How long should a car dealer keep customer records?
Car dealers have no ongoing anti-money-laundering retention floor: the one group that had one, dealers acting as insurance providers or intermediaries, left the Financial Transaction Reports Act on 7 January 2025, on AUSTRAC's own advice. You keep tax records for 5 years, and your state's motor-dealer records for the period that state sets: 6 years in NSW and Victoria, 5 in Queensland. The identity and finance data you collect from customers is different, and you take reasonable steps to destroy or de-identify it once you no longer need it. The real risk is not keeping records too briefly: it is the pile of licence photos and finance paperwork nobody ever deletes.
By Jon Oates, Founder of Privaproof · Last updated
General information, not legal advice. Privaproof is not a law practice.
The governing rule: destroy when no longer needed
APP 11.2 is the rule, and it binds you only if the Act covers your dealership at all (check that first). Where you hold personal information you no longer need for any purpose you may use or disclose it for, and no Australian law or court or tribunal order requires you to retain it, you must take such steps as are reasonable in the circumstances to destroy it or de-identify it. Paragraph (d), the law-required limb, is where the tax and state periods sit: inside one, keeping the record is required; when it runs out, the destruction duty takes over. No privacy law makes you hold a customer's identity data.
What you keep, and for how long
- Business and tax records: 5 years. Section 262A(4)(a) of the Income Tax Assessment Act 1936 sets the period at 5 years, running from when the record was prepared or obtained or the transactions were completed, whichever is later. That is the same start rule the ATO publishes. It covers your accounting records. It is not a reason to keep every customer's licence photo.
- Sale records under state motor-dealer licensing. This is state law: the period differs, and so does the date the clock starts. NSW is at least 6 years after the last entry made in the record (Motor Dealers and Repairers Regulation 2025 (NSW) cl 39, in force 1 September 2025). Victoria is at least 6 years after the document's creation (Motor Car Traders Act 1986 (Vic) s 83A). Queensland is at least 5 years for each document the Act requires a principal licensee to keep (Motor Dealers and Chattel Auctioneers Regulation 2014 (Qld) s 17(2)). Trading elsewhere, find your own provision before you set a schedule.
- Finance paperwork. A credit provider's record-keeping duty is the lender's, not yours. The question worth asking is which finance documents you are still holding that the lender already holds: those are the copies to destroy or securely archive once the deal is done.
- Test-drive licence data: keep it briefly. A licence taken for a test drive that ends with no sale usually needs to be destroyed soon after. Do not let licence images accumulate. Read: the test-drive licence
Over-retention is the real problem
Because nothing forces long retention of the customer file, the failure mode at a dealership is holding data far longer than any purpose justifies: folders of finance applications, a phone full of licence photos, a previous owner's papers in a trade-in. The required record is narrower than the pile: Schedule 3 of the NSW regulation asks for the seller's name and address and, for a private seller, a driver licence, passport or Photo Card number. A photograph of the licence is not on that list. Set a retention period, destroy or de-identify on schedule, and keep identity and financial data for the shortest time you can.
This is general information and document templates you tailor to your own business, not legal advice.
Common questions
Is there a legal minimum for keeping customer files?
Not from anti-money-laundering law: AUSTRAC's position is that since 7 January 2025 motor vehicle dealers who act as insurance providers or intermediaries are no longer regulated under the Financial Transaction Reports Act, though pre-repeal reports and records still stand. The minimums that do apply are tax at 5 years (s 262A(4)(a) of the Income Tax Assessment Act 1936) and your state's motor-dealer period: 6 years in NSW and Victoria, 5 in Queensland. Beyond those, APP 11.2 requires reasonable steps to destroy or de-identify customer personal information once you no longer need it.
How long can we keep a test-driver's licence photo?
Only as long as you need it, which for a test drive with no sale is usually a short time. The safest practice is to avoid keeping the image at all, and to destroy any details you did record once the purpose has passed.
Do we have to keep finance records for years?
Any record-keeping obligation on finance usually flows from the lender's or the credit regime's requirements, not a privacy retention floor. Keep what you are actually required to keep, secure it, and destroy your own unnecessary copies. Confirm any credit-side obligations separately.
This is general information and document templates you tailor to your own business, not legal advice. Privaproof is not a law practice and does not provide legal advice. Retention periods depend on your purposes and any laws that apply, including your state's motor-dealer licensing rules, so confirm your own position. For advice on your specific circumstances, consult a qualified Australian legal practitioner.