AutoSmart GuidebooksWhat this guidebook covers
Dealers hold driving licences, payslips, bank details, addresses and vehicle and telematics data. Since February 2026, fines for marketing and cookie breaches have the same ceiling as UK GDPR: £17.5 million or 4% of turnover.
This guidebook covers 7 data standards with 20 checkpoints: marketing consent, cookie consent, the privacy notice and lawful basis, subject access requests, security and breach reporting, retention and disposal, and the ICO fee.
The 7 data protection standards
Open a standard to see the law behind it, what is checked, what it can cost and the evidence. Ideal fix times are counted from audit submission.
DAT-01Marketing consentImmediate
- The law
- UK GDPR · Data Protection Act 2018 · PECR 2003 as amended by the Data (Use and Access) Act 2025 · PECR regs 21–22 electronic marketing · soft opt-in rules
- What we check
- Marketing emails and texts go only to customers who opted in, or existing customers under the soft opt-in with an easy opt-out every time. Consent is never forced through terms and conditions.
- What it can cost
- Marketing fines were capped at £500,000. Since Feb 2026 they reach £17.5M or 4% of turnover.
- Evidence
- Consent records + test results
DAT-02Cookie consent7 days
- The law
- UK GDPR · Data Protection Act 2018 · PECR 2003 as amended by the Data (Use and Access) Act 2025 · PECR reg.6 cookies and similar technologies (with DUAA exemptions for some analytics)
- What we check
- The website asks before setting non-essential cookies (advertising, tracking), with "reject" as easy as "accept", and doesn't fire tags before a choice is made.
- What it can cost
- Cookie breaches now fall under the £17.5M / 4% ceiling, and every dealer website and portal is visible to the ICO.
- Evidence
- Browser test + screenshots
DAT-03Privacy notice and lawful basis30 days
- The law
- UK GDPR · Data Protection Act 2018 · PECR 2003 as amended by the Data (Use and Access) Act 2025 · UK GDPR Articles 5, 6, 13–14 transparency and lawful basis
- What we check
- Customers are told, when data is collected, what's collected, why, the lawful basis, who it's shared with (lenders, OEM, insurers) and how long it's kept.
- What it can cost
- Transparency failures fall in the higher tier: up to £17.5M or 4% of turnover.
- Evidence
- Notices + processing record
DAT-04Subject access requests7 days
- The law
- UK GDPR · Data Protection Act 2018 · PECR 2003 as amended by the Data (Use and Access) Act 2025 · UK GDPR Articles 12 and 15–22 data subject rights
- What we check
- Requests for access, correction or deletion are recognised in any form, logged and answered within one month (extendable only where allowed).
- What it can cost
- Missed deadlines lead to ICO complaints and enforcement notices, with fines up to £17.5M.
- Evidence
- Request log
DAT-05Security and breach reporting24 hours
- The law
- UK GDPR · Data Protection Act 2018 · PECR 2003 as amended by the Data (Use and Access) Act 2025 · UK GDPR Articles 32–34 security of processing and personal data breach notification
- What we check
- Customer data is protected (access control, MFA, encryption, locked paper files), and breaches are reported to the ICO within 72 hours where required.
- What it can cost
- Poor security is fined in the lower tier (up to £8.7M or 2%), and a breach brings customer claims on top.
- Evidence
- Settings + photos + procedure
DAT-06Retention and disposal30 days
- The law
- UK GDPR · Data Protection Act 2018 · PECR 2003 as amended by the Data (Use and Access) Act 2025 · UK GDPR Article 5(1)(e) storage limitation
- What we check
- There's a retention schedule for sales, finance, service and marketing data, and old records are deleted or shredded on schedule.
- What it can cost
- Keeping data too long is a principle breach in the higher tier: up to £17.5M or 4%.
- Evidence
- Schedule + certificates
DAT-07ICO fee paid7 days
- The law
- UK GDPR · Data Protection Act 2018 · PECR 2003 as amended by the Data (Use and Access) Act 2025 · Data Protection (Charges and Information) Regulations 2018
- What we check
- The dealership (each legal entity) pays the annual data protection fee to the ICO and keeps its registration details up to date.
- What it can cost
- Not paying the fee is a fixed penalty up to £4,350, and puts the business on the ICO's radar.
- Evidence
- Register screenshots
How to run a UK data protection and marketing audit, step by step
- Confirm what applies. Map the marketing channels, website, deal files, CRM and service data, including data shared with manufacturers under OEM agreements.
- Walk the site, standard by standard. Score each of the 20 checkpoints Pass, Fail or N/A. N/A only where the standard rules it out, with the reason recorded. Check consent wording and opt-outs in recent marketing, test the website's cookie banner, and look at where deal files are kept.
- Capture the evidence. A pass counts only with proof captured at the time of the audit: consent records, the cookie banner, the privacy notice, the access request log and the ICO fee receipt.
- Give every fail an owner and a fix time. Record what you saw and who owns the fix. Each standard carries an ideal fix time, from immediate to 30 days, counted from audit submission (see the table above).
- Fix it, then prove it. The site fixes the cause and uploads proof of closure; the auditor checks the proof before closing the finding.
- Re-check at the next audit. Confirm closed findings stay closed, and look for the same fail at your other sites so one gap doesn't repeat across the network.
Who this guidebook is for
- Dealer principals
- Marketing and CRM managers
- Data protection leads
- Auditors
A reference document, not legal advice. Fines and rules change: check the current text with the regulator or your legal adviser before acting.
