What this guidebook covers
Dealers hold driving licences, payslips, bank details, addresses and vehicle and telematics data. Since February 2026, fines for marketing and cookie breaches have the same ceiling as UK GDPR: £17.5 million or 4% of turnover.
This guidebook covers 7 data standards with 20 checkpoints: marketing consent, cookie consent, the privacy notice and lawful basis, subject access requests, security and breach reporting, retention and disposal, and the ICO fee.
The 7 data protection standards
| Code | Standard | Ideal fix time |
|---|---|---|
| DAT-01 | Marketing consent | Immediate |
| DAT-02 | Cookie consent | 7 days |
| DAT-03 | Privacy notice and lawful basis | 30 days |
| DAT-04 | Subject access requests | 7 days |
| DAT-05 | Security and breach reporting | 24 hours |
| DAT-06 | Retention and disposal | 30 days |
| DAT-07 | ICO fee paid | 7 days |
How to run a UK data protection and marketing audit, step by step
- Confirm what applies. Map the marketing channels, website, deal files, CRM and service data, including data shared with manufacturers under OEM agreements.
- Walk the site, standard by standard. Score each of the 20 checkpoints Pass, Fail or N/A. N/A only where the standard rules it out, with the reason recorded. Check consent wording and opt-outs in recent marketing, test the website's cookie banner, and look at where deal files are kept.
- Capture the evidence. A pass counts only with proof captured at the time of the audit: consent records, the cookie banner, the privacy notice, the access request log and the ICO fee receipt.
- Give every fail an owner and a fix time. Record what you saw and who owns the fix. Each standard carries an ideal fix time, from immediate to 30 days, counted from audit submission (see the table above).
- Fix it, then prove it. The site fixes the cause and uploads proof of closure; the auditor checks the proof before closing the finding.
- Re-check at the next audit. Confirm closed findings stay closed, and look for the same fail at your other sites so one gap doesn't repeat across the network.
Who this guidebook is for
- Dealer principals
- Marketing and CRM managers
- Data protection leads
- Auditors
A reference document, not legal advice. Fines and rules change: check the current text with the regulator or your legal adviser before acting.
