{"id":1469,"date":"2026-10-13T12:47:02","date_gmt":"2026-10-13T12:47:02","guid":{"rendered":"https:\/\/autosmarts.co\/en\/guidebooks\/uk-data-protection-compliance-guidebook\/"},"modified":"2026-10-13T12:47:02","modified_gmt":"2026-10-13T12:47:02","slug":"uk-data-protection-compliance-guidebook","status":"publish","type":"guidebook","link":"https:\/\/autosmarts.co\/en\/guidebooks\/uk-data-protection-compliance-guidebook\/","title":{"rendered":"UK Data Protection and Marketing Compliance Guidebook for Automotive Companies"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\" id=\"overview\">What this guidebook covers<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Dealers hold driving licences, payslips, bank details, addresses and vehicle and telematics data. Since February 2026, fines for marketing and cookie breaches have the same ceiling as UK GDPR: \u00a317.5 million or 4% of turnover.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This guidebook covers 7 data standards with 20 checkpoints: marketing consent, cookie consent, the privacy notice and lawful basis, subject access requests, security and breach reporting, retention and disposal, and the ICO fee.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"standards\">The 7 data protection standards<\/h2>\n\n\n\n<figure class=\"wp-block-table as-papertable as-gbtable\"><table><thead><tr><th>Code<\/th><th>Standard<\/th><th>Ideal fix time<\/th><\/tr><\/thead><tbody><tr><td>DAT-01<\/td><td>Marketing consent<\/td><td>Immediate<\/td><\/tr><tr><td>DAT-02<\/td><td>Cookie consent<\/td><td>7 days<\/td><\/tr><tr><td>DAT-03<\/td><td>Privacy notice and lawful basis<\/td><td>30 days<\/td><\/tr><tr><td>DAT-04<\/td><td>Subject access requests<\/td><td>7 days<\/td><\/tr><tr><td>DAT-05<\/td><td>Security and breach reporting<\/td><td>24 hours<\/td><\/tr><tr><td>DAT-06<\/td><td>Retention and disposal<\/td><td>30 days<\/td><\/tr><tr><td>DAT-07<\/td><td>ICO fee paid<\/td><td>7 days<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"steps\">How to run a UK data protection and marketing audit, step by step<\/h2>\n\n\n\n<ol class=\"wp-block-list as-gbsteps\">\n<li><strong>Confirm what applies.<\/strong> Map the marketing channels, website, deal files, CRM and service data, including data shared with manufacturers under OEM agreements.<\/li>\n\n<li><strong>Walk the site, standard by standard.<\/strong> Score each of the 20 checkpoints Pass, Fail or N\/A. N\/A only where the standard rules it out, with the reason recorded. Check consent wording and opt-outs in recent marketing, test the website&#039;s cookie banner, and look at where deal files are kept.<\/li>\n\n<li><strong>Capture the evidence.<\/strong> A pass counts only with proof captured at the time of the audit: consent records, the cookie banner, the privacy notice, the access request log and the ICO fee receipt.<\/li>\n\n<li><strong>Give every fail an owner and a fix time.<\/strong> Record what you saw and who owns the fix. Each standard carries an ideal fix time, from immediate to 30 days, counted from audit submission (see the table above).<\/li>\n\n<li><strong>Fix it, then prove it.<\/strong> The site fixes the cause and uploads proof of closure; the auditor checks the proof before closing the finding.<\/li>\n\n<li><strong>Re-check at the next audit.<\/strong> Confirm closed findings stay closed, and look for the same fail at your other sites so one gap doesn&#039;t repeat across the network.<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"who\">Who this guidebook is for<\/h2>\n\n\n\n<ul class=\"wp-block-list as-gbwho\">\n<li>Dealer principals<\/li>\n\n<li>Marketing and CRM managers<\/li>\n\n<li>Data protection leads<\/li>\n\n<li>Auditors<\/li>\n<\/ul>\n\n\n\n<p class=\"as-gbnote wp-block-paragraph\">A reference document, not legal advice. Fines and rules change: check the current text with the regulator or your legal adviser before acting.<\/p>\n\n\n","protected":false},"excerpt":{"rendered":"<p>Marketing consent, cookies, privacy notices, access requests, security and retention: what the ICO checks at UK car dealers.<\/p>\n","protected":false},"featured_media":1854,"menu_order":23,"template":"","meta":{"footnotes":"","_as_region":"UK","_as_topic":"Data protection","_as_edition":"Edition 1 \u00b7 2026","_as_standards":"7","_as_checkpoints":"20","_as_pages":"12","_as_language":"","_as_law":"UK GDPR \u00b7 Data Protection Act 2018 \u00b7 PECR","_as_regulator":"Information Commissioner's Office (ICO)","_as_facts":"\u00a317.5M | or 4% of turnover: now the ceiling for marketing and cookie breaches too (Feb 2026)\n72 hours | to report a serious data breach to the ICO\n170M | car finance claim texts behind the ICO's search warrants (Jul 2026)","_as_pdf":1470,"_as_checklist_1":804,"_as_checklist_2":0,"_as_checklist_3":0,"_as_guide":0,"_as_solution":557},"class_list":["post-1469","guidebook","type-guidebook","status-publish","has-post-thumbnail","hentry"],"_links":{"self":[{"href":"https:\/\/autosmarts.co\/en\/wp-json\/wp\/v2\/guidebook\/1469","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/autosmarts.co\/en\/wp-json\/wp\/v2\/guidebook"}],"about":[{"href":"https:\/\/autosmarts.co\/en\/wp-json\/wp\/v2\/types\/guidebook"}],"version-history":[{"count":1,"href":"https:\/\/autosmarts.co\/en\/wp-json\/wp\/v2\/guidebook\/1469\/revisions"}],"predecessor-version":[{"id":1471,"href":"https:\/\/autosmarts.co\/en\/wp-json\/wp\/v2\/guidebook\/1469\/revisions\/1471"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/autosmarts.co\/en\/wp-json\/wp\/v2\/media\/1854"}],"wp:attachment":[{"href":"https:\/\/autosmarts.co\/en\/wp-json\/wp\/v2\/media?parent=1469"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}