GDPR for Detailers: Sharing Customer Data with Third Parties

GDPR – the law governing how businesses can use customer data, from names and addresses, to anything personally identifiable the business may hold on the owner – is a vast subject, full of grey areas and permission seeking tick boxes.

Here’s a question that trips up a lot of detailers:

Do you need a customer’s explicit permission to submit their email address to a manufacturer for a coating warranty?

As with all the best questions, the honest answer is “it depends” – so let’s unpick it.

We’ll assume your own data-protection housekeeping is already in order, and that you have (or have been refused) permission to process the information the customer has given you. If you’re holding their email as a result of direct contact where they haven’t been given an opt-out, such as a contact form or general enquiry which led to a booking, then yes, you’d need explicit permission to do anything further with it. But there are situations where you don’t need separate explicit consent to pass on relevant information for the customer’s own benefit.

What UK GDPR actually says

Since Brexit, UK businesses are governed by the UK GDPR – the retained version of the regulation, sitting alongside the Data Protection Act 2018 and overseen by the Information Commissioner’s Office (ICO) – rather than the EU GDPR. The relevant part here is Article 6, which sets out the lawful bases for processing personal data. Two of the six matter for this scenario:

• Performance of a contract (Article 6(1)(b)) – processing necessary to deliver something the customer has asked for, or to take steps at their request before entering a contract.
• Legitimate interests (Article 6(1)(f)) – processing necessary for the legitimate interests of you or a third party, provided those interests aren’t overridden by the customer’s own rights and freedoms.

If you’ve sold the customer a product and explained that it carries a warranty, then passing their contact details to the warranty provider is part of completing that contract – the provider needs those details, and it’s squarely in the customer’s interest. That gives you a lawful basis without needing a separate consent form.

What this does not cover

What you’re not signing the customer up for is marketing lists, up-selling emails, spam, or permission to sell their details on. Any of that needs its own separate agreement and explicit consent – and the third party should be aware of the distinction. Direct marketing in particular is governed by separate rules (PECR) on top of UK GDPR, and best practice remains to get clear consent before any marketing contact. A warranty is a service the customer has paid for, however indirectly; it shouldn’t come bundled with a marketing sign-up. It’s important you have a sharing agreement in place with the warranty endorser – if they break the rules and start spamming with marketing emails, you could still get into trouble as their agent and source.

Should you have to do this at all?

Ideally, no. A warranty shouldn’t be invalidated as long as the customer can provide whatever contact details are genuinely necessary, perhaps just for identification. Any switched-on manufacturer will have their own online warranty registration system that takes this out of your hands entirely – which also protects you, since you’re no longer handling data you arguably shouldn’t be, and it lets them seek their own marketing consent directly. If a manufacturer insists you submit customer data on their behalf, they should be able to demonstrate their own data-protection practices are watertight enough to take that responsibility off you.

Should you tell the customer anyway?

Yes. Always. It’s simple courtesy, and even where you’re legally entitled to process their data, a quick “I need to supply your email address to activate your warranty – is that OK?” is never a hard sell. If someone objects, and as a result you can’t provide the warranty, that’s their choice to make. Just ask before you apply the products – a “no” gets a lot more awkward afterwards if they weren’t aware of the condition – something to add to your terms and conditions page perhaps?

Get it right from the start

Data protection is one of the topics we cover in our Business and Marketing course and as part of our Level 1 professional detailer syllabus – because the consequences of getting it wrong for a legitimate business range from a fine, through general inconvenience, to the thing that stings most: an unhappy and inconvenienced customer.

This is general guidance for UK-based detailers, not formal legal advice. UK data protection law was updated by the Data (Use and Access) Act 2025, and the ICO’s guidance is the definitive source – check ico.org.uk or take professional advice for your specific situation. Last reviewed: 09/26