TLDR: Before any vehicle leaves your dealership with a customer, four things need to exist: a verified licence for every driver, explicit privacy consent captured before the licence is collected, a signed agreement covering insurance and liability, and a condition record of the car. Get those four right on every movement — test drives, loaners, staff cars — and fines, disputes and privacy exposure stop being your problem.
Nobody gets into the car business to think about compliance. But every dealership hands strangers the keys to expensive assets dozens of times a day, and the process wrapped around that moment is what stands between “routine Tuesday” and a genuinely bad week.
Here’s what needs to be in place, and where the common shortcuts fail.
1. Licence checks — for every driver, every time
The baseline: nobody drives without a valid licence being sighted and recorded. Not “the husband showed his and she drove too”. Every person who takes the wheel.
The failure mode isn’t usually skipping the check — it’s the recording of it. Paper photocopies get lost, misfiled and left on printers. When you need to prove who was driving eight months later, a photocopy in a filing cabinet at another branch might as well not exist.
Digital licence scanning fixes both halves: the details are captured accurately in seconds (physical or digital licences, multiple drivers supported), and the record is searchable forever.
2. Privacy consent — before the scan, not after
This is the one that changed recently, and the one most dealerships are still getting wrong.
A driver licence is high-risk personal information, and regulators now expect transparency and explicit consent at the point of in-person collection. In Australia, the OAIC began privacy compliance inspections in January 2026 with dealerships explicitly in scope — with penalties up to $66,000. We covered the details in our January post on the OAIC sweep.
The key point: using a digital system does not automatically make you compliant. If a licence can be scanned before the customer has personally seen a privacy notice and agreed — or if staff tap “I agree” on the customer’s behalf — the exposure is still there. The consent step has to be customer-led and has to come first.
3. Insurance and liability — agreed in writing, before the drive
If a customer kerbs a wheel, or worse, the question is immediately: who pays, and what did they agree to?
A compliant drive agreement should disclose, before the vehicle moves:
- Who is insured to drive, and any licence class or age restrictions
- The excess the driver is liable for if something happens
- The conditions of the drive — accompanied or unaccompanied, route or time limits, geographic restrictions
- A proper signature — the driver’s own, on a staff device or their own phone, not a checkbox someone else ticked
Verbal agreements and “sign here on the clipboard” both fail the same way: when a dispute arrives, there’s no defensible record of what the driver actually saw and agreed to. E-signatures with timestamps end that argument before it starts.
4. Condition records — out and back
Damage disputes are the small, constant leak. The customer says the scratch was already there; your salesperson can’t remember; the dealership wears the cost.
The fix is photos, fuel and odometer on the way out and the way back in, attached to the drive record. Thirty seconds of capture, and “was that there before?” becomes a question with an answer.
5. Who was driving? — fines, tolls and nominations
As the registered operator, the dealership receives every speeding fine and toll notice its vehicles generate. The law then expects you to nominate the actual driver — and the clock is usually ticking.
With a paper register, matching “the silver CX-5, last Tuesday, 2:14pm” to a driver is an afternoon of archaeology. With a searchable digital register it’s an instant lookup by vehicle and time, with the driver nomination form generated automatically from the licence already on file.
Don’t forget the movements that aren’t test drives
Here’s the blind spot: most dealerships that manage customer test drives reasonably well have almost no process for everything else — service loaners, staff drives, trade movements between sites, cars out with the pre-delivery department.
Those movements carry exactly the same identity, insurance and accountability requirements, and they’re where paper processes disappear entirely. One governed process should cover every movement of every vehicle, or the audit gap is still open.
The compliance checklist
- Valid licence sighted, scanned and stored for every driver
- Customer-led privacy consent captured before licence collection
- Signed agreement disclosing insurance excess and drive conditions
- Condition photos, fuel and odometer — out and back
- Searchable register: who had which car, when
- Auto-generated driver nomination forms for fines and tolls
- Same process for loaners, staff drives and trade movements
This is the exact checklist DriveExpert was built to automate — licence scan and auto-fill, customer-led consent, e-signed agreements, condition capture, and a full searchable register across every movement type, with daily summaries to managers. It’s why brands like JLR Australia run their drive days on it.
If your drive process still lives on a clipboard — or in a system where consent happens after the scan — feel welcome to reach out.