Customer privacy notice (motor trade)

What you need to know

The plain-English guidance that comes with this document.

• Garages hold real customer data — this is your GDPR notice. Names, contact details, vehicle registrations and service history are all personal data under UK GDPR, and you're required to tell customers, in plain language, what you hold and why. Display this or hand it over (a line on your job card pointing to it works well).
• You're the "data controller". That's why the notice carries your business name and address. If you appoint someone to handle data questions, add their contact.
• MOT and service reminders need consent. Texting or emailing customers when an MOT or service is due is genuinely useful — but it's marketing, so get their agreement and give them an easy opt-out. Don't assume a repair customer wants ongoing messages.
• Mind vehicle-keeper and DVLA data. If you look up or hold keeper information, or use DVLA data, handle it carefully and only for legitimate purposes — misusing it is a serious matter.
• Keep it secure, and don't hoard it. Lock away paper records or use a password-protected system, don't leave customer details on the counter, and clear out what you no longer need. A pile of old job cards anyone could read is a breach waiting to happen.
• Applies UK-wide. UK GDPR and the Data Protection Act apply across the whole UK. The ICO has free, small-business-friendly guidance if you want to go further.