Close Brothers Motor Finance has issued its top five tips to help car dealers achieve GDPR compliance after identifying a need for a quick and easy guide to the new legislation.

The automotive finance specialist delivered its data guidance after its Dealer Satisfaction Survey found that almost a fifth of car dealers (17%) see legislation and regulation as the single greatest threat to their business over the coming year.

Here are Close Brothers’ top tips to help motor retail businesses become GDPR compliant:

1)    Make a plan and have a timeline

The GDPR comes into force on May 25th, 2018, and applies to all UK organisations which hold or process personal data.

If you’re not compliant by then you could face huge administrative fines (up to 4% of global turnover or up to €20m).

It’s crucial that you make a plan of action towards compliance, and keep a record of what you do. The ICO have produced a guide on the 12 steps you should take now. You can find it here: https://ico.org.uk/media/1624219/preparing-for-thegdpr-12-steps.pdf

2)    Assess all personal data you hold and have access to

The GDPR sets out how we keep personal data and what we can and can’t do with it. For example, data must be “collected for specified, explicit and legitimate purposes”.

It is important to ensure that information is not captured without reason and that the customer knows how and where their data will be used.

Under the GDPR, you can still retain customer data, however you cannot retain personal data for any longer than is necessary, so if you do want to hold on to it, you need to have a valid reason for doing so.

3)    Review your privacy notice

The most common way to provide information about how you will use a customer’s personal data is in the form of a privacy notice.

Most companies already have a privacy notice, but there may be some changes required under the GDPR.

If you don’t have a privacy notice already, then you should create one.

It should be easy for the customer to understand, and explain, what you do with their data and why. If you do have one already, make sure you check through it to ensure that it’s easy to understand and covers any activity that you’ll be using the customers’ data in.

4)    Check your consent process

Make sure that you understand what personal data you collect and what for, or why you use it. You might not always need to gain consent if you have other lawful bases for collecting the data.

Direct marketing to individuals who are not your customers generally requires the individuals to have consented to hearing from you in the channel used (i.e., email, SMS, phone, post) and about the type of product or service you are marketing.

This means any web enquiry forms on your website and other ways of identifying leads will need to be reviewed to confirm appropriate consent language is in place.

You may be able to market to existing customers without explicit consent, if you are marketing related products or services to those already purchased, the individuals have an opportunity to opt out of future communications, and you stop marketing to anyone who does opt.

5)    Train your team

It’s important that you and your team understand what the GDPR is. To promote best practice, you should train all of your staff about the principles of the GDPR so that they understand the importance of protecting customer data.

Training is also one of the first things that the ICO might ask about if they were to investigate your business, so make sure you keep a record of any training you provide to your team.