Customer data in a garage: what you hold.

Know what you actually hold, and where

The first exercise is an inventory, and it usually surprises people because customer data in a garage accumulates in more places than anyone remembers.

The management system is the obvious one. Less obvious are the shared mailbox, the phone that took the booking photographs, the paper job cards in a drawer, the spreadsheet somebody made for a marketing push, the WhatsApp thread with a fleet contact, and the card machine records.

You cannot protect, retain or delete what you have not located, so a list of where personal data lives is the prerequisite for everything else in this article. It takes an afternoon and it is rarely done.

Keep it for a reason, not forever

The instinct is to keep customer data indefinitely, on the grounds that it might be useful and deleting feels risky.

That is backwards in most jurisdictions: data should be kept while there is a reason and then removed, and holding more for longer increases what you lose in a breach without adding value. Service history has a genuine long retention justification; a spreadsheet of leads from four years ago does not.

Setting a retention period per category, written down and actually applied, is the practical version. The exact periods vary by country and by what other rules apply to your records, so check locally rather than inventing a number.

Marketing needs a lawful basis

This is where workshops most often stray, usually without meaning to.

• A customer giving you their number to be told their car is ready has not agreed to receive offers.
• Service reminders and marketing are treated differently in many jurisdictions, and the line is worth knowing.
• Consent needs to be recorded, including when and how it was given.
• Every marketing message needs a working way to opt out, honoured promptly.
• A purchased list of local vehicle owners is almost never usable lawfully, whatever the seller claims.

The practical rule that keeps most workshops safe is to ask at the point of service and record the answer, rather than assuming a relationship implies permission.

Photographs and inspection records

Digital vehicle inspections are excellent practice and they create a category of data that deserves thought.

A photograph of a vehicle can include a registration, a driveway, a house number and sometimes a person in a reflection. That is personal data in most frameworks, and it lives on a technician's phone unless the system stores it centrally.

The manageable version is that images go into the job record rather than staying on personal devices, and that the phone is not the archive. It is also worth telling customers you photograph their vehicle, which is good practice and reassuring rather than alarming.

Requests and breaches will eventually arrive

Two things happen to every business that holds data for long enough, and both go badly without a plan.

A customer asking for a copy of what you hold, or asking for it to be deleted, is a request with a time limit attached in most jurisdictions. Knowing where the data lives, which the inventory gives you, is what makes that answerable rather than alarming.

A breach is the other. A stolen laptop, a mis-sent email or a compromised mailbox all count, and there are usually reporting obligations with short deadlines. The response is far better when somebody has thought about it in advance than when it is being invented at eight in the evening.

Practical steps that cover most of it

None of this needs a specialist for a small workshop, and a handful of habits cover the majority.

Keep customer data in one system rather than five. Give people their own logins rather than a shared one, so access is attributable. Remove access when someone leaves, which is the step most often missed. Do not carry customer lists on personal devices. Check what your suppliers and software providers do with the data you put into them.

That last point matters more as workshops adopt more tools. Every system holding your customer records is part of your responsibility, so knowing where it stores them and what it would give you back is worth asking before signing rather than afterwards.