Trade-ins, PPSR and privacy: handling vehicle and owner data at a dealership
A trade-in is not just a car changing hands, it is a small pile of personal information: the customer's own details for the deal, the vehicle's identifiers, a Personal Property Securities Register (PPSR) search, and often a previous owner's information sitting in the service books, registration papers or finance history. Two sets of rules land on it. The Australian Privacy Principles govern what you collect, use and keep, if your dealership is an APP entity. The Personal Property Securities Act 2009 (Cth) governs the search: where you search by the customer's own details, s 172(3) makes using the result for anything but the permitted purpose a civil penalty of 50 penalty units, and it binds the searcher whether or not the Privacy Act reaches you.
By Jon Oates, Founder of Privaproof · Last updated
General information, not legal advice. Privaproof is not a law practice.
What a trade-in actually brings you
- The customer's own details, as part of the sale and any finance payout.
- The vehicle's identifiers (VIN, registration), which you use to value it and check its status.
- A PPSR search, which you run to check for money owing or other interests over the vehicle. Section 171(1) of the Personal Property Securities Act 2009 (Cth) lets you search by serial number (the VIN) or by a grantor's details. A VIN search does not put the customer's name into the register; a grantor search does, and s 172 limits that one.
- A previous owner's information, which frequently travels with a used car in the service history, logbooks, registration papers, or old finance documents. That is someone else's personal information, and it deserves the same care.
The privacy rules that apply
- Collect only what is reasonably necessary (APP 3.2). For an organisation the test is "reasonably necessary for one or more of the entity's functions or activities". Enough to value the car, run the search and complete the payout. Does your trade-in form ask for a date of birth, and which of those jobs needs it?
- Notice (APP 5). Your collection notice should cover the trade-in as one of your collection points, including that you run a PPSR check and may disclose details to wholesalers or auctions if you on-sell. Read: the collection notice a dealership needs
- Use and disclosure (APP 6). Use the trade-in data for the trade, and disclose it only for related purposes: a finance payout to the customer's lender, or on-selling through a wholesaler or auction. A serial-number search under s 171(1)(b) discloses the vehicle, not the customer. The PPSA permits a search, it does not require one, so APP 6.2(b), "required or authorised by or under an Australian law", is not your route.
- Security and retention (APP 11). APP 11.1 requires reasonable steps against misuse, interference, loss and unauthorised access. APP 11.2 adds a destruction duty once you no longer need it and no Australian law or court order requires you to retain it. Old finance documents and a previous owner's papers left in a glovebox or a filing cabinet are a quiet over-retention problem. Read: how long should a car dealer keep customer records?
The previous-owner data nobody thinks about
The service history and papers that come with a used trade-in often name a previous owner and their servicing, finance or registration details. You did not solicit it, so the rule is APP 4, not APP 3: decide within a reasonable period whether you could have collected it under APP 3, and if you could not, APP 4.3 requires you to destroy or de-identify it as soon as practicable where that is lawful and reasonable. If you keep it, APP 4.4 applies APPs 5 to 13 as though you had collected it, so clear or redact previous-owner details before the car moves on.
This is general information and document templates you tailor to your own business, not legal advice.
Common questions
Is running a PPSR check a privacy problem?
Running it is authorised, but the search carries its own rules. Section 172 of the Personal Property Securities Act 2009 (Cth) covers a search by an individual grantor's details, and item 6 of its table permits it where "the property is to be purchased or dealt with by the person". Section 172(3) then bars using the result for any other purpose, civil penalty 50 penalty units, and s 173(2) makes an unauthorised search or use an interference with privacy for the purposes of s 13 of the Privacy Act 1988.
What do we do with the previous owner's details in the logbooks?
Treat them under APP 4, which covers personal information you receive but did not solicit. If you could not have collected them under APP 3, APP 4.3 requires you to destroy or de-identify them as soon as practicable, where that is lawful and reasonable. Otherwise use them only in connection with the vehicle, and clear or redact them before the car is on-sold.
How long should we keep trade-in paperwork?
APP 11.2 sets the test: once you no longer need it for any purpose for which it may be used or disclosed, and no Australian law or court order requires you to retain it, take reasonable steps to destroy or de-identify it. Note that retention limb, since dealer licensing and tax rules can require you to keep parts of a trade-in file. Which parts of yours are covered by one?
This is general information and document templates you tailor to your own business, not legal advice. Privaproof is not a law practice and does not provide legal advice. The PPSR is maintained by the Registrar of Personal Property Securities under the Personal Property Securities Act 2009 (Cth), and the search and use rules above are that Act's, alongside the Australian Privacy Principles. For advice on your specific circumstances, consult a qualified Australian legal practitioner.