AutoSmart GuidebooksWhat this guidebook covers
A dealer holds more data than many banks: ID cards, driving licences, bank details, addresses and vehicle data, passed on to the importer, banks and insurers. GDPR (RODO in Polish) allows fines of up to €20 million or 4% of worldwide turnover. UODO (the Personal Data Protection Office) fined McDonald's Polska PLN 16.9 million over gaps in its risk analysis and security.
This guidebook covers 5 data protection standards for dealers, with 12 checkpoints: marketing consent, the information clause, customer rights requests, data security with breach reporting within 72 hours, and processing agreements and retention. The guidebook PDF is in Polish.
The 5 data protection standards
Open a standard to see the law behind it, what is checked, what it can cost and the evidence. Ideal fix times are counted from audit submission.
DAN-01Marketing consentImmediate
- The law
- GDPR (Regulation (EU) 2016/679) · Personal Data Protection Act 2018 · GDPR arts. 6–7 · Electronic Communications Law: consent to marketing
- What we check
- Marketing texts and emails go only to customers who gave separate consent, not pre-ticked, and opting out is easy.
- What it can cost
- A fine of up to €20 million or 4% of turnover.
- Evidence
- Forms + test
DAN-02Information clause30 days
- The law
- GDPR (Regulation (EU) 2016/679) · Personal Data Protection Act 2018 · GDPR arts. 13–14: duty to inform
- What we check
- Customers know what data we collect, why, who we pass it to (importer, banks, insurers) and how long we keep it.
- What it can cost
- A fine of up to €20 million or 4%.
- Evidence
- Privacy notices
DAN-03Customer rights requests7 days
- The law
- GDPR (Regulation (EU) 2016/679) · Personal Data Protection Act 2018 · GDPR arts. 12, 15–22: data subject requests
- What we check
- Requests for access, correction, deletion and objection are logged and dealt with within a month.
- What it can cost
- A complaint to UODO and a fine of up to €20 million.
- Evidence
- Request log
DAN-04Data security24 hours
- The law
- GDPR (Regulation (EU) 2016/679) · Personal Data Protection Act 2018 · GDPR arts. 32–34: security and breach notification within 72 hours
- What we check
- Customer documents (ID cards, driving licences, bank details) are secured, systems have MFA, and breaches are reported to UODO within 72 hours.
- What it can cost
- A fine like McDonald's: PLN 16.9 million, plus customer claims.
- Evidence
- Photos + settings
DAN-05Processing agreements and retention30 days
- The law
- GDPR (Regulation (EU) 2016/679) · Personal Data Protection Act 2018 · GDPR art. 28 processing agreements · art. 5(1)(e) storage limitation
- What we check
- Suppliers (DMS, CRM, call centre) have data processing agreements, and old data is deleted on schedule.
- What it can cost
- A fine for both the controller and the processor.
- Evidence
- Agreements + schedule
How to run a Polish GDPR (RODO) data protection audit, step by step
- Confirm what applies. Map every channel where customer data is collected and everyone it is passed to; data sent to the importer needs a legal basis and must be described in the information clause.
- Walk the site, standard by standard. Score each of the 12 checkpoints Pass, Fail or N/A. N/A only where the standard rules it out, with the reason recorded. Check consent forms and test an opt-out, collect the clauses from every channel, walk the showroom to see where customer files are kept, and check MFA on the DMS and CRM.
- Capture the evidence. A pass counts only with proof captured at the time of the audit: consent forms and opt-out test results, information clauses, the requests register, photos and system settings, processing agreements and the deletion schedule.
- Give every fail an owner and a fix time. Record what you saw and who owns the fix. Each standard carries an ideal fix time, from immediate to 30 days, counted from audit submission (see the table above).
- Fix it, then prove it. The site fixes the cause and uploads proof of closure; the auditor checks the proof before closing the finding.
- Re-check at the next audit. Confirm closed findings stay closed, and look for the same fail at your other sites so one gap doesn't repeat across the network.
Who this guidebook is for
- Boards: the size of the risk
- Marketing and sales: collecting consent correctly
- Data protection officers (IOD) and auditors: testing consent and requests
A reference document, not legal advice. Fines and rules change: check the current text with the regulator or your legal adviser before acting.
