Almost half of private parking companies audited by the Government have been rated as either ‘red’ or ‘amber’ for their handling of vehicle keeper data, according to analysis of Freedom of Information disclosures by the RAC. The findings raise fresh questions about compliance among private parking operators and add to calls for the Government’s long-delayed Private Parking Code of Practice to be implemented.
The RAC’s analysis covers 57 car park management companies assessed by the Government Internal Audit Agency during 2025/26. Of these, 23 (40%) received a ‘red’ rating, indicating significant weaknesses or serious compliance concerns, while five (9%) were rated ‘amber’, highlighting issues requiring improvement.
The remaining 29 operators (51%) were rated ‘green’.
The audit ratings relate to companies’ access to information held by the Driver and Vehicle Licensing Agency (DVLA), which private parking operators can use to obtain registered keeper details when pursuing parking charge notices.
Under the Keeper at Date of Event (KADOE) service, operators pay £2.50 per record requested. Access is restricted to companies that belong to either the British Parking Association or the International Parking Community.
The RAC’s review of audit results dating back to 2015 also identified several companies that have repeatedly received the lowest rating.
G24 Ltd was rated ‘red’ in five of its six audits, including assessments in 2025, 2023, 2020, 2019 and 2018.
UK Car Park Management Ltd received four ‘red’ ratings across audits in 2023, 2019 and twice in 2018. Vehicle Control Services Ltd was also rated ‘red’ on four occasions, in 2023, 2020, 2018 and 2017.
APCOA Parking (UK) Ltd received a ‘red’ rating in each of its three audits, the most recent in 2024/25, following earlier assessments in 2022 and 2020.
The Government Internal Audit Agency stresses that its red, amber and green classifications represent an assessment of an organisation’s compliance with DVLA requirements at a particular point in time.
The checks examine whether companies have a lawful basis for accessing vehicle keeper information, restrict requests to legitimate parking enforcement activity and use the data only for authorised purposes.
Auditors also assess data retention and disposal, information security, staff access controls, complaints procedures and record-keeping, alongside operators’ compliance with relevant industry codes of conduct.
Evidence supporting parking charge notices, controls governing automatic number plate recognition (ANPR) cameras and the handling of information by third parties, including debt recovery agents, contractors, councils, NHS trusts and universities, can also be scrutinised.
The findings come ahead of the planned introduction of the Government’s Private Parking Code of Practice, which is expected to be brought into force later this year. Under the proposed framework, operators will have to meet a range of requirements to retain access to the DVLA database.
The code was legislated for in 2019 but withdrawn in 2022 following legal challenges from the private parking industry and debt recovery firms.
RAC head of policy Simon Williams said the audit findings underlined the need for the code to be introduced.
“These government audits into the way private parking companies work with DVLA data are very revealing with more than half (52%) being identified as having practices which led to them being rated as ‘red’ or ‘amber’,” he said.
Williams said the code would require parking management companies to meet key operating standards to retain access to registered keeper information, without which they would be unable to issue parking charge notices using the DVLA database.
He added that the RAC continued to press for the code’s implementation on behalf of drivers.
The scale of parking enforcement activity also highlights the significance of the issue. According to separate RAC analysis, private parking companies requested a record 17 million vehicle keeper records from the DVLA in the year to the end of March 2026.
(Picture: RAC)
