Car rental

Car rental and leasing: destroying customer data

18 July 2026 · 10 min read · DeSnipperaar

A car rental company's contracts and customer files ready for confidential destruction

A car rental or leasing company processes more sensitive data than just a name and a contract: driving licence and ID copies, payment and deposit data, damage files, traffic fines and nowadays also telematics and GPS data from the vehicles. Part falls under the tax retention obligation, part is precisely sensitive and should be kept as briefly as possible. This guide shows, by part, what you keep, when it may go and how to destroy it confidentially.

The quick answer: the administration you keep for seven years for the tax retention obligation. The rental contract you keep until the rental and any damage or fine have been handled. Licence copies and telematics you treat with restraint. What may go disappears confidentially and with a certificate.

Why car rental must handle data carefully

Anyone who rents out or leases a car must be able to identify the driver and settle the trip financially. For that you process a driving licence, an identity document, payment and deposit data and sometimes a copy of the credit card. That is sensitive data. On top of that, modern vehicles constantly collect data: locations, trips, mileage and even the phone a renter pairs. All that data can be traced to a person and therefore falls under the GDPR.

The GDPR requires storage limitation. Do not keep the data longer than necessary for the rental, the settlement and any dispute. Only the tax administration has a fixed period of seven years.

Retention periods by part

The period differs per type of data. The overview below gives the main line. Count the tax period from the end of the financial year and the other periods from the end of the rental or lease.

Part	Starting point	Period
Invoicing and administration	Tax retention obligation	7 years
Rental and lease contract	Until settlement and dispute	purpose-bound
Licence and ID copy	As limited as possible	only what is needed
Damage and fine file	Until handling and limitation	purpose-bound
Telematics, GPS and mileage	Personal data, storage limitation	as briefly as possible
Infotainment at return	Wipe before reuse	at every return

Use this as a guideline, not a final legal ruling. When in doubt about a specific file, consult your data protection officer or adviser. The tax side is in the 7-year tax retention obligation.

Licence and ID copies: be restrained

For the rental you need the data from a driving licence and identity document, but that does not mean you must always keep a full copy. Such a copy is sensitive data and should not be kept longer than the settlement of the rental and any dispute requires. Note only what you need and clear loose copies out confidentially afterwards. That way you avoid managing a mountain of driving licences you no longer needed.

Telematics, GPS and the infotainment system

In the lease and rental of modern vehicles, data plays a major role. Telematics records where and when a car was driven, what the mileage is and sometimes the driving behaviour. That data can be traced to the driver and calls for storage limitation: keep it only as long as there is a concrete purpose, such as invoicing or a damage settlement, and then erase or destroy it.

Do not forget the infotainment system either. A renter often pairs their phone, leaving contacts and navigation history in the car. Erase that data at every return, before a next renter gets in. That way you do not unintentionally pass on the previous driver's data.

How to handle it in 6 steps

Split the file into administration, contract, ID copy and damage.
Limit licence and ID copies to what the settlement requires.
Treat telematics and GPS separately and erase them once the purpose has lapsed.
Wipe the infotainment system at every return before reuse.
Collect what may go in sealed containers, not in the paper bin.
Have it destroyed confidentially with a certificate and record it in your register.

Destroy confidentially with a certificate

Customer files are destroyed confidentially, because they contain identity, payment and sometimes damage data. The paper and any data carriers travel sealed and stay that way until destruction, so the chain is closed. Old systems with telematics or a computer with customer data belong with it too.

Afterwards you receive a certificate of destruction with the date, quantity and level. That certificate is your proof towards the GDPR that you acted carefully. Record the destruction in your record of processing. We collect within 20 km of Amsterdam with no call-out charge, work nationwide through pooled collection rounds and charge a fixed price per box or roll container. Drop-off on site is not possible; it works by appointment through collection.

Customer files to be destroyed?

Tell us what you have and you get a fixed price. We collect it sealed, destroy it at the right DIN level and you receive a certificate for your GDPR file. No call-out charge within 20 km of Amsterdam.

Request a quote

Common mistakes

Keeping licence copies forever. After settlement and any dispute the purpose lapses.
Keeping telematics indefinitely. GPS and mileage are personal data.
Not wiping the infotainment system. Contacts and navigation history of the previous renter otherwise remain.
Throwing away unshredded. A rental contract with identity data on the street is a reportable data breach.
Keeping no proof. Without a certificate you cannot demonstrate the destruction.

Frequently asked questions

How long does a car rental company keep contracts?

The invoicing and administration fall under the seven-year tax retention obligation. The rental contract itself you keep until the rental has been settled and any damage or fine has been handled, after which it may go.

May I keep a copy of a renter's driving licence?

Be restrained here. A licence copy is sensitive data. Keep no more than necessary and no longer than the settlement of the rental and any dispute requires. Clear the copy out confidentially afterwards.

Are telematics and GPS data of a lease car personal data?

Yes. Trips, locations and mileage can be traced to the driver and are therefore personal data. Keep them no longer than necessary and destroy or erase them carefully once the purpose has lapsed.

What do I do with the infotainment system when a car is returned?

Erase the paired phone, contacts and navigation history before a next renter gets the car. Otherwise you unintentionally pass on the previous driver's data.

Conclusion

A car rental or leasing company works with identity, payment and vehicle data of every driver. Keep the administration seven years, keep the contract until the rental and any damage have been handled and be restrained with licence copies. Telematics you keep as briefly as possible and the infotainment system you wipe at every return. What may go you have destroyed confidentially with a certificate as proof. That way you protect your customers' data.

Have customer files collected? Request a quote via desnipperaar.nl. Within a few minutes you have a fixed price, including a certificate as proof.