Government audit identifies issues with more than half of private parking firms’ use of DVLA data

40% of audited car park management companies rated as ‘red’ indicating possible misuse of data or significant risk to data protection

19/10/2026

Almost half of private parking companies (49%) audited by the Government have been rated as ‘red’ or ‘amber’ over their use of DVLA vehicle keeper data, new analysis of Freedom of Information data by the RAC has found.

Fifty-seven car park management companies, which can request information from the Driver and Vehicle Licensing Agency’s database* for the purpose of issuing parking charge notices to drivers, were assessed by the Government Internal Audit Agency in 2025/26.

Of these 40% (23) were ranked as ‘red’ which typically means significant weaknesses or serious compliance concerns were identified. These could include possible misuse of DVLA keeper data or inadequate safeguards, material failures in controls or procedures, or significant risk to data protection, governance or compliance.

In addition, 9% (5) were rated ‘amber’ meaning weaknesses were found that require improvement but were not considered critical. These may be non-compliance or control weaknesses or risks that data could be mishandled if improvements are not made. Fifty-one percent of companies audited (29) were rated as ‘green’.

When pursuing parking charge notices, private parking companies can obtain registered keeper details from the DVLA via the KADOE (Keeper at Date of Event) service at a cost of £2.50 per record. In order to do this they have to be members of either the British Parking Association (BPA) or the International Parking Community (IPC).

The government audits check a number of points including whether these companies have a lawful basis for requesting keeper data; only request data for genuine parking enforcement activity; use DVLA data solely for the permitted purpose; retain and dispose of data appropriately and protect personal data securely. They also review whether operators’ procedures align with the industry’s own code of conduct.

Auditors typically test sample parking charge notices; evidence supporting DVLA requests; automatic number plate recognition camera (ANPR) usage controls; staff access controls; complaint handling procedures; audit trails and record keeping; third-party processors such as debt recovery agents, parking management contractors, councils, NHS trusts and universities.

Worryingly, looking over checks dating back to 2015, one company has been rated ‘red’ on five occasions from six audits G24 Ltd (2025, 2023, 2020, 2019, 2018). Furthermore, two companies were rated ‘red’ on four occasions: UK Car Park Management Ltd (2023, 2019, 2018 x2) and Vehicle Control Services Ltd (2023, 2020, 2018, 2017). In addition, APCOA Parking (UK) Ltd has been audited three times – the most recent being 2024/25 – and has been ‘red’ each time (also 2022 & 2020).

The Government Internal Audit Agency does, however, state that its ‘Red, Amber, Green’ ratings are based solely on a point in time assessment of the organisation's compliance with DVLA requirements.

Under the Government’s official Private Parking Code of Practice, which is due to be brought into force later this year, car park management companies will have to be compliant with a range of operating requirements or risk losing access to the DVLA database.

RAC head of policy Simon Williams said: “These government audits into the way private parking companies work with DVLA data are very revealing with more than half (52%) being identified as having practices which led to them being rated as ‘red’ or ‘amber’.

“These findings demonstrate the desperate need for the Government’s Private Parking Code of Practice to finally be brought into force since becoming law back in 2019. Crucially, it will require all car park management companies to have to meet a number of key operating standards in order to have access to the DVLA’s keeper database. Without this of course, they will not be able to issue parking charge notices to drivers.

“The RAC continues to work hard on behalf of drivers to get the code back into action, after it was withdrawn in 2022 following legal challenges from the private parking industry and debt recovery firms.”

RAC analysis of requests made by private parking companies for keeper details from the DVLA in the year to the end of March 2026 shows a record of 17m were issued to drivers.