DC CubeTRAICE
    Compliance

    Lawful basis for vehicle location data in a default scenario

    For asset recovery by the legal owner, the usual lawful basis under UK GDPR is legitimate interests. The argument stands or falls on proportionality: what is processed, when it starts, and when it stops. This page sets out how is designed around that test.

    General information for lenders and leasing companies, not legal advice. Your Legitimate Interest Assessment and DPIA remain your own.

    Four things a reviewer checks

    Designed for the balancing test, not around it

    Legitimate interests, documented

    Article 6(1)(f) with a written Legitimate Interest Assessment. Consent is not used as the basis for recovery, because it is withdrawable at the worst moment.

    Case-scoped in time

    Access begins when the case opens and ends when it closes. Sessions expire on their own rather than running for the term of the agreement.

    Data minimisation

    Location, movement patterns and mileage relevant to recovery. Not journeys of performing customers, not content, not more brands than the case requires.

    Auditable by default

    Every access is logged with actor and timestamp, retention limits are enforced, and share links to field agents are time-limited and revocable.

    Deliberate omission

    No remote immobilisation

    Some platforms in this category can disable a vehicle remotely. does not, and will not. FCA expectations treat repossession as a last resort after genuine forbearance, and interfering with a vehicle a customer may still be driving sits badly with both safety and fair treatment.

    informs the decision to attend. The action on the vehicle stays with the recovery process, the contract and the courts, where it belongs.

    Proportionality is also why the hardware question matters. See manufacturer data compared with fitting GPS trackers for the case-scoped alternative to a device that stays live for the whole agreement.

    FAQ

    Frequently Asked Questions

    What compliance, risk and DPO teams ask before a recovery deployment.

    For asset recovery by the legal owner, the usual basis under UK GDPR is legitimate interests, Article 6(1)(f). The lender documents it in a Legitimate Interest Assessment, including the balancing test against the customer's rights. Consent is generally the wrong basis, because it can be withdrawn at the exact moment recovery depends on it.

    It is a much harder argument than case-scoped access. Monitoring an entire portfolio for the whole agreement term processes location data about customers who are fully performing. Access that starts at default and ends when the case closes is narrower, easier to justify in a balancing test, and easier to evidence to a reviewer.

    Where processing involves systematic location monitoring of individuals, a Data Protection Impact Assessment is expected. provides the processing description, retention settings and audit trail evidence a DPIA needs, but the assessment itself belongs to the controller.

    Recovery-related processing should be disclosed in the finance agreement and the privacy notice, with the customer retaining their data subject rights, including the right to object under Article 21 and the right of access. Covert processing that is never disclosed is not a position we support.

    The lender or leasing company is the controller for its own financed vehicles. acts as processor under a data processing agreement, acting on documented instructions, with sub-processors disclosed and EU hosting.

    No, deliberately. Disabling a vehicle a customer may be driving raises safety and fairness questions, and FCA expectations treat repossession as a last resort after forbearance. informs the decision to attend; it does not act on the vehicle.

    Review the documentation with us

    DPA, processing description, retention settings and audit evidence — walked through with your risk team.

    Read the compliance overview