Customer data in a garage: what you possess.

Know what you have and where it is

The first task is an inventory, and it often surprises people as customer data in a garage builds up in more places than anyone recalls.

The management system is the obvious one. Less obvious are the shared mailbox, the phone that took the booking photographs, the paper job cards in a drawer, the spreadsheet somebody made for a marketing push, the WhatsApp thread with a fleet contact, and the card machine records.

You can't protect, retain or delete what you haven't found, so knowing where personal data is stored is essential for everything else in this article. It takes an afternoon and is seldom done.

Keep it for a purpose, not indefinitely

The instinct is to retain customer data indefinitely, as it may be useful and deleting seems risky.

This is backwards in most areas: data should be retained only as long as necessary, then deleted. Keeping more for longer increases breach risks without adding value. Service history justifies long retention; a four-year-old leads spreadsheet does not.

Setting a retention period for each category, documented and enforced, is the practical approach. Exact durations differ by country and other regulations affecting your records, so verify locally instead of guessing.

Marketing requires a legal basis

This is where workshops most often stray, usually without meaning to.

• A customer providing their number to be informed their car is ready hasn't consented to receive offers.
• Service reminders and marketing are viewed differently in many areas, and it's important to know the distinction.
• Consent must be documented, including when and how it was obtained.
• Every marketing message must include a clear opt-out option, which should be honoured swiftly.
• A bought list of local vehicle owners is rarely legally usable, regardless of the seller's claims.

The practical rule for keeping most garages safe is to ask at the point of service and note the response, rather than assuming a relationship grants permission.

Photos and inspection records

Digital vehicle inspections are best practice and create data that requires consideration.

A photo of a vehicle may show a registration, driveway, house number, and sometimes a person in a reflection. This is personal data in most regulations, and it remains on a technician's phone unless stored centrally.

The practical approach is to store images in the job record instead of on personal devices, ensuring the phone isn't the archive. It's also advisable to inform customers that you photograph their vehicle, which is reassuring rather than concerning.

Requests and breaches will inevitably occur

Two things happen to every business that retains data long enough, and both end poorly without a plan.

A customer requesting a copy of their data or its deletion has a time limit in most jurisdictions. Knowing where the data resides, as the inventory shows, makes it manageable rather than concerning.

A breach is another issue. A stolen laptop, misdirected email, or compromised inbox all count, and there are often reporting obligations with tight deadlines. A pre-planned response is far better than one created at eight in the evening.

Practical steps that cover most of this

None of this requires a specialist for a small garage; a few habits cover most.

Keep customer data in one system, not five. Provide individual logins instead of shared ones for traceable access. Remove access when someone departs, the most commonly overlooked step. Avoid storing customer lists on personal devices. Verify what your suppliers and software providers do with your data.

This point is crucial as garages adopt more tools. Every system containing your customer records is your responsibility, so knowing where it stores them and what it returns is worth asking before signing, not after.