What does privacy compliance cost a car dealer?
Privacy compliance for a dealership really costs in one of three ways: a cheap generic template that is the wrong shape for a car yard and goes stale, a bespoke lawyer engagement that is expensive and still goes stale, or a sector-specific kit that is kept current as the law changes. The trap is thinking of it as a one-off document cost. The real cost is keeping the documents current, and dealer privacy is moving.
By Jon Oates, Founder of Privaproof · Last updated
General information, not legal advice. Privaproof is not a law practice.
The three ways dealers pay for this
- The free or cheap generic template. A generic privacy-policy generator costs little, and it is written for a generic business. Open the one you have and search it for four words: licence, finance, trade-in, camera. Whatever it says about those is what you have. A generated document also does not update itself, so it does not move when the law does.
- The bespoke lawyer engagement. A lawyer can draft you a tailored set, and for a complex or higher-risk dealership that is the right answer. It is a one-off engagement, so the documents still go stale unless you pay again to refresh them. The question is whether your position is genuinely bespoke, or the same licence, finance and camera ground every yard covers.
- The kept-current sector kit. A car-dealer-specific document set, written for how a dealership actually collects and holds data, at a self-serve price, with updated versions issued while your subscription is active as the rules move.
Why "kept current" is the part that matters
Dealer privacy is not static. From 10 December 2026, APP 1.7 requires a covered dealership's privacy policy to disclose where a computer program makes, or does a thing substantially and directly related to making, a decision that could reasonably be expected to significantly affect a person's rights or interests. Worth asking of any finance pre-qualification tool you run. And the OAIC's Bunnings determination (29 October 2024), affirmed on its APP 1 and APP 5 transparency findings by the Administrative Review Tribunal on 4 February 2026, is the clearest Australian marker for yard cameras doing facial recognition. The forgotten cost is noticing a change like that and refreshing every document it touches. Read: yard CCTV and facial recognition
What Privaproof costs, and what you get
The Car Dealer Kit is A$449 per year including GST, for all fourteen documents: the privacy policy, collection notices, a test-drive and finance-data procedure, a CCTV and yard-surveillance procedure, a breach response plan, a retention and destruction schedule, and the staff, supplier and marketing documents behind them. One price for the set, no per-document charge, no lock-in, and a 30-day guarantee. While your subscription is active, we monitor the law and aim to provide updated versions as it changes. This is not a guarantee of compliance, and does not replace your own legal advice.
That is the honest positioning: shaped for a dealership rather than a generic business, and with the updating inside the subscription rather than paid for each time the law moves. If the Privacy Act covers your dealership, note where the Act puts the emphasis: s 13K(1)(b)(ii) names APP 1.4, the contents of a privacy policy, as a contravention the Commissioner can act on by infringement notice under s 80UB, without going to court. Does the policy you have now contain everything APP 1.4 lists?
Common questions
Can we just use a free template and be done?
You can. The test is whether the template you pick addresses the four places a dealership holds personal information: the test-drive licence, the finance details you disclose to a lender or insurer, the trade-in, and the yard cameras. A generated document also will not update itself, so whatever it says today is what it says in December.
Is a lawyer worth it?
For some dealers, yes, especially larger or higher-risk operations. A maintained sector kit covers the common ground, and you can take specific advice on the parts that are genuinely bespoke to you. At A$449 a year with no lock-in it is not a permanent choice between the two.
Why a subscription rather than a one-off?
Because a document does not move when the law does. APP 1.7 commences on 10 December 2026 and adds to what a covered entity's privacy policy must contain, and the facial-recognition position moved again when the Administrative Review Tribunal ruled on the Bunnings determination on 4 February 2026. A one-off document needs a paid refresh for each. A subscription is designed to carry them.
This is general information and document templates you tailor to your own business, not legal advice. Privaproof is not a law practice and does not provide legal advice. Written by Privaproof. Whether the Privacy Act 1988 (Cth) reaches your dealership depends on your turnover and structure, and state surveillance-devices legislation applies to your cameras separately. For advice on your specific circumstances, consult a qualified Australian legal practitioner.