The test-drive licence: a car dealer's privacy duties when you take a customer's ID

Taking a driver's licence before a test drive is a collection of personal information, and if your dealership is an APP entity the Privacy Act's handling rules apply to it. Tell the customer why you are taking it (APP 5.1), collect only what is reasonably necessary (APP 3.2), and prefer sighting the licence and recording the details over photographing it and keeping the image. The question that settles most of it: how many licence photos are sitting on phones and shared drives right now, and whose job is it to delete them?

By Jon Oates, Founder of Privaproof · Last updated 9 September 2026

General information, not legal advice. Privaproof is not a law practice.

Taking the licence is a collection, so three rules apply

When you take a customer's licence to verify who is driving your vehicle, you are collecting personal information (and a licence image is a rich piece of it: name, address, date of birth, licence number, photo). The licence number is also a government related identifier, one assigned by a State or Territory authority (s 6(1)). If your dealership is an APP entity, four Australian Privacy Principles shape how you do it:

APP 5.1, notice. At or before you take it, or as soon as practicable after if that is not practicable, take reasonable steps to make the customer aware of who you are, why you are collecting it, and who you usually disclose it to (APP 5.2(a), (d), (f)). A short, clear line at the point of the test drive does the job.
APP 3.2, collect only what is reasonably necessary for one or more of your functions or activities. You need to confirm identity and licence validity for the test drive, so ask whether you need an image of the licence to do that, or whether sighting it and recording the details (name, licence number, expiry) in your test-drive log is enough. In Commissioner Initiated Investigation into IRE Pty Ltd (Privacy) [2026] AICmr 24 (1 April 2026) the Commissioner found at [95] that a rental-application platform could perform its functions on a lesser amount of identification documents. That respondent was a platform, not a dealership, and the OAIC records the determination as under review in the Administrative Review Tribunal, so read it as direction of travel.
APP 11, secure it and destroy it. APP 11.1 requires reasonable steps to protect what you hold, and APP 11.2 reasonable steps to destroy or de-identify it once you no longer need it, unless an Australian law or a court or tribunal order requires you to keep it (APP 11.2(d)). A test-drive licence image is not something to keep indefinitely in a folder or on a salesperson's phone.
APP 9.1, do not adopt the licence number as your own reference. An organisation must not adopt a government related identifier as its own identifier of the individual unless an Australian law or a court or tribunal order requires or authorises it, so the licence number should not become your customer number. Narrower than it sounds: recording the number is governed by APP 3.2 and APP 11, and APP 9.2(a) permits use reasonably necessary to verify identity.

Sight and record beats photograph and hoard

The practical rule that keeps a dealership clean: sight the licence, record the details you genuinely need, and avoid keeping the image unless you have a real, stated reason. Photographing every test-driver's licence and letting the images accumulate on phones and in shared drives is over-collection and over-retention at once. The reason matters: a licence is not sensitive information, because s 6(1) is a closed list and a licence is not on it, but it is a complete identity set, and s 26WG directs regard to the kind of information, its sensitivity, and whether it was protected by security measures that could be overcome. A folder of unsecured licence images answers those badly. If you do keep an image for a specific reason, store it securely, log why, and set a short retention period after which it is deleted.

You do not generally need a signed consent form to sight a licence for a legitimate test-drive purpose, but you do need to notify under APP 5.1. Notice (telling the customer what you are doing and why) is the baseline; a bundled "I consent to everything" form is not what the Act asks for here. Keep the notice specific and honest. One step changes the test: photograph or scan the licence and run an automated face match, and that is biometric information used for automated biometric verification or identification, which s 6(1)(d) makes sensitive information, so APP 3.3 requires consent as well as reasonable necessity. In 7-Eleven Stores Pty Ltd (Privacy) [2021] AICmr 50 the Commissioner held faceprints were sensitive information and their collection was, at [105], at most helpful or convenient. Read: consent to collect a customer's ID at a dealership

Where this fits the bigger picture

The licence is often just the first piece of data a customer hands over. If they go on to enquire about finance, you then collect income and bank details and disclose them to lenders, which is a separate and higher-stakes flow. Read: finance and insurance data at a dealership And the notice you give at the test drive belongs in a proper collection notice covering all your collection points. Read: the collection notice a dealership needs

This is general information and document templates you tailor to your own business, not legal advice.

Common questions

Can we photocopy or photograph a customer's licence for a test drive?

Yes, if the image is reasonably necessary for one of your functions or activities (APP 3.2). Keeping the copy is a separate collection from the check, so ask whether sighting and recording the details is enough. If you do keep an image, notify the customer, store it securely, and delete it on a short timetable. The risk is not the copy itself, it is keeping copies you no longer need.

You need to notify them (APP 5.1) of who you are and why you are taking the licence. A separate signed consent is not generally required just to sight a licence for a legitimate purpose, though clear notice is. The APP 3.3 consent bar attaches to sensitive information, and s 6(1) is a closed list: finance, income and bank details are not on it, but biometric information used for automated verification or identification is (s 6(1)(d)). So consent at a dealership is a face-match question, not a finance-form question.

How long can we keep the licence details?

Only as long as you need them for the purpose. For a test drive that finished with no sale, that is usually a short period. APP 11.2 then requires reasonable steps to destroy or de-identify them, unless an Australian law or a court or tribunal order requires you to keep them (APP 11.2(d)). Check what your state's motor dealers legislation requires in a dealing record, then set a period. Read: how long should a car dealer keep customer records?

This is general information and document templates you tailor to your own business, not legal advice. Privaproof is not a law practice and does not provide legal advice. Whether the Privacy Act applies is not just this year's turnover: under s 6D(4)(a) a business whose annual turnover has exceeded $3,000,000 in any financial year since it started is not a small business operator, and a later fall does not undo that. You may genuinely be outside it. For advice on your specific circumstances, consult a qualified Australian legal practitioner.