Standing up a governance framework across OEM, supplier and dealer

A single connected vehicle generates its VIN (Vehicle Identification Number, the 17-character unique ID stamped on every car) plus a stream of telemetry: GPS traces, battery state, braking events, and cabin sensor data. That data touches at least three parties before anyone acts on it: the OEM (Original Equipment Manufacturer, the carmaker like Ford or BMW), a Tier 1 supplier (the company that builds a major system, like Bosch or Continental), and the dealer who sells and services the car.

Here is the failure mode. When a data subject access request arrives, or a regulator asks "who authorized sharing location data with the insurance partner?", each party points at the other. Accountability evaporates at every handoff.

This lesson shows you how to assign concrete roles so it does not.

The three roles that must be named

Governance fails when roles are implied instead of assigned. Three roles matter, and they mapmapUsing software to automate repetitive marketing tasks and campaigns, enabling personalisation at scale across channels like email, web, and social.View full definition → to legal definitions under the EU GDPRGDPREU regulation governing how organizations collect, store and use personal data, with fines tied to global revenue for breaches.View full definition → (General Data Protection Regulation) and are echoed in US state laws like the CCPA (California Consumer Privacy Act).

Data owner. Accountable for a dataset. Decides purpose and who gets access. Usually a named business leader, not IT. Example: the OEM's VPVPA clear statement of the benefits your product delivers, the problems it solves and why customers should choose you over alternatives.View full definition → of Connected Services owns the telemetry dataset.

Data steward. Operational custodian. Maintains quality, definitions, and access lists day to day. Example: a data engineering lead who enforces that "odometer_km" always means kilometers, never miles.

Data processor. Under GDPR, a party that processes data on behalf of a controller and only on documented instructions. Example: a dealer running a diagnostics dashboard supplied by the OEM is a processor for that flow.

The controller (the party deciding why and how data is processed) carries the heaviest legal weight. In most connected-car flows the OEM is controller. But watch for joint controllership: if a Tier 1 supplier co-decides purposes (say, using braking data to improve its own ADAS product), both share controller duties under GDPR Article 26.

Worked example: mapping one VIN flow

Take a location-based service where the dealer offers "find my car" to a customer.

The lesson: ownership does not transfer at the handoff. The GPS trace still belongs to the OEM even while the dealer displays it. The dealer is a processor for that element and must have a data processing agreement (DPA), a contract required under GDPR Article 28 that specifies exactly what the processor may do.

The regulations you actually name

Do not wave at "privacy law." Name the instruments.

• GDPR (EU/EEA): covers personal data, and a VIN linked to an identifiable owner is personal data. Fines reachreachThe number of unique people exposed to your message in a given period. Unlike impressions, reach counts each person once, no matter how often they see it.View full definition → up to 4 percent of global annual turnover.
• UNECE WP.29 R155/R156 (Europe and beyond): UN regulations requiring a Cybersecurity Management System and Software Update Management System for vehicle type approval. Governs how telemetry and OTA (over-the-air) updates are secured.
• CCPA / CPRA (California): gives consumers rights to know, delete, and opt out of "sale" or "sharing" of personal information. Precise location is "sensitive personal information."
• US state patchwork: as of 2026 roughly 20 US states have comprehensive privacy laws (this count keeps rising, treat as an estimate and check current status). There is still no single US federal privacy law.

For a plain-language reference on GDPR roles, the EU's own text is readable: [GDPR Article 4 definitions](https://gdpr-info.eu/art-4-gdpr/).

A concrete trap: automakers were found sharing driving-behavior data with data brokers who fed insurers. That is a "sale" or "sharing" under CPRA and triggers opt-out rights. If your governance map does not flag that downstream flow, you are exposed.

Building the RACI so handoffs hold

Use a RACI matrix (Responsible, Accountable, Consulted, Informed) for each cross-party process. Keep it boring and specific.

Example process: "Disable telemetry on customer opt-out."

• Responsible: OEM data engineering (executes the flag).
• Accountable: OEM Connected Services VP (data owner).
• Consulted: Tier 1 supplier (confirms collection stops at the unit), Dealer (confirms dashboard hides data).
• Informed: DPO (Data Protection Officer, the GDPR-mandated privacy lead), legal.

The magic is that "Accountable" is exactly one named role. If opt-out fails, you know whose phone rings.

🎬 [VIDEO: "GDPR Explained: Controllers vs Processors" - youtube.com - a short, clear walkthrough of the legal roles that map directly to owner/steward/processor duties]

Data checks and audits that catch drift

A governance framework is a document until you run checks against live data. Three practical ones:

1. Lineage check. Can you trace a single VIN's telemetry from vehicle sensor to every downstream consumer? If you cannot draw the map, you cannot honor a deletion request.

2. Consent reconciliation. Does the consent flag in the OEM system match what the Tier 1 unit is actually transmitting? Mismatches are the most common finding.

3. Access recertification. Every quarter, does each person with access still need it? Dealers rotate staff constantly; stale credentials are a breach waiting to happen.

Here is a simple consent reconciliation check in SQLSQLSales Qualified Lead: a prospect the sales team has validated as ready for direct outreach and a proposal, having passed clear qualification criteria.View full definition → you can adapt:

-- Find VINs still sending telemetry despite an opt-out flag
SELECT t.vin, t.last_seen_ts, c.consent_status, c.updated_at
FROM telemetry_ingest t
JOIN consent_registry c ON t.vin = c.vin
WHERE c.consent_status = 'OPTED_OUT'
  AND t.last_seen_ts > c.updated_at;   -- data arriving after opt-out

Any rows returned are governance failures: a customer opted out, yet data kept flowing. Each row is a potential regulatory finding. Run it daily, alert on non-zero.

Where the balance of power actually sits

Governance is also politics. Understand the leverage.

The OEM holds the type-approval relationship and usually the controller role, so it sets the rules. But Tier 1 suppliers like Bosch, Continental, and ZF build the telematics hardware and often the software, so they hold operational knowledge the OEM lacks. Dealers are frequently independent franchises, not owned by the OEM, which makes enforcement harder: you cannot just fire an internal team, you must contract with a separate business.

This is why DPAs (data processing agreements) matter more in automotive than in a single-company setting. Your governance only extends as far as your contracts. If the dealer network operates 3,000 independent franchises, you need 3,000 enforceable DPAs and a way to audit them at scale.

Practical move: standardize a single DPA template and a single consent schemaschemaA schema is the formal blueprint that defines how data is structured, named, typed, and related within a database, file, or message.View full definition → across the whole network. Do not let each dealer invent its own consent screen. One schema means one reconciliation check works everywhere.

The handoff checklist

Before any data crosses a party boundary, confirm:

1. Named owner on both sides (data does not become ownerless in transit).
2. Signed DPA specifying purpose limitation (data used only for the stated purpose).
3. Consent scope confirmed on the receiving side.
4. Lineage entry created so the flow is auditable.
5. Deletion propagation path defined (delete upstream, and it deletes downstream).

Miss item 5 and you get the classic failure: a customer's data is deleted at the OEM but lives on in a dealer's local export forever.

A note on data minimization

The cheapest governance is collecting less. Under GDPR's data minimization principle, you may only collect data adequate and relevant to your purpose. If "find my car" needs only current location, do not stream a full 90-day GPS history to the dealer app. Every element you do not share is one you never have to govern, secure, or delete.

Ask of every field: which named purpose justifies this, and who is the owner? If no one can answer, stop collecting it.

Key Takeaways

• Assign exactly one accountable data owner per dataset, and it survives every handoff. The OEM owning a GPS trace does not stop owning it when the dealer displays it.
• Map roles to real law: controller, processor, joint controller under GDPR; sale/sharing opt-outs under CPRA. A VIN tied to an owner is personal data.
• Governance extends only as far as your contracts. With independent dealer franchises, standardized DPAs and one consent schema are the enforcement mechanism.
• Run live checks, not just documents. A daily consent-reconciliation query that flags telemetry arriving after opt-out will catch real failures before regulators do.
• Define deletion propagation up front. Deleting upstream is worthless if a dealer's local export keeps the data alive.