# Standing up a governance framework across OEM, supplier and dealer
A single connected vehicle generates its VIN (Vehicle Identification Number, the 17-character unique ID stamped on every car) plus a stream of telemetry: GPS traces, battery state, braking events, and cabin sensor data. That data touches at least three parties before anyone acts on it: the OEM (Original Equipment Manufacturer, the carmaker like Ford or BMW), a Tier 1 supplier (the company that builds a major system, like Bosch or Continental), and the dealer who sells and services the car.
Here is the failure mode. When a data subject access request arrives, or a regulator asks "who authorized sharing location data with the insurance partner?", each party points at the other. Accountability evaporates at every handoff.
This lesson shows you how to assign concrete roles so it does not.
Governance fails when roles are implied instead of assigned. Three roles matter, and they mapmapUsing software to automate repetitive marketing tasks and campaigns, enabling personalisation at scale across channels like email, web, and social.Voir la définition complète → to legal definitions under the EU GDPR (General Data Protection Regulation) and are echoed in US state laws like the CCPA (California Consumer Privacy Act).
Data owner. Accountable for a dataset. Decides purpose and who gets access. Usually a named business leader, not IT. Example: the OEM's VPVPA clear statement of the benefits your product delivers, the problems it solves and why customers should choose you over alternatives.Voir la définition complète → of Connected Services owns the telemetry dataset.
Data steward. Operational custodian. Maintains quality, definitions, and access lists day to day. Example: a data engineering lead who enforces that "odometer_km" always means kilometers, never miles.
Data processor. Under GDPR, a party that processes data on behalf of a controller and only on documented instructions. Example: a dealer running a diagnostics dashboard supplied by the OEM is a processor for that flow.
The controller (the party deciding why and how data is processed) carries the heaviest legal weight. In most connected-car flows the OEM is controller. But watch for joint controllership: if a Tier 1 supplier co-decides purposes (say, using braking data to improve its own ADAS product), both share controller duties under GDPR Article 26.
Take a location-based service where the dealer offers "find my car" to a customer.
| Data element | Owner | Steward | Processor | Controller (legal) |
|---|---|---|---|---|
| VIN | OEM Connected Svcs VPVPA clear statement of the benefits your product delivers, the problems it solves and why customers should choose you over alternatives.Voir la définition complète → | OEM data eng lead | Dealer app, Tier 1 telematics unit | OEM |
| GPS trace | OEM Connected Svcs VPVPA clear statement of the benefits your product delivers, the problems it solves and why customers should choose you over alternatives.Voir la définition complète → | OEM data eng lead | Tier 1 (collects), Dealer (displaysdisplaysThe total number of times an ad or piece of content is displayed, regardless of clicks. Each display counts as one impression, even to the same person.Voir la définition complète →) | OEM |
| Customer name + contact | Dealer sales director | Dealer CRMCRMCustomer Relationship Management: software and strategy to manage and analyse customer interactions throughout their lifecycle.Voir la définition complète → admin | OEM (for warranty) | Dealer (joint w/ OEM) |
The lesson: ownership does not transfer at the handoff. The GPS trace still belongs to the OEM even while the dealer displaysdisplaysThe total number of times an ad or piece of content is displayed, regardless of clicks. Each display counts as one impression, even to the same person.Voir la définition complète → it. The dealer is a processor for that element and must have a data processing agreement (DPA), a contract required under GDPR Article 28 that specifies exactly what the processor may do.
Do not wave at "privacy law." Name the instruments.
For a plain-language reference on GDPR roles, the EU's own text is readable: GDPR Article 4 definitions.
A concrete trap: automakers were found sharing driving-behavior data with data brokers who fed insurers. That is a "sale" or "sharing" under CPRA and triggers opt-out rights. If your governance mapmapUsing software to automate repetitive marketing tasks and campaigns, enabling personalisation at scale across channels like email, web, and social.Voir la définition complète → does not flag that downstream flow, you are exposed.
Use a RACI matrix (Responsible, Accountable, Consulted, Informed) for each cross-party process. Keep it boring and specific.
Example process: "Disable telemetry on customer opt-out."
The magic is that "Accountable" is exactly one named role. If opt-out fails, you know whose phone rings.
🎬 [VIDEO: "GDPR Explained: Controllers vs Processors" - youtube.com - a short, clear walkthrough of the legal roles that mapmapUsing software to automate repetitive marketing tasks and campaigns, enabling personalisation at scale across channels like email, web, and social.Voir la définition complète → directly to owner/steward/processor duties]
A governance framework is a document until you run checks against live data. Three practical ones:
1. Lineage check. Can you trace a single VIN's telemetry from vehicle sensor to every downstream consumer? If you cannot draw the mapmapUsing software to automate repetitive marketing tasks and campaigns, enabling personalisation at scale across channels like email, web, and social.Voir la définition complète →, you cannot honor a deletion request.
2. Consent reconciliation. Does the consent flag in the OEM system match what the Tier 1 unit is actually transmitting? Mismatches are the most common finding.
3. Access recertification. Every quarter, does each person with access still need it? Dealers rotate staff constantly; stale credentials are a breach waiting to happen.
Here is a simple consent reconciliation check in SQLSQLSales Qualified Lead: a prospect the sales team has validated as ready for direct outreach and a proposal, having passed clear qualification criteria.Voir la définition complète → you can adapt:
-- Find VINs still sending telemetry despite an opt-out flag
SELECT t.vin, t.last_seen_ts, c.consent_status, c.updated_at
FROM telemetry_ingest t
JOIN consent_registry c ON t.vin = c.vin
WHERE c.consent_status = 'OPTED_OUT'
AND t.last_seen_ts > c.updated_at; -- data arriving after opt-outAny rows returned are governance failures: a customer opted out, yet data kept flowing. Each row is a potential regulatory finding. Run it daily, alert on non-zero.
Vérification des acquis
1. A regulator asks who authorized sharing location data with an insurance partner, and each of the OEM, supplier, and dealer blames the others. What underlying governance failure does this illustrate?
2. Why does the lesson insist a data owner is usually a named business leader rather than someone in IT?
3. A dealer runs a diagnostics dashboard that was supplied by the OEM and acts only on the OEM's documented instructions. In this flow, what role does the dealer occupy?
4. Select ALL correct answers that accurately distinguish the data owner from the data steward.
Sélectionnez toutes les réponses correctes.
5. Select ALL correct answers about controllers and joint controllership in connected-vehicle data flows.
Sélectionnez toutes les réponses correctes.
Governance is also politics. Understand the leverage.
The OEM holds the type-approval relationship and usually the controller role, so it sets the rules. But Tier 1 suppliers like Bosch, Continental, and ZF build the telematics hardware and often the software, so they hold operational knowledge the OEM lacks. Dealers are frequently independent franchises, not owned by the OEM, which makes enforcement harder: you cannot just fire an internal team, you must contract with a separate business.
This is why DPAs (data processing agreements) matter more in automotive than in a single-company setting. Your governance only extends as far as your contracts. If the dealer network operates 3,000 independent franchises, you need 3,000 enforceable DPAs and a way to audit them at scale.
Practical move: standardize a single DPA template and a single consent schemaschemaA schema is the formal blueprint that defines how data is structured, named, typed, and related within a database, file, or message.Voir la définition complète → across the whole network. Do not let each dealer invent its own consent screen. One schemaschemaA schema is the formal blueprint that defines how data is structured, named, typed, and related within a database, file, or message. means one reconciliation check works everywhere.
Before any data crosses a party boundary, confirm:
1. Named owner on both sides (data does not become ownerless in transit).
2. Signed DPA specifying purpose limitation (data used only for the stated purpose).
3. Consent scope confirmed on the receiving side.
4. Lineage entry created so the flow is auditable.
5. Deletion propagation path defined (delete upstream, and it deletes downstream).
Miss item 5 and you get the classic failure: a customer's data is deleted at the OEM but lives on in a dealer's local export forever.
The cheapest governance is collecting less. Under GDPR's data minimization principle, you may only collect data adequate and relevant to your purpose. If "find my car" needs only current location, do not stream a full 90-day GPS history to the dealer app. Every element you do not share is one you never have to govern, secure, or delete.
Ask of every field: which named purpose justifies this, and who is the owner? If no one can answer, stop collecting it.