What GDPR compliance means
GDPR compliance means designing and running your processes so that any personal data you handle is processed lawfully, transparently, securely, and only for defined purposes — and that you can prove it (accountability).
In EV charging, GDPR compliance usually spans: CPMS + mobile apps, RFID tokens, payments/invoicing, roaming data exchange, support tooling, analytics, and logs.
What counts as personal data in EV charging (typical)
Even if you don’t store names, a lot of charging data becomes personal if it can be linked to a person:
– User account details (name, email, phone)
– RFID UID / app token linked to a driver
– Charging session history (time + location + kWh)
– Vehicle identifiers (if linked to a person)
– Support tickets and call recordings
– Device IDs when tied to a household/employee
– IP addresses and app analytics identifiers
The practical GDPR compliance checklist
1) Define roles: Controller vs Processor
Clarify who is the data controller (decides why/how) and who is a processor (acts on instructions). In charging, this can vary:
– Site owner / CPO often = controller for network operations
– CPMS provider often = processor (sometimes joint controller depending on purpose)
Document it and align contracts accordingly.
2) Pick a lawful basis for each purpose
Common bases in charging:
– Contract: providing charging service, accounts, billing
– Legal obligation: invoicing and tax retention
– Legitimate interest: fraud prevention, security monitoring, basic network analytics
– Consent: marketing, optional profiling, non-essential app tracking
Don’t rely on consent for things that are essential to operate the service.
3) Transparency (privacy notice)
Provide clear information about:
– What data you collect
– Why you collect it
– Who you share it with (roaming partners, payment providers)
– How long you keep it
– How users exercise their rights
4) Data minimization and purpose limitation
Only collect what you need for the defined purpose. Typical “easy wins”:
– Don’t store full payment card data (use PSP tokenization)
– Avoid storing precise location trails unless needed
– Limit logs so they don’t contain unnecessary PII
5) Retention schedule (and deletion)
Define retention per dataset, for example:
– Billing/tax records: keep as required by law
– Session data: keep only as long as needed for disputes/reporting
– App analytics: keep short, aggregate where possible
– Logs: shorter retention + restricted access
Implement automated deletion/anonymization.
6) Security measures (GDPR Art. 32 style)
For EV charging, practical measures include:
– Role-based access control (RBAC) in CPMS and support tools
– Encryption in transit (TLS/mTLS) and at rest
– Device identity and secure provisioning (certificates, mTLS)
– Audit trails for admin actions and configuration changes
– Vulnerability management and secure update pipeline
– Incident response plan and breach notification workflow
7) Data subject rights processes
Be able to handle requests for:
– Access, correction, deletion, portability
– Objection to processing (especially marketing/profiling)
– Restriction of processing
Your CPMS/app should support exporting and deleting user-linked data without breaking legal retention duties for invoices.
8) Data Processing Agreements (DPAs) and vendor management
You’ll usually need DPAs with:
– CPMS/SaaS vendors
– Hosting providers
– Payment service providers
– Customer support/ticketing tools
– Roaming/clearing partners (plus data sharing terms)
Ensure sub-processors, security measures, and transfer mechanisms are documented.
9) International transfers
If personal data leaves the EEA, ensure a valid mechanism (e.g., SCCs) and assess risks. This often matters for cloud hosting, analytics, and support platforms.
10) DPIA (Data Protection Impact Assessment)
Often relevant if you do:
– Large-scale location/session tracking
– Driver behaviour analytics and profiling
– Systematic monitoring in public spaces
A DPIA documents risks and mitigations and is strong evidence of accountability.
Common pitfalls in charging networks
– Treating RFID IDs as “not personal” (they usually become personal once linkable)
– Keeping session/location data indefinitely “for analytics”
– Sharing too much session data in roaming when only a subset is needed
– Debug logs containing names/emails and being retained too long
– Unclear controller/processor split between site owner, CPO, CPMS vendor
– No tested process for access/deletion requests
Related terms for internal linking
– Data minimization
– Controller / processor
– Data processing agreement (DPA)
– Forensic logging
– Cybersecurity
– Roaming / eClearing