How should your business handle driver data from chargers?

Map the personal information used by your charging service and agree who controls each use before launch. Your host business and charging operator may have different responsibilities. Set a lawful basis, privacy information, access controls and retention rules. A reportable personal data breach must reach the ICO without undue delay and within 72 hours of awareness [S5]. Checked October 2026.

Last checked 16 October 2026

What personal data does your charging service handle?

Ask for a data map before commissioning the service. Start with the fields your proposed system actually collects, rather than assuming every charger works alike. Request a sample report using demonstration data and ask what can be linked back to a person.

Under the UK General Data Protection Regulation (UK GDPR), information can be personal data even without a name if it identifies a person in combination with other information. The ICO includes customer reference numbers among examples. Apply that test to the records available to your organisation. [S1]

Use this suggested review table with your operator:

Request only the fields you need in host reports. Use charging data and reporting to specify useful management outputs without automatically asking for a named history of every driver.

Who is the data controller for your chargers?

A controller decides how personal data is used; a processor handles it on that controller’s behalf. Your business might determine the purposes of staff charging records while another organisation determines separate purposes for its customer accounts. Assess the actual activities instead of giving the whole service a single label based on who paid for the equipment. [S1]

Ask your solicitor to document each party’s role. Where a processor acts for a controller, the ICO’s contract guidance sets out required terms covering documented instructions, confidentiality, security, assistance, sub-processors and arrangements at contract end. A general maintenance clause is not a substitute. [S2]

For procurement, ask who can export records, who approves a new use and who receives driver enquiries. Keep those answers beside the host agreement, so the commercial and data arrangements can be reviewed together. This page provides general information, not legal advice; check the agreement with your solicitor.

Do you need consent to collect driver information?

Consent is not required for every processing activity. The ICO says you should select the lawful basis that reflects the relationship and purpose. Consent must offer a real choice; an imbalance of power can make it unsuitable, including in employment. Do not treat a staff tick box as the complete assessment. [S6]

List your purposes separately, such as managing access or resolving a billing query. Have your data protection adviser review the lawful basis and necessary fields for each. Ask for another review before adding marketing or a new reporting purpose to an existing charging service.

If an app is proposed, ask which functions require a driver account and what information each function uses. Obtain that answer during selection, while you can still compare different arrangements. Keep your workplace charging policy consistent with the chosen process.

What privacy information should drivers receive?

The ICO’s privacy guidance requires information about your organisation, purposes, lawful basis, retention and relevant rights. It also covers recipients and international transfers where applicable. Ask your adviser to check the full list against the proposed service rather than using a generic website notice. [S3]

Prepare a short explanation drivers can find when they first interact with the service, with a route to the full information. Ask the operator to show where this appears in account creation and support flows. Check that staff using an access card receive the relevant explanation too.

Test the published contact route with your own team before launch. Someone should be able to identify which organisation handles a question without asking the driver to understand your supply chain.

How long should you keep charging records?

There is no universal UK GDPR retention period for all personal data. The ICO says you must justify how long identifiable information is needed and review it. Removing a name while keeping a linkable identifier does not automatically take the record outside retention requirements. [S4]

Create a retention schedule by purpose and record type. Distinguish an unresolved payment dispute from routine access history. Ask your accountant about accounting records and your solicitor about any legal retention requirement, then record the applicable reason rather than applying it to every field.

Ask the platform to demonstrate deletion and what happens to exported reports and backups. Include return or deletion of processor-held data at the end of the service in your contract review. [S2]

How should your team handle access requests and data incidents?

The ICO says a request for a person’s information need not use formal wording. Create a route from reception, HR and customer support to the responsible person, and keep a request log. Agree how your operator will search its systems and provide the information needed for your response. [S7]

For an incident, record when you became aware, the information involved and the possible effects on people. The ICO requires notification of reportable personal data breaches without undue delay and within 72 hours of awareness. Assess reportability promptly; do not assume every technical outage is a reportable breach. [S5]

Read charger cyber security alongside that procedure. Rehearse who contacts the operator and who makes the reporting assessment before an incident occurs.

Access requests are normally free. Ask your adviser to check the limited exceptions before seeking a fee, and tell staff how to route a request without adding an unnecessary payment step. [S8]

What should you do next?

Bring your proposed data map, reporting needs and contract questions, then get matched with an installer that covers your area.

Piggy Pineapple Ltd operates this advice and referral service. We refer enquiries and may be paid a fee. Before sharing your details, we will name the proposed installer and disclose any shareholding the owner holds in it. Read how we work for the referral process.