GDPR and parking: what operators must get right

Plate and session data is personal data

Because a plate can be traced to a keeper, the images, timestamps and payment records tied to it fall squarely within GDPR. Treating this information casually is the fastest route to a complaint, so the starting point is to recognise that you are a data controller for everything your site captures.

That recognition sets the standard for everything downstream: how long you keep records, who can see them, and what you tell drivers you are doing.

Lawful basis and data minimisation

Every collection needs a lawful basis. For paid parking and permit management this is usually contract or legitimate interests; for enforcement you should document the balancing test that justifies it. Collect only what the purpose requires and nothing more.

• Identify and record a lawful basis for each processing activity
• Capture only the fields you genuinely need to run and enforce parking
• Avoid retaining images or scans beyond their stated purpose
• Review the basis when you add cameras, apps or new charges

Transparency, retention and data-subject rights

Drivers must be able to find out what you hold and why, usually through a clear privacy notice on signage, tickets and your portal. Set defined retention windows and honour access, correction and erasure requests within the statutory timeframe.

Local rules vary across the Nordics and Europe, so confirm specifics with your own counsel, but the principles are consistent everywhere.

• Publish a plain-language privacy notice where drivers will see it
• Set and enforce retention periods, then delete on schedule
• Have a documented process for access and erasure requests