When you appealed, did you do so only as the Keeper. Did you provide your name and address?
If they had your details as the Keeper and have since applied to the DVLA for your Keeper data, they have done so unlawfully. This warrants a formal complaint to the DVLA.
Don't worry about that Notice to Keeper (NtK). You already have an appeal rejection with a POPLA code.
You should send a formal complaint to the DVLA. Here’s how to make a DVLA complaint:
• Go to: https://contact.dvla.gov.uk/complaints
• Select: “Making a complaint or compliment about the Vehicles service you have received”
• Enter your personal details, contact details, and vehicle details
• Use the text box to summarise your complaint or insert a covering note
• You will then be able to upload a file (up to 19.5 MB) — this can be your full complaint or supporting evidence
That’s it.
The DVLA is required to record, investigate and respond to every complaint about a private parking company. If everyone who encounters a breach took the time to submit a complaint, we might finally see the DVLA take meaningful action—whether that means curtailing or removing KADOE access altogether.
For the text part of the complaint the webform could use the following:
I am submitting a formal complaint against Corporate Services Parking Management (CSPM), a BPA AOS member with DVLA KADOE access, for unlawfully obtaining my personal data when they had no legal basis to do so.
I, the Keeper, had already provided my full name and address in an appeal submitted directly to CSPM on 9 May 2025. They responded to that appeal on 21 May 2025, confirming receipt of my details. Despite this, CSPM went on to make a KADOE request to the DVLA and issued a Notice to Keeper thereafter.
The KADOE contract explicitly prohibits operators from accessing DVLA keeper data where the Keeper’s identity is already known. This was not a data misuse after lawful acquisition — this was an unlawful and unnecessary request for personal data that CSPM had no reasonable cause to make.
I have attached a full supporting statement and request a full investigation. Please confirm receipt and provide a reference number for this complaint.
Then you could upload the following as a PDF file for the formal complaint itself:
SUPPORTING STATEMENT
Complaint to DVLA – Breach of KADOE Contract and PPSCoP
Operator name: Corporate Services Parking Management (CSPM)
Date of PCN issue: [Insert date of PCN]
Vehicle registration: [Insert VRM]
I am submitting a formal complaint to report a misuse of DVLA data by CSPM, who unlawfully obtained my personal data under the KADOE (Keeper at Date of Event) contract, despite already holding it.
On 9 May 2025, I submitted a formal appeal to CSPM as the Keeper of the vehicle. This appeal included my full name and postal address. CSPM responded to this appeal on 21 May 2025, thereby confirming that they were in receipt of my Keeper data.
Despite this, CSPM subsequently made a KADOE request to the DVLA to obtain the same Keeper data again — and used it to issue a Notice to Keeper.
This action is a clear breach of the DVLA's KADOE contract, which prohibits access to DVLA data where the operator already holds the Keeper’s details. The UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, as the data was obtained without lawful basis.
This is not a case of data misuse after lawful acquisition. The request itself was unlawful. CSPM had no reasonable cause to request my data from the DVLA, and no lawful basis to process it again under the terms of the KADOE contract.
I am asking the DVLA to:
• Confirm that a KADOE breach has occurred
• Take enforcement action against CSPM for unlawful data access
• Review whether CSPM’s access to DVLA data should be suspended or revoked
Supporting documents are attached, including:
• My original appeal (9 May 2025)
• CSPM’s response (21 May 2025)
• The subsequently issued NtK
Please acknowledge this complaint and confirm the case reference number. I am happy to assist further if required.
Name: [INSERT YOUR NAME]
Date: [INSERT DATE]