Car dealers face privacy policy scrutiny in 2026 compliance sweep

Car dealerships and rental companies will be among the first businesses scrutinised under Australia’s inaugural privacy compliance sweep, set to begin in January 2026.

The Office of the Australian Information Commissioner (OAIC) will conduct targeted reviews of approximately 60 entities across six sectors that collect personal information in-person, including car dealerships that gather customer data for test drives and car rental companies processing rental agreements.

Businesses found with non-compliant privacy policies face penalties of up to $66,000, following legislative changes to the Privacy Act passed by Parliament in 2024 that expanded regulatory consequences for privacy breaches.

Privacy Commissioner Carly Kind says the sweep targets sectors where consumers often lack sufficient information to make informed decisions about sharing personal data.

“When confronted with in-person requests for their personal information from retailers, licenced venues, car hire companies or real estate agents, consumers often don’t have access to all the information they might need to make an informed decision,” Kind says.

“This makes them vulnerable to overcollection of personal information and creates risks to their security and privacy.”

The automotive sector’s inclusion reflects particular privacy risks associated with collecting personal identification documents and previous data breaches within these industries.

Car dealerships routinely collect customer information during test drives, while rental companies gather extensive personal and identification data as part of rental agreements. Both practices involve significant power imbalances between businesses and consumers.

Target sectors under review

The OAIC will review privacy policies across six sectors:

• Car dealerships collecting personal information for vehicle test drives
• Car rental companies gathering identity and personal information for rental agreements
• Rental and property agents collecting data during property inspections
• Chemists and pharmacists gathering information for paperless receipts and medication provision
• Licensed venues collecting identity information for venue access
• Pawnbrokers and second-hand dealers collecting identity information from sellers

Target entities will be selected based on size, location, and risk profile, including high-profile businesses and those previously subject to data breaches.

The compliance sweep will assess whether privacy policies meet Australian Privacy Principle (APP) 1.4 requirements, which specify what information privacy policies must contain. The OAIC recently updated its APP 1 guidance to reflect current standards.

Kind says the review aims to ensure businesses meet transparency obligations while encouraging broader reflection on privacy practices.

“In conducting a compliance sweep, the OAIC intends to ensure that entities are meeting their obligations to be transparent with consumers and customers about how they’re using the personal information they collect in-person,” she says.

“The Australian community is increasingly concerned about the lack of choice and control they have with respect to their personal information. The first building block of better privacy practices is a clear privacy policy that transparently communicates how an individual can expect their information to be collected, used, disclosed and destroyed.”

The OAIC says it takes a risk-based and proportionate approach to regulation, with non-compliant entities facing its expanded regulatory toolkit to determine appropriate responses.

The compliance sweep represents the first systematic review of privacy policies since the Privacy Act amendments took effect, signalling increased regulatory focus on business compliance with privacy obligations.</body> </article>