Website Security for UK Car Dealerships and Motor Retailers

Why Motor Retailers Handle High-Risk Personal Data

Car dealerships are among the few retail businesses that routinely process identity documents, financial credit information, and motor finance application data as part of a standard sale. A customer purchasing a vehicle on finance provides proof of identity, proof of address, employment details, income information, and banking details — a package of data that is directly usable for identity theft and financial fraud.

The FCA regulates credit broking activities, including motor finance. Regulated firms face both ICO and FCA scrutiny for data protection failures.

What Dealership Websites and Systems Hold

**Finance application data** — Identity documents (driving licences, passports), proof of address, employer details, income figures, credit reference consent, and banking details. This combination is the highest-risk personal data package in retail.

**Customer contact and purchase history** — Names, home addresses, email addresses, phone numbers, and vehicle purchase history. For repeat customers, this spans decades of vehicle ownership records.

**Vehicle part-exchange and valuation data** — Part-exchange vehicle details linked to current keeper information.

**Service history and workshop records** — Service invoices, recall notices, and workshop job cards linked to vehicle registration and owner identity.

**Test drive records** — Names, licence details, and addresses collected before a test drive — including the specific time slot when the customer was away from their home in the dealership's vehicle.

Common Security Vulnerabilities at Dealerships

**Finance application data stored insecurely** — Paper and digital finance application packs that sit in salespeople's email folders or shared drives without access controls represent a serious data risk. Identity document copies must be stored with field-level encryption or in a specifically secured document management system.

**Outdated DMS with web interfaces** — Dealer Management Systems accessible through web browsers and not recently updated carry known vulnerabilities. These systems contain the entire customer and transaction history of the dealership.

**Weak access controls on customer records** — Broad staff access to all customer records means a single compromised account can expose the full customer database. Access should be scoped to relevant departments and roles.

**Website chat and lead capture tools** — Third-party chat widgets and lead capture forms embedded on dealership websites collect customer contact details through a third-party system whose security controls are outside the dealership's direct management.

**FCA regulated activity and data obligations** — Finance-related data collected in connection with regulated credit activity must be handled in compliance with FCA requirements in addition to GDPR. This includes specific consent requirements for credit reference checks.

Practical Steps

Review who has access to finance application data and restrict it to those with an operational need. Ensure identity document copies are deleted once their purpose is served. Apply access controls and audit logging to your DMS. Run an annual security scan to identify vulnerabilities in customer-facing systems. Enable multi-factor authentication on all DMS and email accounts.

Yrzo AI scans car dealership websites and identifies vulnerabilities in lead capture systems, finance application handling, and customer data management.