ZEVRA › Knowledge › Documents, power of attorney and insurance

Data protection in vehicle registration: what dealers check under the GDPR

In short: A registration contains the customer's ID, vehicle documents and bank details. Processing is usually based on performance of a contract under Art. 6 GDPR. If a registration service works on your behalf, a contract under Art. 28 GDPR is required, and both sides take security measures under Art. 32.

Anyone submitting registrations for customers processes personal data. This page summarises the three articles of the General Data Protection Regulation that matter most.

Zevra is the B2B platform for digital vehicle registration for car dealers, registration services and fleets: cases are entered in the dealer portal and filed nationwide by power of attorney with qualified electronic signature – from €10 per registration, no base fee, no minimum volume.

Last updated: · Zevra editorial team · Reviewed by M. Gabal, owner

Data protection in vehicle registration: what dealers check under the GDPR

On what legal basis may dealers process customer data?

Processing is lawful if at least one condition of Art. 6(1) GDPR is met.

For registration, performance of a contract with the customer and compliance with a legal obligation matter most.

Which keeper data the registration application must contain is set by section 6(1) FZV – for example name, date of birth, place of birth and address.

What must the contract with a registration service contain?

What must the contract with a registration service contain?
Duty of the processorArt. 28(3)
process only on documented instructionspoint (a)
bind staff to confidentialitypoint (b)
take security measures under Art. 32point (c)
engage further processors only with authorisationpoint (d)
delete or return data after completionpoint (g)
allow evidence and auditspoint (h)

The contract also sets out the subject matter, duration, nature and purpose of the processing.

Which security measures does Art. 32 name?

  • pseudonymisation and encryption of personal data
  • ongoing confidentiality, integrity, availability and resilience of systems
  • rapid restoration after an incident
  • regular testing of the effectiveness of the measures

How does Zevra implement this?

Zevra processes the data as a processor on behalf of the dealer. Personal fields are stored encrypted, and backups run daily in 3 locations.

Details on storage location, encryption and deletion periods are on the data security page.

What should dealers check before starting?

  • Is there a data processing agreement?
  • Where is the data stored and who has access?
  • When are ID copies deleted?
  • How does the application reach the authority?

With Zevra, registration costs from 10 € per transaction and deregistration 2 € net, plus official fees.

Next step for your business. How businesses put this topic into practice with Zevra: Registration services · Car dealerships · Data security · How Zevra works · View pricing
Digital registration in figures
  • Temporary registration proof: valid for 10 days
  • Documents posted by the authority: within 6 days
  • Digital deregistration: documents from 01.01.2015
  • Digital registration: documents from 01.01.2018
  • Registration with Zevra: €10 net
  • Deregistration with Zevra: €2 net · base fee: €0

Deadlines and cut-off dates according to: Bundesministerium für Verkehr

Read more

Sources: BfDI: DSGVO – BDSG, Texte und Erläuterungen (Stand März 2026) · Fahrzeug-Zulassungsverordnung (FZV) § 6 – Antrag auf Zulassung · Sources · FZV sections § 6

Answers to common questions

Does a dealer need a contract with the registration service?
Yes, if the service processes data on its behalf. Art. 28(3) GDPR requires a contract or other legal act.
May a registration service use a subcontractor?
Only with prior specific or general written authorisation of the controller.
What happens to the data after the assignment?
At the controller's choice it is deleted or returned, unless there is a legal obligation to store it.
Is encryption mandatory?
Art. 32 names encryption as one of the measures for a level of security appropriate to the risk.

Frequently asked questions about digital vehicle registration