PIPEDA (and equivalent provincial laws) expects Canadian dealers to collect only the personal information they need, tell customers why, get consent, keep it secure and not hold it longer than necessary. Credit applications and ID copies are especially sensitive. Storing records on your own computer with limited staff access, and backing them up securely, supports these duties.
What you collect
- Contact details and driver's licence information.
- Credit applications and credit check results.
- Trade-in and financing information.
Practical habits
- Collect only what the transaction needs.
- Explain the purpose and get consent; Dealer Garage includes a PIPEDA privacy consent form.
- Limit staff access by role.
- Keep backups somewhere secure and encrypted if possible.
- Delete or destroy records when retention periods end.
Local storage
Dealer Garage keeps data on the dealership's computer and does not upload it unless you use an online feature. That gives you control but also responsibility for physical security, access control and backups. See staff roles and backups.
A short privacy checklist
- A privacy notice available to customers.
- Consent recorded for credit checks and marketing.
- Staff access by role.
- Backups protected.
- A retention schedule and someone responsible for following it.
Questions people ask
What if I lose a laptop with customer data?
You may have breach-reporting duties. Seek advice quickly and use disk encryption beforehand.
This is general information, not legal advice. Rules differ by state, province and territory and change over time; confirm what applies to you with your regulator or a qualified adviser.
Try Dealer Garage
Dealer Garage is installable dealer management software for independent used-car dealers in the US and Canada: inventory, leads, deals, dealer paperwork, Facebook Marketplace posting and email campaigns, with records stored on the dealership's own computer..