Finance and insurance data at a car dealership: the privacy rules when you broker a loan
When you help a buyer finance a car, you collect a concentrated set of personal and financial information, income, bank statements, ID and employment details, and you disclose it to lenders and insurers. That collection and disclosure is governed by the Privacy Act: you should notify the customer you will share it (APP 5), use and disclose it only for the finance purpose they expect (APP 6), keep it secure (APP 11), and mind APP 8 if any of it is processed offshore. Privacy law covers how you handle the data; the separate credit-reporting and credit-law rules are their own regime.
By Jon Oates, Founder of Privaproof · Last updated
General information, not legal advice. Privaproof is not a law practice, and this page does not cover your credit-law or credit-reporting obligations.
The finance flow is a disclosure to third parties
Brokering finance is one of the highest-stakes data flows in a dealership. You take a buyer's income and bank details and pass them to one or more lenders and insurers to get an approval. In privacy terms:
- You collect high-value personal and financial information from the buyer. It is not "sensitive information" in the Privacy Act's special sense (that category is health, biometrics and the like), but it is exactly the sort of data that causes serious harm if it leaks, so handle it carefully.
- You disclose it to third parties (the lenders and insurers). That disclosure has to be for the purpose the customer would expect, and covered by your collection notice.
The privacy rules that apply
- APP 5, notice. Tell the buyer, at the point you take their finance details, that you will disclose them to lenders and insurers to arrange finance, and to whom in general terms. Read: the collection notice a dealership needs
- APP 6, use and disclosure. Use and disclose the finance data only for arranging the finance the customer asked for. Do not shop a buyer's financial details around to lenders they did not agree to, or reuse them for unrelated marketing.
- APP 11, security. Income and bank details need strong protection: secure storage, limited access, and no leaving finance paperwork or scans lying around the yard or on personal devices.
- APP 8, overseas. If a lender, insurer, aggregator or cloud tool processes the finance data offshore, APP 8 applies and you can stay accountable for how the overseas recipient handles it. Read: car dealers, offshore finance and cloud tools
The line we do not cross: privacy is not credit law
Brokering finance also engages credit law and the credit-reporting system, which is a separate regime with its own rules (including Part IIIA of the Privacy Act on credit reporting, and the credit legislation that governs credit assistance). Those rules are distinct from the general privacy handling this page covers, and we keep to the privacy side. If you obtain credit reports, act as a credit assistance provider, or take on credit-provider obligations, get advice on those requirements specifically. This page is about handling the personal information properly, not about your credit-law duties.
This is general information and document templates you tailor to your own business, not legal advice.
Common questions
Is a customer's financial information "sensitive information"?
Not in the Privacy Act's technical sense. Sensitive information is a defined category (health, biometric, and similar), and financial data is not in it. But financial data is high-value and high-risk, so you should handle it with strong security and tight purpose limits even though it is "ordinary" personal information legally.
Can we send a buyer's details to several lenders to find the best rate?
Only for the finance purpose the customer expects and has been told about, and generally to the lenders they are actually applying with. Be transparent in your collection notice about disclosing to lenders and insurers, and do not disclose beyond what the buyer would reasonably expect.
Does this cover our credit-reporting obligations?
No. Credit reporting and credit law are a separate regime with their own rules. This page covers the general privacy handling of the finance data. Take specific advice on any credit-reporting or credit-assistance obligations your dealership has.
This is general information and document templates you tailor to your own business, not legal advice. Privaproof is not a law practice and does not provide legal advice, and does not cover credit-reporting or credit-law obligations, which are a separate regime. Privaproof's car-dealer documents are self-authored and are not independently reviewed by a solicitor. For advice on your specific circumstances, consult a qualified Australian legal practitioner.