Data Sharing Policy


1. Purpose of This Policy

This Data Sharing Policy sets out how NPED Services Ltd (“NPED”) shares, receives, processes, and protects personal data in accordance with the UK GDPR, the Data Protection Act 2018, and all other applicable data protection legislation.

It ensures that all data sharing undertaken by NPED is lawful, proportionate, secure, transparent, and necessary, and that NPED meets its obligations as a data controller when receiving and processing Shared Personal Data from Issuing Authorities (IAs), private parking operators (POs), and other approved partners.

2. Scope

This policy applies to:

  • All NPED employees, directors, consultants, contractors, and authorised partners handling personal data on behalf of NPED.
  • All personal data shared with NPED for inclusion in the National Persistent Evader Database (“the Database”).
  • All onward sharing of personal data by NPED to authorised users of the NPED Service.

This policy covers controller-to-controller data sharing, controller-to-processor arrangements, and onward disclosure to authorised third parties.

3. Principles of Data Sharing

NPED adheres to the UK GDPR principles. Personal data must be:

  • Lawful, fair and transparent
  • Collected for specified, explicit and legitimate purposes
  • Adequate, relevant and limited
  • Accurate and kept up to date
  • Stored only for as long as necessary
  • Processed securely
  • Handled in accordance with data subject rights
  • Not transferred outside the UK without appropriate safeguards

These principles apply to all data sharing activities undertaken by NPED.

4. Lawful Basis for Sharing and Processing

NPED acts as a data controller for all PCN Data and related vehicle data uploaded to the Database.

NPED relies on the lawful basis of Legitimate Interests (Article 6(1)(f) UK GDPR) for:

  • Operating the NPED Service
  • Scoring VRNs using the NPED scoring matrix
  • Conducting research and statistical analysis into persistent evasion and nuisance vehicles

A Legitimate Interest Assessment (LIA) is completed for each processing purpose and reviewed annually.

Issuing Authorities and POs must identify and document their own lawful basis for sharing data with NPED.

5. Types of Data Shared

In accordance with the Data Sharing Agreement, NPED receives the following Shared Personal Data:

  • Vehicle Registration Number (VRN)
  • Unique PCN reference number
  • First four digits of the offence postcode
  • Contravention reason, date and time
  • Whether the PCN remains unpaid after 28 days

NPED does not receive or process:

  • Names or addresses
  • Special category data
  • Criminal offence data
  • Data relating to individuals under 17

NPED may enrich vehicle records with Additional Data (e.g., MOT, VED, insurance status) from authorised DVLA data aggregators, subject to separate agreements and lawful basis assessment.

6. Purposes of Data Sharing

Data is shared with NPED for the following Agreed Purposes:

6.1 NPED Service Purpose

To enable NPED to provide real time scoring of VRNs to participating IAs and POs, supporting enforcement decision making and reducing avoidable processing costs.

6.2 Research Purpose

To conduct analysis into trends, persistent evasion, and nuisance vehicles.
All outputs are anonymised and aggregated.

6.3 Operational and Security Purposes

To maintain system integrity, detect misuse, and ensure compliance with NPED’s Terms of Service.

NPED does not use Shared Personal Data for:

  • Marketing
  • Automated decision-making with legal or significant effects
  • Any purpose incompatible with the Agreed Purposes
7. Data Sharing with Third Parties

NPED may share personal data only with:

  • Authorised Users (IAs and POs) who have uploaded PCN/parking charge data for the same VRN
  • Approved processors under written contracts
  • Law enforcement or statutory bodies, where legally required
  • NPED does not share raw PCN Data with any party that has not contributed data for the relevant VRN.

All third party access is logged, monitored, and subject to strict authentication controls.

8. International Transfers

NPED does not transfer Shared Personal Data outside the UK unless:

9. Data Quality and Accuracy

NPED ensures:

• Only compatible datasets are ingested

• Strong validation rules are applied at upload

• Duplicate or corrupt data is rejected or corrected

• Data can be replayed from the event store if required

Issuing Authorities and POs are responsible for ensuring the accuracy of the data they provide.

10. Security Measures

NPED maintains robust technical and organisational measures, including:

Encryption of data in transit and at rest

  • Secure SFTP and API upload mechanisms
  • Role based access control
  • Multi factor authentication
  • Immutable audit logs
  • Regular penetration testing
  • Staff training and confidentiality obligations

These measures align with the security requirements set out in the Data Sharing Agreement.

11. Data Subject Rights

Although NPED does not hold contact details for data subjects, NPED will:

• Support IAs and POs in responding to Subject Rights Requests
• Provide relevant information within statutory timeframes
• Maintain a log of all rights requests and outcomes

NPED relies on the Article 14(5)(b) exemption where direct notification to data subjects is impossible or disproportionate.

12. Retention and Deletion

NPED retains Shared Personal Data only for as long as necessary for the Agreed Purposes.

Retention periods are governed by the NPED Data Retention Policy, including:

  • VRN and PCN Data: typically up to 6–10 years depending on category
  • Archived vehicle records: 12 months after last activity
  • Research data: anonymised and retained indefinitely

Data is securely deleted using cloud native lifecycle policies and documented disposal procedures.

13. Governance and Accountability

NPED maintains:

  • A Data Protection Officer (if required by law)
  • A Record of Processing Activities (RoPA)
  • Annual reviews of all data sharing arrangements
  • DPIAs for high risk processing
  • Regular audits of processors and authorised users

Any new data sharing initiative must be approved by the Information Security Officer.

14. Personal Data Breaches

All breaches must be reported immediately to the Information Security Officer.

NPED will:

  • Investigate all incidents
  • Notify the ICO and affected parties where legally required
  • Cooperate with IAs, POs, and regulators
  • Maintain a breach register
15. Policy Review

This policy is reviewed annually or sooner if:

  • Legislation changes
  • New data sharing arrangements are introduced
  • Risks or operational needs change