Understanding GDPR Lawful Basis for Vehicle Dealer Enquiries
Vehicle dealers in the UK must identify at least one of six lawful bases under GDPR before processing any buyer enquiry data. The three most relevant bases for dealer enquiries are legitimate interests (Article 6(1)(f)), consent (Article 6(1)(a)), and performance of a contract (Article 6(1)(b)). Most dealers rely on legitimate interests when responding to initial enquiries, as this basis permits processing necessary for the dealer's commercial interests provided those interests do not override the buyer's rights. Consent becomes relevant for marketing communications beyond the initial enquiry response, whilst contract performance applies when a buyer has committed to a purchase and the dealer needs their data to complete the transaction.
The choice of lawful basis determines what you can do with enquiry data, how long you can retain it, and what rights buyers can exercise. Getting this wrong exposes dealers to Information Commissioner's Office (ICO) enforcement action, fines up to £17.5 million or 4% of annual turnover (whichever is higher), and reputational damage that undermines buyer trust.
Why Legitimate Interests Is the Primary Basis for Enquiry Processing
Legitimate interests provides the most practical lawful basis for processing initial buyer enquiries about vehicles in stock. This basis recognises that dealers have a genuine commercial interest in responding to enquiries, and buyers reasonably expect a response when they contact a dealership. The lawful basis does not require explicit opt-in consent for the initial response, making it suitable for web forms, phone calls, and email enquiries where buyers initiate contact.
To rely on legitimate interests, dealers must conduct and document a Legitimate Interests Assessment (LIA) that demonstrates three elements. First, the processing must serve a legitimate interest (responding to commercial enquiries qualifies). Second, the processing must be necessary to achieve that interest (you cannot respond effectively without processing the enquiry data). Third, the buyer's interests and rights must not override your legitimate interests (responding to an enquiry a buyer voluntarily submitted rarely overrides their rights).
The LIA must be documented before you start processing enquiries under this basis. The assessment should identify what data you collect (name, contact details, vehicle preferences), why you need it (to respond to the enquiry and match vehicles), how long you retain it (typically 12-24 months for unconverted enquiries), and what safeguards you apply (access controls, encryption, staff training). This documentation proves compliance if the ICO investigates.
Legitimate interests covers the initial enquiry response and reasonable follow-up directly related to the enquiry. It does not permit ongoing marketing communications to buyers who have not purchased. Once you move beyond responding to the specific enquiry, you need either consent for marketing or a contract basis for post-purchase communications.
When to Use Consent as Your Lawful Basis
Consent becomes the appropriate lawful basis when you want to send marketing communications beyond the initial enquiry response. If a buyer enquires about a specific BMW 3 Series and you want to email them about new stock arrivals, special offers, or unrelated vehicles over subsequent months, you need their freely given, specific, informed, and unambiguous consent.
GDPR requires consent to be granular. You cannot bundle consent for marketing into your enquiry form's terms and conditions. The consent request must be separate, clearly worded, and presented with an unticked opt-in box. Pre-ticked boxes, assumed consent, and conditional service access ("we can only respond if you agree to marketing") all invalidate consent under GDPR.
Valid consent requires four elements. It must be freely given (no pressure or conditional service), specific (clear about what communications the buyer will receive), informed (explaining who will contact them, how often, and about what), and unambiguous (requiring a clear affirmative action like ticking a box or clicking a button). Your privacy notice must explain that consent can be withdrawn at any time without affecting the buyer's ability to enquire about vehicles.
Dealers using GDPR-compliant vehicle listing and buyer data handling practices typically present consent as an optional add-on during enquiry submission. The form might state: "I would like to receive updates about similar vehicles and special offers (optional)" with an unticked checkbox. This approach separates enquiry processing (legitimate interests) from marketing (consent) and gives buyers clear control.
Consent creates ongoing obligations. You must maintain records proving when and how each buyer consented, what they consented to, and any subsequent withdrawals. When a buyer withdraws consent, you must stop processing their data for marketing purposes immediately, though you can retain the enquiry record itself under your original legitimate interests basis for a reasonable period.
Contract Performance for Post-Purchase Processing
Performance of a contract (Article 6(1)(b)) becomes the relevant lawful basis once a buyer commits to purchasing a vehicle. This basis covers processing necessary to fulfil the sales contract, including collecting payment details, arranging finance, registering the vehicle transfer with DVLA, and providing post-sale documentation.
Contract performance does not require separate consent because the processing is inherently necessary to complete the transaction the buyer has requested. If a buyer agrees to purchase a vehicle, you can lawfully process their name, address, payment details, and driving licence information to complete the sale, even without explicit data processing consent.
The contract basis has clear boundaries. It covers only processing strictly necessary for contract performance. You cannot use this basis to justify marketing communications, customer satisfaction surveys (unless contractually promised), or sharing data with third parties for their own marketing purposes. These activities require either consent or a separate legitimate interests assessment.
Dealers should document what processing they consider necessary for contract performance. Typical necessary processing includes DVLA registration updates, finance company applications (where the buyer has chosen finance), warranty registration (where included in the sale), and delivery coordination. Processing that enhances customer experience but is not strictly necessary (such as courtesy MOT reminders 12 months after purchase) requires either consent or a legitimate interests basis.
Documenting Your Lawful Basis Decision
The ICO expects dealers to document which lawful basis applies to each processing activity before collecting buyer data. This documentation should form part of your data protection policy and be available to demonstrate compliance during audits or investigations.
Create a processing activities register that lists each way you collect and use buyer data. For each activity, record the lawful basis, the data collected, the purpose, retention period, and any third parties who receive the data. A typical entry might state: "Web enquiry form, lawful basis: legitimate interests, data collected: name, email, phone, vehicle preference, purpose: respond to enquiry and suggest matching vehicles, retention: 24 months or until buyer requests deletion, third parties: none."
Your privacy notice must clearly explain your lawful basis to buyers. Generic statements like "we process your data in accordance with GDPR" fail the transparency requirement. Instead, explain: "When you submit an enquiry, we process your contact details and vehicle preferences based on our legitimate interest in responding to your enquiry. We will contact you to discuss the vehicles you asked about and suggest similar options from our stock. You can ask us to stop contacting you or delete your enquiry at any time."
Dealers implementing GDPR best practices for vehicle dealers handling buyer enquiries typically review their lawful basis documentation annually or when changing how they process enquiries. This review ensures your documented basis still matches your actual processing activities and reflects any changes in ICO guidance.
Common Mistakes Dealers Make with Lawful Basis
Many dealers incorrectly assume consent is always required for processing enquiry data. This misunderstanding leads to overly complex enquiry forms that deter buyers with unnecessary consent checkboxes. Legitimate interests provides a simpler, legally sound basis for initial enquiry processing without requiring explicit consent.
Another common error is conflating different processing activities under a single lawful basis. Dealers might claim legitimate interests for both enquiry responses and ongoing marketing, when only the former qualifies. This approach fails the necessity test (ongoing marketing is not necessary to respond to an enquiry) and risks ICO enforcement if buyers complain about unwanted contact.
Some dealers use pre-ticked consent boxes or assume consent from enquiry submission. Both practices invalidate consent under GDPR. The regulation explicitly prohibits pre-ticked boxes and requires affirmative action. Submitting an enquiry form constitutes consent to receive a response (under legitimate interests), but not consent for unrelated marketing communications.
Relying on contract performance too broadly creates compliance risks. Dealers sometimes claim this basis for processing that is convenient but not strictly necessary for contract completion. Customer satisfaction surveys, for example, benefit the dealer but are not necessary to complete the vehicle sale. These activities require legitimate interests (with an LIA) or consent, not contract performance.
Failing to document the lawful basis decision before processing begins is perhaps the most serious mistake. GDPR requires you to identify your lawful basis before collecting data, not retrospectively when the ICO investigates. Dealers who cannot produce a documented LIA or consent records when challenged face significantly higher enforcement risk.
Practical Implementation for Dealer Enquiry Systems
Implementing compliant lawful basis processing requires updating your enquiry forms, CRM systems, and staff procedures. Start by reviewing every point where you collect buyer data (website forms, phone calls, showroom visits, email enquiries) and documenting the lawful basis for each.
For web enquiry forms, add a clear privacy notice link immediately above the submit button. The notice should explain that you will process the enquiry under legitimate interests and describe what follow-up the buyer should expect. If you want to offer optional marketing consent, add a separate, unticked checkbox with specific wording about what the buyer will receive.
Configure your CRM system to record the lawful basis for each contact. Tag enquiries processed under legitimate interests separately from contacts who have consented to marketing. This separation prevents accidentally sending marketing to buyers who only submitted an enquiry. Set automated retention periods that delete unconverted enquiries after your documented retention period (typically 12-24 months).
Train sales staff to understand lawful basis distinctions. Staff should know they can follow up on enquiries under legitimate interests but must stop when the buyer indicates disinterest. They should not add enquiry contacts to general marketing lists without documented consent. Staff handling phone enquiries should verbally explain how the buyer's data will be used and offer the option to receive marketing updates as a separate, optional choice.
Dealers using platforms like CarsLink.ai benefit from systems designed to route enquiries directly to dealer websites, where dealers control the enquiry form and lawful basis implementation. This direct connection ensures dealers can implement their documented lawful basis without relying on third-party marketplace consent mechanisms that may not align with their own compliance approach.
Handling Data Subject Rights Under Different Lawful Bases
The lawful basis you rely on affects which data subject rights apply and how you must respond to buyer requests. Understanding these differences helps you handle requests correctly and avoid compliance breaches.
Under legitimate interests, buyers can object to processing at any time. When a buyer objects, you must stop processing unless you can demonstrate compelling legitimate grounds that override their interests. For enquiry processing, this threshold is rarely met. If a buyer objects to further contact, you should cease follow-up and mark their record as "do not contact," though you can retain the enquiry record itself for a reasonable period to prove compliance if questioned.
Under consent, buyers can withdraw consent at any time, and you must make withdrawal as easy as giving consent. Every marketing email should include a clear unsubscribe mechanism. When consent is withdrawn, you must stop marketing immediately but can retain a record that the buyer previously consented and then withdrew (to prove you are not contacting them without basis).
Under contract performance, buyers cannot object to processing that is genuinely necessary to complete the contract they have entered. However, they retain other rights including access (requesting copies of their data), rectification (correcting inaccurate data), and erasure (after the contract is complete and you no longer need the data).
All buyers, regardless of lawful basis, have the right to access their data. When a buyer submits a Subject Access Request (SAR), you have one month to provide copies of all personal data you hold about them, explain why you are processing it, identify the lawful basis, and describe any third parties who have received the data. Dealers should maintain systems that can quickly retrieve all data relating to a specific buyer to meet this deadline.
Retention Periods and Lawful Basis Expiry
GDPR requires you to retain personal data only as long as necessary for the purpose you collected it. The lawful basis influences what "necessary" means and when you must delete enquiry data.
For enquiries processed under legitimate interests, necessity typically expires when it becomes clear the buyer will not purchase. Most dealers apply a 12-24 month retention period for unconverted enquiries. This period allows reasonable follow-up while the buyer's vehicle search remains active but prevents indefinite retention of old enquiries. After this period, delete the enquiry data unless the buyer has separately consented to marketing or you have another lawful basis for retention.
For consented marketing contacts, you can retain data as long as consent remains valid and the buyer continues to engage. However, you should periodically review inactive contacts and seek consent renewal. The ICO recommends re-confirming consent if a buyer has not engaged with marketing for 24 months, as continued non-engagement suggests consent may no longer reflect their current preferences.
For contract performance data, retention depends on legal obligations and legitimate interests in defending potential claims. Vehicle sales records should be retained for at least six years to cover the limitation period for contract disputes. Financial records may require longer retention under tax and accounting regulations. After these periods expire, delete customer data unless you have a documented legitimate interest in longer retention (such as ongoing warranty obligations).
Document your retention periods in your privacy notice and implement automated deletion processes where possible. CRM systems should flag records approaching their deletion date and automatically purge data once the retention period expires, unless staff manually extend retention with a documented justification.
Frequently Asked Questions
Can I use legitimate interests for all buyer enquiry processing?
Legitimate interests covers initial enquiry responses and reasonable follow-up directly related to the enquiry. You can use this basis to contact a buyer about the vehicle they asked about and suggest similar vehicles from your current stock. However, legitimate interests does not extend to ongoing marketing communications about unrelated vehicles, special offers, or general dealership news. These activities require either explicit consent or a separate legitimate interests assessment demonstrating why continued marketing serves your legitimate interests without overriding the buyer's rights.
What happens if I process enquiries under the wrong lawful basis?
Processing under an incorrect lawful basis constitutes a GDPR breach that can trigger ICO enforcement action. The consequences depend on the severity and whether the error caused harm. Minor technical breaches (such as inadequate documentation of a valid basis) typically result in warnings and required corrective action. More serious breaches (such as marketing to buyers without consent or legitimate interests) can result in fines, mandatory audits, and reputational damage. If you discover you have been using the wrong basis, conduct an immediate review, stop non-compliant processing, document the correct basis going forward, and consider notifying affected buyers if their rights were significantly impacted.
Do I need separate consent for each type of marketing communication?
GDPR requires consent to be specific, meaning buyers should understand what they are consenting to. Best practice is to offer granular consent options that let buyers choose what communications they receive. For example, you might offer separate consent for email updates about similar vehicles, phone calls about special offers, and SMS notifications about price reductions. However, you can group closely related communications under a single consent request if the description clearly explains what the buyer will receive. Avoid overly broad consent requests like "marketing communications" without explaining the types, frequency, and channels involved.
How long can I keep enquiry data if the buyer does not respond to follow-up?
When a buyer stops responding to follow-up about their enquiry, your legitimate interest in continued processing diminishes. Most dealers apply a 12-24 month retention period from the last contact. This period balances your interest in maintaining records of enquiries (for business analysis and compliance evidence) against the buyer's interest in not having their data retained indefinitely. After this period, delete the enquiry data unless the buyer has provided separate marketing consent or you have documented a specific legitimate interest in longer retention. Always document your retention periods in your privacy notice and apply them consistently.
Can I share buyer enquiry data with finance companies or warranty providers?
Sharing enquiry data with third parties requires either a lawful basis for the sharing itself or the buyer's explicit consent. If a buyer enquires about a vehicle and specifically asks about finance options, you have a legitimate interest in sharing their details with finance providers to obtain quotes, provided you clearly explain this in your privacy notice. However, sharing enquiry data with third parties for their own marketing purposes requires explicit consent that separately identifies each recipient and what they will do with the data. Never share enquiry data with third parties unless your privacy notice clearly describes the sharing and you have a documented lawful basis.