my experience working with UK automotive businesses across all sectors, including fleets, wholesale, finance, rental agencies and dealerships, was that most UK automotive businesses struggled to implement GDPR as it related to their specific line of business.
Time and time again I was being asked to clarify, educate and explain not only the nuances of GDPR as it related to specific automotive businesses, but the potential business implications of failing to meet compliance – both for the business itself, partners in the remarketing chain and individuals in the UK.
And perhaps most importantly, I was repeatedly asked how business can take action on this, in accordance with the regulation’s requirements for technical, objective measures.
Bringing clarity to the industry
To bring clarity to the industry, my team and I reached out to the ICO, and its Business Advice Service, earlier this year to help definitively answer the many questions I was receiving about how GDPR must be put into practice by the automotive industry.
Our journey to carve out clarity, and the industry impact of doing so, is featured in a recent case study within the ICO’s 2026 ‘Enabling Businesses in the UK Economy’ business report.
To summarise our communications with the ICO, we were told that passing of the vehicle to another user without deletion of the personal data held on its systems could amount to unlawful processing and a personal data breach.
Deletion must use an objective, repeatable and auditable process, not rely on the best endeavours or knowledge of staff.
We finally have clear, concise guidance, directly from the source, that leaves no room for ambiguity regarding how to put GDPR obligations into practice.
The fastest and most practical way to compliance
Since receiving clarifications, I have started to share the information with UK automotive businesses, as well as respective trade associations, in an effort to help drive compliance with data protection regulations across the industry.
I’m pleased to say that I’m starting to see firsthand a shift among the industry in understanding, accepting and acting on their obligations to delete this personal data under GDPR using the required objective, technical measures.
Early adopters across the industry have already adopted effective measures to meet compliance and raise the bar, but there is still a long way to go before the industry as a whole rises to meet it.
And I believe the fastest and most practical way to bring the industry into compliance will be through the work and support of trade associations.
Trade associations as a driving force
UK trade associations, in fact, have become one of the greatest driving forces in sharing data deletion obligations with members.
As mentioned in the case study, National Association of Motor Auctions (NAMA) and Vehicle Remarketing Association (VRA) are two of the first UK associations that have crafted and supported a vehicle data deletion standard for their members to help meet their compliance requirements under GDPR.
It is my hope that more trade associations and their members will follow suit with similar objective measures, tools, education and guidance for their members to help put what is now clearly on paper into practice.
This will allow for necessary sweeping changes to happen quickly, efficiently and, most importantly, broadly across the UK automotive industry to meet the requirements of the regulation.
The time for uncertainty is over
The time for uncertainty is over.
Automotive businesses should act now to turn this regulatory clarity into practical, demonstrable compliance. That means reviewing how personal data is handled in every vehicle, putting objective, repeatable and auditable deletion processes in place before vehicles pass to another user, and ensuring those processes are backed by appropriate technical measures – not simply staff knowledge or best endeavours.
Businesses should assign clear responsibility, implement the right tools, maintain evidence of deletion and make these requirements part of their standard vehicle handover and remarketing processes. Trade associations can accelerate that change by setting clear standards and giving members the tools and guidance to meet them. The obligation is now clear; the priority for the industry must be action.
Author: Martin Wilson, vice president, partnerships – UK and EU, Privacy4Cars
Ensure you always receive AM insights. Make us a preferred source of news on Google