Automotive

Automotive: destroying client files and copy-IDs

13 June 2026 · 7 min read · DeSnipperaar

A car dealer is a particular combination: trade, garage, financing and sometimes insurance, all under one roof. For each of those activities personal data is captured, and for some a statutory copy-ID obligation applies. The archive runs from invitations to test drives to the complete lease files of corporate fleets. This article lines up the retention periods and destruction routes.

What data does a car dealer collect?

• Sales files: name and address, contact data, financing details, copy-ID.
• Lease agreements: company details, personal guarantee, credit check.
• Garage records: registration plate link, maintenance history, customer name.
• Insurance and vehicle registration: RDW links, sometimes BSN.
• Marketing and CRM data: test drives, lead lists, email campaigns.
• CCTV footage: showroom, workshop, car park. Read CCTV footage retention.

Legal bases for copy-ID

A car dealer does not automatically have a copy-ID basis for every transaction. What is allowed:

• Wwft basis for car dealers and traders: mandatory for cash payments above €10,000 (Wwft art. 23 et seq.). Read about Wwft client due diligence.
• Leasing/financing: the credit provider (often behind the company) has a Wft basis.
• Long-term rental: basis in the rental agreement plus possibly Wwft.
• Garage work: no automatic copy-ID basis; only name and address plus registration plate.

For the broader context of BSN retention, read BSN in old administration.

Retention periods per category

• Sales invoices, lease agreements: 7 years tax (AWR art. 52).
• Wwft client due diligence: 5 years after end of business relationship.
• Garage work order and maintenance history: 5-7 years for service evidence and any claims procedure.
• Marketing and lead lists: 2 years inactive, or upon withdrawal of consent.
• Personnel files: 2 years after end of employment (general), 5 years (copy-ID and payroll administration).
• CCTV footage: 4 weeks (AP guideline).

Specific risk points

Copy-IDs outside a Wwft basis

A common mistake: at test-drive registration a copy-ID is made "just in case". Not GDPR-compliant. For test-drive registration, name and address plus the registration plate card and a brief note of the year of birth (for age check on driving licence) is enough.

Lease files with personal guarantee

For corporate leases with a personal guarantee, personal data of the guarantor is often in the file. Keep for 7 years plus a 2-year buffer.

RDW links and registration plate

Registration plate plus name is personal data. Treat as CRM data, so a GDPR retention check applies.

The biggest compliance concern in car dealerships is over-retention. Owners keep "just in case" everything 10-15 years. The GDPR requires an active retention check.

The annual clean-up

1. Inventory the physical archive (sales files, lease files, garage records).
2. Split per year.
3. Test the oldest year against retention periods.
4. Plan on-site destruction. Read how to organise an archive clean-up day.
5. Combine with digital clean-up of CRM and garage system.

Specific documents to give attention

• Garage work orders with registration plates of customers from more than 7 years ago: gone.
• Old lease files of terminated agreements: 7 years after end, then gone.
• Test-drive registers: 1-2 years, then gone.
• Insurance correspondence: 7 years after end of policy.
• Marketing data of inactive customers: 2 years inactive, then gone.

Hardware in car dealerships

Do not forget the digital side:

• Old diagnostic laptops with customer data. Read HDD shredding.
• USB sticks for software updates to vehicles. Read disposing of USB sticks.
• Access badges of departed employees. Read passes and badges.
• Camera systems at replacement.

Practical tips

1. Place lockable consoles in the showroom archive room.
2. Train sales staff in the correct copy-ID policy (only Wwft-relevant).
3. Plan the annual clean-up after year-end in March-April.
4. Combine paper destruction with hardware destruction in one run.
5. Document in the records of processing.

---

Ready to clear out your archive? Email us via desnipperaar.nl with the number of cabinets and any hardware batch.