# Running the privacy and data audit: a hands-on checklist
A single modern connected car generates roughly 25 gigabytes of data per hour (a figure widely cited across industry sources, order-of-magnitude, not exact). GPS pings, cabin microphone activations, brake pressure, driver-facing camera frames. Now imagine a regulator asking your OEM (Original Equipment Manufacturer, the carmaker) a simple question: "Show me every place this vehicle's location was stored, who consented, and when you deleted it." If you cannot answer in a week, you have a problem. This lesson walks you through the audit that finds that problem first.
Connected-vehicle data is now heavily regulated. The main laws you must name:
In 2023, US regulators and press scrutiny landed hard on automakers sharing driving-behavior data with data brokers and insurers, sometimes without clear consent. That is the exact failure mode this audit catches.
Key terms before we start:
Picture a typical telematics pipelinepipelineAll active sales opportunities across the stages of the sales process, together with their combined potential value and probability of closing.View full definition →:
Vehicle sensors to in-car gateway to cloud ingestion to data lakedata lakeA data lake is a centralized repository that stores large volumes of raw data in its native format, from structured tables to unstructured files, until needed.View full definition → to analytics/ML to third-party sharing (dealers, insurers, mapping partners).
Your job is to walk this pipelinepipelineAll active sales opportunities across the stages of the sales process, together with their combined potential value and probability of closing.View full definition → and stamp each stage against three failure modes: un-consented collection, over-retention, and missing lineage.
You cannot audit what you cannot see. Start with a complete inventory of data elements flowing through the pipelinepipelineAll active sales opportunities across the stages of the sales process, together with their combined potential value and probability of closing.View full definition →.
For each element, capture: source sensor, data category, whether it is PII, the consent basis, retention period, and every storage location.
A minimal inventory row looks like this:
| Element | Category | PII? | Consent basis | Retention | Stores |
|---|---|---|---|---|---|
| GPS lat/long | Location | Yes | Opt-in (nav feature) | 30 days | ingest topic, lake, maps partner |
| Hard-braking events | Telematics | Yes (via VIN) | ??? | ??? | lake, insurer feed |
The "???" cells are exactly where audits find fines. In our example, hard-braking events flow to an insurer but the consent basis is undocumented. Flag it.
Location is the highest-risk category in connected vehicles. The EDPB treats precise geolocation as especially sensitive because it reveals home, workplace, and habits.
Run this check: pick one VIN and follow its GPS data through every system.
Ask:
A practical query against your event store to spot location data sitting in the wrong topic:
-- Find location fields present in topics that should not carry them
SELECT topic_name, field_name, COUNT(*) AS records
FROM data_catalog_fields
WHERE field_name IN ('gps_lat', 'gps_long', 'geohash')
AND topic_name NOT IN ('navigation_service', 'emergency_ecall')
GROUP BY topic_name, field_name
ORDER BY records DESC;If marketing_events or partner_export shows up in the results, you have found un-consented location logging. This is the single most common finding in real audits.
Consent on paper is not consent in the pipelinepipelineAll active sales opportunities across the stages of the sales process, together with their combined potential value and probability of closing.View full definition →. Verify that the technical system honors what the driver actually chose.
Concrete test: create a test account, opt OUT of location sharing in the vehicle's privacy menu, drive a route, then check whether GPS still landed in the analytics lake. If it did, consent enforcement is broken.
For EU drivers, remember the eCall exception. Mandatory emergency call systems can collect location without consent, but only for the emergency purpose. If that same eCall location feeds an analytics dashboard, that is unlawful repurposing.
Over-retention is keeping PII past the point it is useful or lawful. Regulators expect a defined, documented, and enforced retention schedule.
Check three things:
1. Is there a written retention period per data category?
2. Is deletion actually automated (not "we delete on request")?
3. Do backups and third-party copies also expire?
That third point catches people. You delete GPS from the lake after 30 days, but a mapping partner keeps it for two years under an old contract. Under GDPR, you are still the controller and remain responsible.
Suppose you store raw GPS for 10 million vehicles, each sending one ping every 10 seconds, and your stated retention is 30 days.
If your policy says 30 days but your lake still holds pings from 90 days ago, you are holding roughly 3 times the lawful volume. That is a concrete, measurable finding you can hand a regulator or your own board. (Illustrative math, not a real fleet.)
Knowledge check
1. A regulator asks an OEM to show every place a vehicle's location was stored, who consented, and when it was deleted. Which capability is MOST directly being tested by this request?
2. Why is a VIN tied to an owner treated as PII, while a VIN alone might be treated differently?
3. The lesson notes a connected car generates roughly 25 GB of data per hour. What is the main conceptual reason this figure matters for a privacy audit?
4. Select ALL correct answers about how GDPR applies to connected-vehicle data.
Select all the correct answers.
5. Select ALL correct answers describing failure modes this privacy audit is designed to catch.
Select all the correct answers.
Missing lineage is the failure that makes every other problem unfixable. If you cannot trace where a data element came from and where it went, you cannot honor a deletion request, prove consent, or scope a breach.
For each PII element, you need a traceable chain: sensor to gateway to topic to table to export.
Tools like OpenLineage or a data catalogdata catalogA centralized inventory of an organization's data assets, enriched with metadata, that helps people find, understand, and trust the data they need.View full definition → (Collibra, Alation, or open-source alternatives) capture this. But the audit test is simple: pick a driver, issue a Data Subject Access Request (DSAR, the legal right to see one's own dataown dataData collected directly from your own customers and prospects through your own channels: your most reliable and privacy-compliant source.View full definition →), and time how long it takes to assemble every copy of their data. If it takes more than the legal window (GDPR requires a response within one month), your lineage is inadequate.
The 2023 scrutiny of automakers centered here: driving data flowing to brokers and insurers. For every outboundoutboundProactive outreach that pushes your message to targeted audiences through advertising, email, or direct prospecting, initiated by the seller rather than the buyer.View full definition → feed, verify:
Document the balance of power honestly. Large OEMs (Toyota, Volkswagen, GMGMGross margin is the share of revenue left after subtracting the direct cost of producing goods or services, expressed as a percentage of revenue.View full definition →, Ford, Stellantis) sit at the center; mapping providers (Google, HERE), insurers, and data brokers pull data outward. You, the controller, carry the liability no matter how big the partner is.
An audit is worthless without a ranked findings list. Rate each issue by regulatory exposure and likelihood, and assign an owner and a deadline. Example:
partner_export with no consent basis. Owner: Data platform lead. Fix in 14 days.