Australia’s privacy regulator has begun its first-ever privacy compliance sweep, and car dealerships are explicitly in scope.
From the first week of January 2026, the Office of the Australian Information Commissioner (OAIC) is inspecting how businesses collect personal information in person, including driver licence data collected during vehicle test drives and loan vehicles.
The OAIC has been explicit about its intent:
“The OAIC intends to ensure that entities are meeting their obligations to be transparent with consumers and customers about how they’re using the personal information they collect in-person.”
Digital does not mean compliant
Many dealerships assume they’re safe because they use an app or a digital process.
They’re not, unless explicit customer consent is captured before licence collection.
If your system allows a driver licence to be scanned before the customer has personally seen a privacy notice and explicitly agreed, the dealership risks non-compliance.
Using a digital system alone does not remove that exposure.
Why dealerships are being targeted
According to the OAIC:
"The target sectors have been selected noting the particular privacy risks… and the privacy breaches that have occurred within these sectors.”
Driver licences are high-risk personal information. They’re collected quickly. In person. Often under pressure.
That combination is exactly what regulators are now examining.
Where non-compliance actually happens
Most dealerships aren’t deliberately doing the wrong thing.
Non-compliance occurs when:
- Customers are not shown a privacy notice before licence capture
- Consent is implied because “they handed over their licence”
- Staff tap “I agree” on the customer’s behalf
- Systems don’t force consent before capture
Those shortcuts are common. They are also exactly what inspectors expect to find.
The penalty is real
The OAIC has confirmed:
“Entities found [to be] non-compliant … may face compliance and infringement notices and penalties of up to $66,000.”
That applies to failures around transparency and consent at the point of in-person collection.
For DriveExpert customers, recent updates ensure explicit customer consent is captured before licence collection, with customer-led acknowledgement.
Dealerships should still confirm staff are using the latest app version and following the correct process consistently.