How long should a car dealer keep customer records?

Car dealers have no anti-money-laundering retention floor, so there is no rule forcing you to hold customer files for years. You keep your business and tax records for the ATO's general period, and you keep any sale records your state's motor-dealer licensing requires, but the identity and finance data you collect from customers should be destroyed once you no longer need it. The real risk is the opposite of keeping records too briefly: it is the pile of licence photos and finance paperwork nobody ever deletes.

By Jon Oates, Founder of Privaproof · Last updated 23 July 2026

General information, not legal advice. Privaproof is not a law practice.

The governing rule: destroy when no longer needed

Under APP 11, once you no longer need personal information for any purpose (and no law requires you to keep it), you take reasonable steps to destroy or de-identify it. For a dealership there is usually no privacy-specific law forcing you to hold a customer's identity data, so this destruction duty is the main constraint, and it points to keeping customer data for a defined, defensible period rather than indefinitely.

What you keep, and for how long

Business and tax records: the ATO's general period. Like any business, you keep your financial and tax records for the ATO's general retention period (broadly five years). That is your accounting records, not a reason to keep every customer's licence photo.
Sale records under state motor-dealer licensing. Your state's motor-dealer or motor-trader licensing rules may require you to keep certain sale or transaction records for a set period. That period varies by state, so confirm the requirement that applies to your dealership rather than assuming a number confirm your state's motor-dealer record-keeping period.
Finance paperwork. Where a lender requires records to be kept, that obligation may sit with the lender; destroy or securely archive your own copies once the deal is done and you no longer need them.
Test-drive licence data: keep it briefly. A licence taken for a test drive that ends with no sale usually needs to be destroyed soon after. Do not let licence images accumulate. Read: the test-drive licence

Over-retention is the real problem

Because nothing forces long retention, the failure mode at a dealership is holding data far longer than any purpose justifies: folders of finance applications, a phone full of licence photos, a previous owner's papers in a trade-in. Set a retention period, destroy or de-identify on schedule, and keep sensitive financial and identity data for the shortest time you can.

This is general information and document templates you tailor to your own business, not legal advice.

Common questions

Is there a legal minimum for keeping customer files?

There is no anti-money-laundering retention floor for car dealers. You keep business and tax records for the ATO's general period, and any sale records your state's motor-dealer licensing requires. Beyond that, APP 11 requires you to destroy or de-identify customer personal information once you no longer need it.

How long can we keep a test-driver's licence photo?

Only as long as you need it, which for a test drive with no sale is usually a short time. The safest practice is to avoid keeping the image at all, and to destroy any details you did record once the purpose has passed.

Do we have to keep finance records for years?

Any record-keeping obligation on finance usually flows from the lender's or the credit regime's requirements, not a privacy retention floor. Keep what you are actually required to keep, secure it, and destroy your own unnecessary copies. Confirm any credit-side obligations separately.

This is general information and document templates you tailor to your own business, not legal advice. Privaproof is not a law practice and does not provide legal advice. Retention periods depend on your purposes and any laws that apply, including your state's motor-dealer licensing rules, so confirm your own position. Privaproof's car-dealer documents are self-authored and are not independently reviewed by a solicitor. For advice on your specific circumstances, consult a qualified Australian legal practitioner.