AutoSmart GuidebooksWhat this guidebook covers
The AEPD (Spanish Data Protection Agency) fined Vodafone €8.15 million for marketing calls and messages sent without consent. A dealer handles ID cards, payslips, finance data and camera footage. The GDPR allows fines of up to €20 million or 4% of worldwide turnover, whichever is higher, and the AEPD can ban the processing.
This guidebook covers 6 data protection standards for dealers and workshops, with 16 checkpoints: marketing consent, information to customers, customer rights, security and breaches (reported within 72 hours), lawful video surveillance, and contracts with data processors. The guidebook PDF is in Spanish.
The 6 data protection standards
Open a standard to see the law behind it, what is checked, what it can cost and the evidence. Ideal fix times are counted from audit submission.
DAT-01Marketing consentImmediate
- The law
- GDPR (Regulation (EU) 2016/679) · Organic Law 3/2018 (LOPDGDD) · GDPR arts. 6–7 · LSSI art. 21: electronic commercial communications · LOPDGDD art. 23: Robinson List
- What we check
- Marketing emails, texts and WhatsApp messages are sent only with separate consent that isn't pre-ticked. Unsubscribing is easy, and the Robinson List is checked before calling non-customers.
- What it can cost
- Up to €20 million or 4% of turnover.
- Evidence
- Forms + test
DAT-02Information to customers30 days
- The law
- GDPR (Regulation (EU) 2016/679) · Organic Law 3/2018 (LOPDGDD) · GDPR arts. 13–14 · LOPDGDD art. 11: layered information
- What we check
- Customers know what data we collect, what for, who it is passed to (the brand, finance and insurance companies) and how long it is kept.
- What it can cost
- Up to €20 million or 4%.
- Evidence
- Privacy notices
DAT-03Customer rights7 days
- The law
- GDPR (Regulation (EU) 2016/679) · Organic Law 3/2018 (LOPDGDD) · GDPR arts. 12, 15–22: access, rectification, erasure and objection
- What we check
- Requests for access, rectification, erasure and objection are logged and answered within a month.
- What it can cost
- Up to €20 million or 4%.
- Evidence
- Request log
DAT-04Security and breaches24 hours
- The law
- GDPR (Regulation (EU) 2016/679) · Organic Law 3/2018 (LOPDGDD) · GDPR arts. 32–33: security of processing · breach notification within 72 hours
- What we check
- Customer files (ID cards, payslips, finance) are locked away and DMS logins are personal. Breaches are reported to the AEPD within 72 hours.
- What it can cost
- Up to €10 million or 2% for security failures.
- Evidence
- Photos + user list
DAT-05Lawful video surveillance7 days
- The law
- GDPR (Regulation (EU) 2016/679) · Organic Law 3/2018 (LOPDGDD) · LOPDGDD art. 22: processing for video surveillance
- What we check
- Cameras have a visible information sign, don't record rest areas or changing rooms, and footage is deleted within a month at most.
- What it can cost
- Up to €20 million or 4% in serious cases.
- Evidence
- Photos + settings
DAT-06Data processors30 days
- The law
- GDPR (Regulation (EU) 2016/679) · Organic Law 3/2018 (LOPDGDD) · GDPR art. 28: processor contracts · retention periods
- What we check
- There is a processor contract with the DMS, the call centre, the marketing agency and the lead supplier. Data is deleted when its period ends.
- What it can cost
- Up to €10 million or 2%.
- Evidence
- Contracts
How to run a Spanish data protection compliance audit, step by step
- Confirm what applies. List every channel that collects customer data and every supplier that handles it (DMS, call centre, marketing agency, lead provider). Business (B2B) contacts are also personal data when they identify a person.
- Walk the site, standard by standard. Score each of the 16 checkpoints Pass, Fail or N/A. N/A only where the standard rules it out, with the reason recorded. Review the forms and test the unsubscribe link, sample 5 rights requests, check cabinets, desks and DMS users, and walk the cameras and the recorder settings.
- Capture the evidence. A pass counts only with proof captured at the time of the audit: consent forms and the unsubscribe test, privacy notices, the requests log, photos and the DMS user list, camera settings and processor contracts.
- Give every fail an owner and a fix time. Record what you saw and who owns the fix. Each standard carries an ideal fix time, from immediate to 30 days, counted from audit submission (see the table above).
- Fix it, then prove it. The site fixes the cause and uploads proof of closure; the auditor checks the proof before closing the finding.
- Re-check at the next audit. Confirm closed findings stay closed, and look for the same fail at your other sites so one gap doesn't repeat across the network.
Who this guidebook is for
- Management and DPO: understand the risk
- Marketing and sales: know when a customer can be contacted
- Auditors: review forms, cabinets and cameras
A reference document, not legal advice. Fines and rules change: check the current text with the regulator or your legal adviser before acting.
