It’s up to you now whether you want to out the knife in to APCOA for their failures and breaches which they are trying to squirm out of. You have successfully had the PCN cancelled, which is a success.
However, APCOA’s conduct here — misuse of your data, procedural failings, failure to adhere to PoFA properly, internal misrouting, unlawful third-party sharing, and misleading responses about presumed delivery — fully warrants escalated, serious complaints to:
• DVLA (for breach of KADOE and misuse of keeper data),
• Information Commissioner’s Office (ICO) (for unlawful processing and mishandling under UK GDPR),
• British Parking Association (BPA) (for breaches of the Private Parking Single Code of Practice — PPSCoP — and their AOS membership obligations).
You already have a live complaint with DVLA. Now you can escalate properly to the ICO and the BPA — and you can update DVLA too with further evidence.
APCOA, as usual, have behaved appallingly and you were right to pursue this hard. They thought you would back down.
The PPSCoP (Private Parking Single Code of Practice) at paragraph 11.3 does not specify that the 14-day acknowledgment deadline refers to working days—it simply says:
"A complaint must be acknowledged by the parking operator within 14 days of its receipt unless exceptional circumstances apply..."
In the absence of a specific reference to working days, this is correctly interpreted as calendar days.
In your case:
• Complaint sent: 3 April 2025
• Today: 19 April 2025
That is 16 calendar days, and no exceptional circumstances have been cited.
Since the DVLA complaint is already in progress, in order to maintain a clear audit trail of APCOA's continued non-compliance, here is a short, follow-up email you should now send to APCOA (copying both the original and misrouted contacts) to place them on further notice:
Subject: Failure to Acknowledge Formal Complaint – Breach of PPSCoP para. 11.3 – PCN LU00217221
Dear APCOA Complaints Team,
I am writing to remind you that I submitted a formal complaint by email on 3 April 2025 to ukcustomercomplaints@apcoa.com, copied to complaints.lutondropoff@apcoa.com, concerning PCN LU00217221 issued in respect of Loughborough University.
It is now the end of 18 April 2025, more than 14 calendar days since receipt, and I have received no acknowledgment or response. The Private Parking Single Code of Practice (PPSCoP) at paragraph 11.3 is clear:
“A complaint must be acknowledged by the parking operator within 14 days of its receipt unless exceptional circumstances apply…”
No such exceptional circumstances have been cited, and no update has been provided. Your failure to comply with this basic obligation constitutes a further breach of the PPSCoP, compounding the data misuse and internal misrouting I have already raised with the DVLA.
I now request immediate written acknowledgment of my complaint and confirmation of its referral to the correct internal team. Please treat this as a final opportunity to avoid further regulatory escalation.
Sincerely,
[Your Full Name]
[Your Contact Details]
[Vehicle Registration: YG12 BBF]
[PCN Reference: LU00217221]
The DVLA complaint is likely to be fobbed off at stage 1 and once you've verified that the correct VRM has been used, show us their response so that a stage 2 complaint can be submitted.
Regarding the formal complaint to APCOA, the PPSCoP states:
11.3. A complaint must be acknowledged by the parking operator within 14 days of its receipt unless exceptional circumstances apply, in which case the complainant must be kept informed by the operator.
NOTE: For a small operator there might from time to time be limited administrative capacity to handle communications, e.g. due to staff sickness.
11.4. A full response to a complaint must be provided by the parking operator within 28 days of its receipt unless exceptional circumstances apply, in which case the complainant must be kept informed by the operator.
If they've breached any of those requirements, let us know and a suitable follow up can be provided.
As already advised, all debt recovery correspondence can be safely ignored.
APCOA will not litigate at all, so no need to even contemplate that. They are benign.
Send the following to UKcustomercomplaints@apcoa.com and CC complaints.lutondropoff@apcoa.com and yourself:
Subject: Formal Complaint – Misrouted Complaint and GDPR/KADOE Breach – PCN LU00217221
Dear APCOA UK Customer Complaints Team,
I am writing to escalate a formal complaint regarding your company's appalling handling of a matter concerning Parking Charge Notice LU00217221, issued in relation to Loughborough University.
I initially submitted my complaint on 12 March 2025 to your designated customer complaints address (ukcustomercomplaints@apcoa.com). However, I have since received multiple replies from an entirely unrelated department—complaints.lutondropoff@apcoa.com, which clearly pertains to London Luton Airport. This wholly inappropriate redirection appears to have been triggered by incompetent staff or defective automated systems failing to understand that the “LU” prefix refers to Loughborough University, not Luton Airport.
This degree of operational incompetence is unacceptable.
Despite me clearly quoting the reference LU00217221, exactly as printed on both the NtK and subsequent correspondence from Debt Recovery Plus, your staff then wrongly claimed the reference was “in the incorrect format” and could not be located. Only when I reluctantly provided the vehicle registration, as your misdirected team requested, did the matter appear to be taken any further—though still by the wrong department.
This error has now resulted in my personal data being unnecessarily shared with a department entirely unconnected to the matter at hand, thereby breaching the principles of the UK General Data Protection Regulation (UK GDPR) and misusing DVLA keeper data obtained under the KADOE contract. Please take this as formal notice that I have raised a complaint with the DVLA regarding APCOA’s clear breach of the terms of that agreement, which strictly limits data processing to the specific contravention for which it was obtained.
To summarise:
• The PCN relates solely to Loughborough University, not Luton Airport.
• You have misused the data by forwarding it internally to a department with no relevance or lawful purpose.
• You failed to correctly identify your own reference number, despite it being printed on all official correspondence.
• You have demonstrated a complete lack of data handling safeguards and customer service accountability.
• You have failed to deal with the core PoFA-related issues raised in my original complaint.
I now demand the following:
1. Immediate escalation of this complaint to the correct department responsible for Loughborough University PCNs;
2. A full explanation as to why my personal data was shared with an unrelated team;
3. Confirmation of the corrective steps you are taking to prevent such GDPR and KADOE breaches in future;
4. Written confirmation that the PCN LU00217221 has been cancelled—or alternatively, a formal rejection with a valid POPLA code.
I expect a full response within 14 days.
Sincerely,
[Your Full Name]
[Your Postal Address]
[Your Email Address]
[Vehicle Registration: YG12 BBF]
You should also, without delay, make a formal complaint to the DVLA:
• Go to: https://contact.dvla.gov.uk/complaints
• Select: “Making a complaint or compliment about the Vehicles service you have received”
• Enter your personal details, contact details, and vehicle details
• Use the text box to summarise your complaint or insert a covering note
• You will then be able to upload a file (up to 19.5 MB) — this can be your full complaint or supporting evidence
That’s it.
The DVLA is required to record, investigate and respond to every complaint about a private parking company. If everyone who encounters a breach took the time to submit a complaint, we might finally see the DVLA take meaningful action—whether that means curtailing or removing KADOE access altogether.
For the text part of the complaint the webform could use the following:
I am submitting a formal complaint against APCOA Parking (UK) Ltd, a BPA AOS member with DVLA KADOE access, for breaching the Private Parking Single Code of Practice (PPSCoP) after obtaining my personal data.
While the Operator may have had reasonable cause at the time of their KADOE request, their subsequent misuse of my data—through conduct that contravenes the PPSCoP—renders that use unlawful. The PPSCoP forms an integral part of the DVLA’s governance framework for data access by private parking firms. Continued access is conditional on compliance.
The DVLA, as data controller, is obliged under UK GDPR and the Data Protection Act 2018 to investigate and take enforcement action when data is misused following release. This complaint is not about whether the data was obtained lawfully at the outset, but whether its subsequent use breached the terms under which it was provided.
I have prepared a supporting statement setting out the nature of the breach and the Operator’s actions, and I request a full investigation into this matter. I have attached the supporting document.
Please acknowledge receipt and confirm the reference number for this complaint.
Then you could upload the following as a PDF file for the formal complaint itself:
SUPPORTING STATEMENT
Complaint to DVLA – Breach of KADOE Contract and PPSCoP
Operator name: APCOA Parking (UK) Ltd
Date of PCN issue: 24 January 2025 (Notice to Keeper dated)
Vehicle registration: YG12 BBF
I am submitting this complaint to report a misuse of my personal data by APCOA Parking (UK) Ltd, who obtained my keeper details from the DVLA under the KADOE (Keeper At Date Of Event) contract.
Although APCOA may have had reasonable cause to request my data initially, their subsequent use of that data constitutes unlawful processing due to a breach of the Private Parking Single Code of Practice (PPSCoP). Compliance with the PPSCoP is a condition of the KADOE contract, which governs the permitted use of DVLA-supplied keeper data.
The KADOE contract states that personal data must only be used for the lawful pursuit of a parking charge, and only in accordance with the governing Code of Practice. When an operator breaches that Code, their lawful basis to continue processing the data collapses.
In this case, APCOA has breached the PPSCoP and misused DVLA data as follows:
1. Internal misrouting of my personal data to an unrelated business division.
After receiving my formal complaint regarding a PCN issued at Loughborough University, APCOA inexplicably forwarded my email, PCN reference, and vehicle registration to a completely unrelated department—the Luton Airport Drop-Off Complaints team. This appears to have occurred because of the “LU” prefix on the PCN (which refers to Loughborough University), leading APCOA to misclassify the complaint as a Luton Airport matter.
This represents an unlawful internal disclosure of my personal data to an irrelevant team with no lawful basis to process it. Once DVLA data is obtained under KADOE, it must not be disclosed further except as required to pursue the specific PCN. The Luton Airport division had no connection whatsoever to the matter, and therefore no lawful interest or justification for processing my data.
2. Incompetent record-keeping and false claim of an invalid PCN reference.
Despite me quoting the PCN number exactly as printed on the NtK and on a Debt Recovery Plus letter, APCOA claimed the number was “not in the correct format” and could not be found. This not only demonstrates a lack of data integrity and competence but further delayed their response to my complaint. They only acknowledged the case after I provided the vehicle registration, which they should never have needed had their records been accurate.
3. PoFA non-compliance.
In addition, the Notice to Keeper was not received until well outside the 14-day limit imposed by Paragraph 9(5) of Schedule 4 of the Protection of Freedoms Act 2012. This statutory failure means APCOA has no lawful basis to pursue the registered keeper, nor to process their data for this purpose.
These are not minor technicalities but systemic breaches. APCOA has clearly failed to implement proper safeguards to restrict access to DVLA keeper data and has allowed internal cross-contamination between departments. Their actions are in direct contravention of the KADOE contract and UK GDPR Article 5(1)(c) and (f).
The DVLA remains the Data Controller for data it releases under KADOE and is therefore obliged to ensure that the data is used only for permitted purposes and not mishandled internally by private operators.
I respectfully request that the DVLA investigate this matter fully and take appropriate enforcement action, including:
• Confirming that a breach has occurred
• Taking enforcement action against the operator
• Suspending or terminating their KADOE access if warranted
I have attached relevant email correspondence as evidence and am happy to provide additional information if required. Please acknowledge receipt and confirm the reference number for this complaint.
Name: [Insert Your Full Name]
Date: [Insert Date of Submission]