A data-protection compliant dealer portal: what to settle before signing

A dealer portal looks like a purely business-to-business system, but it holds real people’s data: names, emails, phone numbers, IP addresses, session records and who placed which order when. That is personal data.

Define the roles in the contract

Typically the manufacturer operating the portal is the controller and the company building and hosting the software is the processor. The contract must state this, along with the instructions and limits the processor operates under. Outsourcing does not remove the controller’s responsibility.

Disclosure and consent

On first login a dealer user must see what data is processed, for what purpose and for how long. Data required to perform the contract does not need explicit consent; marketing use does, and that consent must be revocable.

Retention

“Keep everything forever” is not a strategy. Define a retention period per data type and what happens at the end — deletion or anonymisation.

Technical measures — the minimum

• Role-based authorisation; a dealer user sees only their own dealer’s data
• Encryption in transit and at rest
• Immutable audit trail: who, when, which record, old and new value
• Multi-factor authentication for administrative access
• Backups with restore testing — an untested backup is not a backup
• A breach notification procedure with named owners

Payments

Do not store card data in your application. Handing the payment step to a compliant provider’s redirect page or secure iframe removes most of the security and compliance burden. Keep only the transaction reference.

Exit plan

What happens when the contract ends? Define the export format, the timeline and when the provider deletes its copies. Raising this early signals professionalism rather than distrust.