Key data sovereignty regulations in the automotive industry

Nataliia Dolzhenko

In 2021, Volkswagen faced a €1.1 million fine after a data breach exposed sensitive information from over 3.3 million customers in North America. Like all companies, automotive companies don’t want the publicity that follows a data mishap. One step towards automotive data security is compliance with automotive data residency and sovereignty laws.

Staying compliant with these regulations is essential for avoiding fines, securing customer trust, and ensuring smooth global operations.

In this article, we’ll explore the essential data sovereignty regulations that every automotive leader should know and highlight how InCountry’s data residency solutions can simplify the path to compliance.

What is data sovereignty in the automotive industry?

Data sovereignty in the automotive industry is the principle that data generated by vehicles, their users, manufacturing processes, and related services should be subject to the laws and regulations of the country where it originates. This means ensuring that data storage, processing, and collection adhere to local legal requirements.

As the automotive industry becomes increasingly globalized, with vehicles, data centers, and services crossing borders, data sovereignty becomes necessary to protect user privacy, national security, and economic interests. Note that data residency in the automotive industry refers to the practice of storing and processing data within a specific geographical location.

Why automotive data sovereignty is critical

Another way to consider this is to reflect on data sovereignty automotive benefits. Beyond compliance, data sovereignty plays a crucial role in protecting sensitive personal and business information. For automotive companies, this protection is essential—not only to avoid regulatory issues but to safeguard consumer trust, secure proprietary data, and enhance operational resilience.

Here’s why data sovereignty is critical for automotive companies:

Safeguarding consumer privacy 

Modern vehicles collect extensive personal data, from driver behaviors and locations to even biometric information (in some cases). Data sovereignty ensures this data stays within a jurisdiction’s control, aligning with local privacy standards to protect it from misuse. This protection is crucial for individual privacy.

Strengthening data security:

As vehicles and connected systems advance, the risk of cyber threats grows. Data sovereignty often requires in-country data storage, allowing local cybersecurity measures to safeguard it. This approach minimizes unauthorized access and the risk of cyber breaches. It also ensures sensitive data is not exposed or transferred to regions with weaker security protocols.

Ensuring compliance with regulations

To operate smoothly and avoid penalties, auto manufacturers must comply with data sovereignty laws, which vary by region. For instance, while the EU GDPR permits data transfers once appropriate conditions have been fulfilled, China requires sensitive data to remain within its borders. Automotive companies must adapt to these differing laws to maintain market access and avoid costly legal consequences.

Preserving competitive edge

Automotive data includes sensitive details on manufacturing, vehicle design, and software. Data sovereignty laws help shield this proprietary information from unauthorized access, reducing the risk of industrial espionage. It also helps these automotive companies maintain their competitive advantage.

Building consumer trust

As consumers become increasingly aware of data privacy, they expect auto manufacturers to handle their information responsibly. Automobile data sovereignty supports consumer trust by placing stringent requirements for data processing, storage, and transfers. With this, customers are more likely to trust companies that prioritize their data security and privacy.

Automotive data sovereignty laws by country

Let’s review some automotive data sovereignty laws by country, for this purpose, the following countries/regions will be our focus:

  1. China.
  2. European Union.
  3. United States of America.
  4. Japan.

China’s automotive data regulation 2021

Introduced on October 1, 2021, this regulation significantly strengthened data residency for the automotive industry in China. This automotive data sovereignty law mandates that data collected from vehicles operating in China must be stored within its borders. This approach aims to protect sensitive information, prevent misuse, and maintain jurisdictional control over data in line with China’s comprehensive data protection policies.

The regulation’s core requirements are summarized below:

Automotive companies must keep sensitive data, such as vehicle location, images, and biometric information, within China. Specific categories of sensitive data require a security review before being transferred out of the country, thereby minimizing risks of foreign access and ensuring that information remains secure from external threats.

The law categorizes automotive data as either “personal information,” which directly identifies individuals, or “important data,” which could impact national security or public interests. For example, detailed geographic data on vehicle routes might qualify as “important data” due to its relevance to national security.

Foreign auto manufacturers must meet China’s data localization requirements, including conducting risk assessments before moving any data abroad. Compliance often requires investment in local data infrastructure, such as Chinese-based data centers, or partnerships with local entities, which can increase operational costs.

Oversight by the Cyberspace Administration of China (CAC) means non-compliance could lead to significant penalties, from fines and restrictions on business activities to the potential loss of market access. This highlights the regulation’s critical impact on automotive businesses.

The regulation strengthens privacy protections for consumers, limiting how automotive companies collect and handle personal information. This aligns with China’s broader data privacy laws, like the Personal Information Protection Law (PIPL), which emphasizes transparency, security, and the importance of consumer consent.

Several foreign automakers, such as Tesla and BMW, have established data centers within China to comply with these regulations. Tesla, for instance, opened a data center in Shanghai in 2021 to store data locally, allowing it to meet the local storage requirements and avoid complications with data transfers.

The European Union’s automotive data sovereignty regulation

Although the European Union (EU) does not have a single body of laws known as the Automotive Data Sovereignty Law, it has some regulations that apply to the automotive industry. The two primary regulatory frameworks are the General Data Protection Regulation (GDPR) and the Cybersecurity Act. These regulations establish requirements for handling, storing, and transferring automotive data generated within the EU. They focus on user privacy, data security, and operational compliance.

Here are some critical requirements that business leaders in this industry must be aware of to operate smoothly in the EU:

The GDPR sets strict rules on data transfer and storage, especially for data collected from connected vehicles, which may include location, biometric, and behavioral information. Automotive data gathered in the EU must remain within the EEA or meet “adequate protection” standards for external transfers. These protection standards include Standard Contractual Clauses (SCCs) or Binding Corporate Rules (BCRs). These will ensure data sovereignty for connected vehicles.

Violating GDPR transfer rules can lead to penalties of up to €20 million or 4% of global revenue. Additionally, GDPR mandates that only necessary data is collected, with explicit user consent required for processing.

The EU Cybersecurity Act, overseen by ENISA (the European Union Agency for Cybersecurity), introduces cybersecurity certification schemes crucial for connected and autonomous vehicles. Although the certification is voluntary, it has become essential as these vehicles are frequent targets for cyberattacks. By meeting these standards, manufacturers can enhance data security, reassure regulators, and build consumer trust.

Technical security measures, including encryption, secure access controls, and frequent software updates, are mandatory for data protection in connected vehicles. Standards like ISO/SAE 21434, which focuses on automotive cybersecurity, align with EU regulations to help ensure these vehicles are resilient against potential cyber threats. Compliance with these standards not only safeguards manufacturers from breaches but also protects their reputations and reduces the risk of financial losses from security incidents.

The GDPR imposes substantial fines for non-compliance, with automotive companies facing millions in penalties for unauthorized use of in-car recording systems or location tracking. Non-adherence to GDPR and the Cybersecurity Act can also lead to operational disruptions, product recalls, or restricted market access. Cybersecurity lapses, which may result in data breaches, expose companies to further lawsuits and compensation claims from affected users. This highlights the high operational and financial risks associated with non-compliance.

Like the GDPR, the U.S. does not have a specific law for automotive data sovereignty. However, a mix of state and federal laws, like the California Consumer Privacy Act (CCPA) and cybersecurity standards from the National Institute of Standards and Technology (NIST), guide how automobile companies should handle data. These rules help protect consumer privacy and car cybersecurity. As new federal laws are being considered, the landscape of automotive data sovereignty is constantly changing.

Below are some important provisions of the US automobile data sovereignty regulations:

Since 2020, the CCPA has granted California residents greater control over their personal data, allowing them to access, delete, and opt out of data sales. This law affects data from connected and autonomous vehicles, covering location data, driver behaviors, and biometric details. Companies must inform consumers about data collection and give them options to control data sharing. Non-compliance with CCPA can result in fines of up to $7,500 per intentional violation. Given California’s importance in the U.S. market, many auto manufacturers apply CCPA standards nationwide to prevent penalties and maintain brand reputation.

The Federal Trade Commission (FTC) oversees data protection for consumers through laws that, while not specific to automotive data, hold companies accountable for secure data practices. The FTC has also issued warnings to automakers, emphasizing the need for clear and accurate privacy disclosures and data security in connected vehicles. The National Institute of Standards and Technology (NIST) provides a voluntary Cybersecurity Framework widely used by automakers. It includes risk assessments, data protection protocols, and incident response guidelines, supporting companies in adopting industry-standard cybersecurity practices to protect vehicle data from unauthorized access and potential threats.

The proposed American Data Privacy Protection Act (ADPPA), introduced in 2022, aims to establish consistent consumer data privacy protections across the U.S. If passed, it would standardize data access, deletion, and portability rights, potentially superseding state laws like the CCPA. For the automotive industry, ADPPA would require companies to obtain consent to collect sensitive data and stick to the limits on data use and sharing. Non-compliance could incur fines of up to 4% of annual global revenue.

Japan enforces data sovereignty and privacy in the automotive sector through a range of national data protection laws, particularly the Act on the Protection of Personal Information (APPI). The APPI governs collecting, processing, and transferring personal data, including information from connected and autonomous vehicles. This regulatory framework is further supported by guidance from the Ministry of Economy, Trade, and Industry (METI) and voluntary industry standards, all aiming to secure consumer privacy, enhance cybersecurity, and manage cross-border data transfers.

APPI requires companies to handle personal data transparently, informing users of how their data will be used and obtaining consent before collecting it. This applies to automotive data, including location, driver behavior, and biometric information from connected vehicles. To comply, companies must minimize data collection to only what’s necessary and use it solely for stated purposes, like navigation or safety. Non-compliance with APPI can lead to regulatory penalties and reputational harm.

APPI mandates that personal data be stored domestically or transferred to countries with equivalent data protection, like the EU, under a 2019 adequacy agreement. For countries with such provisions, companies must implement additional safeguards, such as Standard Contractual Clauses (SCCs) or user consent, ensuring compliance while enabling automakers to use international data storage if they meet APPI standards.

METI provides cybersecurity guidelines for the automotive industry, recommending encryption, secure communication, and regular software updates to safeguard vehicle data. Although voluntary, these guidelines establish best practices. The National Center of Incident Readiness and Strategy for Cybersecurity (NISC) collaborates with METI, focusing on threat detection, incident response, and audits to further enhance automotive data protection.

With the development of autonomous vehicles, Japan emphasizes data protection for Advanced Driver Assistance Systems (ADAS). The Ministry of Land, Infrastructure, Transport, and Tourism (MLIT) recommends anonymizing sensitive data in these systems. They also advocate for a “privacy by design” approach, urging auto manufacturers to integrate data protection measures from the beginning stages of developing autonomous driving technologies.

APPI grants consumers rights to access, correct, or delete their personal data, and automakers must implement systems to fulfill these requests. This applies to vehicle data, location history, and biometrics, requiring automotive companies to invest in data management systems that allow consumers to exercise their rights without affecting service quality.

APPI violations can result in fines, corrective actions, and public disclosure of infractions by Japan’s Personal Information Protection Commission (PPC). Penalties for serious data breaches have increased, reaching up to ¥100 million (around USD 750,000), in line with global data protection trends.

Although it’s quite broad, this framework provides a robust foundation for automotive data security and privacy in Japan, ensuring consumer protection in a rapidly advancing sector.

Challenges with data sovereignty in the automotive industry

Complying with sovereignty laws sometimes comes with some hurdles; let’s review some data sovereignty automotive challenges that could pose a challenge to your business.

  1. Cross-border data management
    Managing data across borders poses a significant challenge due to differing data sovereignty automotive laws. Companies need a strategy that respects each region’s regulations while maintaining efficiency across regions.
  2. Cybersecurity risks
    As connected vehicles evolve, the risk of cyber threats grows. Automotive companies must invest heavily in cybersecurity protocols, adhering to standards across regions to mitigate data sovereignty automotive challenges and protect sensitive data.
  3. Data localization requirements
    Some countries, like China, require that data be stored domestically, forcing companies to invest in local data centers or partner with local providers. This adds to the operational costs and complexity of managing data across borders.

Interoperability and standardization

The absence of consistent data standards makes data sovereignty for connected vehicles challenging to manage, increasing compliance risks and operational inefficiencies.

How InCountry can help global companies stay compliant with automotive data sovereignty laws

Managing global data sovereignty automotive regulations can be complex. InCountry simplifies this by providing data residency-as-a-service globally, ensuring your data complies with local regulations. Our services allow you to store automotive data in specific regions without compromising on accessibility or security.

InCountry’s solutions include:

Get in touch already and let’s discuss your data compliance needs and help your automobile company comply with all applicable automobile data sovereignty regulations.