Guides8 min read

GDPR and customer data in an Italian car rental agency

Which customer data you may collect at the counter, how long to keep it, and how to disclose GPS and telematics tracking. A practical guide for agencies.

At the counter you may collect only the data you genuinely need to start the rental and to defend yourself afterwards: driver identity and licence validity, contact details, payment and deposit data, and the condition of the vehicle at handover and at return. Everything else should be kept only for the period you decided in advance and wrote down: the photocopy kept «just in case», the licence photo still sitting in the team chat, the record of a customer who has not come back in years are risk with no benefit.

The weak spot in almost every independent agency is not the privacy notice: some version of it exists. The weak spot is what happens next. The binder of contracts behind the counter, the shared folder of scanned ID documents, the car's navigation system that still remembers the previous customer's contacts. Below is how to clean this up in 3 steps — what you collect, how long you keep it, how you erase it — pointing you to the Italian data protection authority, the Garante per la protezione dei dati personali, for every detail that changes over time.

Key takeaways

Collect only what serves the contract, a legal obligation or the protection of the vehicle: every extra field needs a reason.
Decide in advance how long you keep each type of data, write it in the privacy notice, then actually respect it.
Satellite tracking and telematics boxes are disclosed before handover, in the notice required by article 13, never after the rental is over.
On return, clean the vehicle the way you check the fuel: Bluetooth, contacts, navigation history, connected service accounts.
When an access request arrives, answer in writing, within the deadline, and keep proof of what you answered.

Which data to ask for at the counter, and which to avoid

The working principle is minimisation: the question is not «which data would be handy», but «without which data can this contract not be performed». Sort the fields on your form into two groups and the rest becomes simple.

The data that carries the contract

Driver identity and licence details, with a check that the licence is valid and covers the vehicle category.
Contact details to reach the customer during the rental: phone number and email address.
Payment and deposit data handled through the payment chain, without copying a card number by hand onto a sheet of paper or into an unprotected system.
Authorised second driver: same check, same privacy notice, because that person is a data subject too.
Vehicle condition at handover and at return, with dated photographs and a signed inspection report.

The data that needs an extra reason

A copy or scan of the ID document kept on file: you need a precise purpose and a retention period, otherwise just record the document references.
Internal lists of customers you have had trouble with: lawful only with a documented assessment, clear information and periodic review.
Email address used for offers and discounts: this needs separate consent, always withdrawable, kept apart from signing the contract.
Yard video surveillance: visible signs, camera angles limited to the area that needs protecting, short retention.
Driving behaviour data from telematics: treat it as commercially sensitive information, not as a marketing bonus.

The legal bases, in counter language

Every processing operation needs a legal basis, and a rental business runs three or four of them in parallel. Writing them down also helps when a customer challenges you: you know exactly why that data is in your files.

Performance of the contract: identity, licence, payment, vehicle condition. Without these the rental does not start.
Legal obligation: invoicing and accounting, plus the transmission of renters' identification data required by Italian security rules. The deadline and the method are set by a decree of the Ministry of the Interior: check the text in force and the authority's guidance before you build a procedure around it.
Legitimate interest: recovering the vehicle, protecting your assets, handling damage and traffic fines. This calls for a written balancing assessment, not a copied formula.
Consent: only for what is not necessary, such as commercial messages. If the rental works without it, then it is consent and must be treated as such.

A familiar example: fines from Italy's limited traffic zones, the ZTL, arrive months after the rental, because cameras read the plate and the notice goes to the registered keeper. That is why contract data and the record of who was driving stay necessary well beyond the return. Rules, hours and gates are set by each municipality and change often, so send the customer to that municipality's own information and promise nothing about amounts.

How long to keep each type of data

There is no single deadline covering an agency's whole archive. There is one deadline per purpose, which you set, justify and disclose. The table below is the skeleton to copy into your record of processing activities, replacing the criteria with the concrete periods you fix with your accountant and your legal adviser.

Type of data	Purpose	Retention criterion
Rental contract and handover and return report	Proof of the relationship, damage, disputes	Duration of the relationship plus the period in which a claim remains possible
Invoice and accounting payment data	Tax and accounting obligations	The period required by tax law: fix it with your accountant and state it in the notice
ID and licence references or copies	Verifying identity and entitlement to drive	The shortest period possible; for transmissions required by security rules the decree's period applies, to be checked in the text in force
Satellite tracking and telematics data	Vehicle security, recovery, claims handling	A short window stated in the notice; beyond it, only the incident still open
Photos and videos of vehicle condition	Damage and deposit	Until the deposit file or the dispute is closed
Yard surveillance footage	Security of the site and parked vehicles	A few days, unless a specific documented incident
Contact details used for marketing	Direct marketing	Until consent is withdrawn, with an unsubscribe option that always works

Two practical rules beat any table. First: retention you cannot justify is retention to stop. Second: once the period has run, deletion must reach the copies too, not only the management system.

Tracking and telematics: what to put in the notice

If the vehicle carries a satellite tracker or a telematics device, you are processing the location data of an identified person: the driver. That must be said before the keys change hands, in the notice required by article 13, in language a customer reads in under 1 minute.

Who the controller is: the agency's registered name and a contact the customer can actually write to.
What the device records and what it does not: position, ignition, impact events, and not for instance sound inside the cabin.
Why you record it: theft protection and recovery, claims handling, roadside assistance. One purpose at a time, no vague lists.
How long you keep it and who sees it: the telematics provider, appointed as processor, the insurer in case of a claim, the authorities on a lawful request.
What rights the customer has and how to exercise them, including a complaint to the Garante.

On the measurement itself, necessity and proportionality are the real constraint: a continuous minute-by-minute trail is hard to justify in an ordinary rental, while recording events — ignition, leaving a defined area, a detected impact — is normally enough for the purpose. If the car offers the manufacturer's connected services, explain as well that pairing a personal profile leaves data in the vehicle, and that you will remove it at return.

The return: erasing the previous rental's data

When the car comes back, the digital life of whoever drove it stays on board. This is the part of the GDPR most often forgotten, and also the easiest to fix, because it becomes one line on the return checklist your staff already fill in.

1Infotainment: remove the paired Bluetooth device, the imported contact list and the synced messages.
2Navigation: clear the history, the recent destinations and the address saved as home.
3Accounts and apps: sign out of connected service profiles, the manufacturer's app and music subscriptions.
4Documents and files: close the file, archive only what you must keep and delete the scattered copies, meaning chat attachments, scans on the desktop, photos on the staff member's phone.
5Traceability: note on the checklist who did the cleaning and when. That line is your proof.

Train seasonal staff on these 5 points the way you train them on the bodywork walk-around. It is the cheapest risk reduction available: no investment, 2 minutes per vehicle.

Platforms, software and who answers for the data

The moment you use an outside tool — management software, a booking portal, a telematics service, your email provider — your customers' data leaves the counter. That is not a problem: it is a relationship to frame. For whatever that supplier processes on your behalf you need a processor agreement under article 28, and its name must appear in your record of processing activities.

Where the data is stored and who, on their side, can access it.
How you export your data and how you obtain its deletion when the relationship ends.
How quickly and through which channel the supplier tells you about a data breach.
Which further sub-processors they use, so the chain does not stop at the first contract.

On DRIVO, for instance, listing a fleet costs nothing: 0 EUR, no listing fee and no monthly subscription, with commission charged only on completed bookings, so an empty week costs nothing. Bookings, calendar and fleet are run from a back-office, payouts arrive automatically through Stripe, listings are multilingual and the profile is verified with reviews. On the customer side every cost is shown before payment, confirmation is instant and cancellation is free up to 48 hours before pick-up. Mapping what flows where is still your job: a platform is a controller for its own activities and a processor for what it handles for you, and that distinction belongs in writing, not in guesswork.

A customer asks for all the data I hold about them: what do I do?

You confirm whether you are processing their data and give them a copy, stating the purposes, the categories of data, the recipients, the retention period and the source. You answer in writing within the deadline set by the regulation, which the Garante publishes in current form, and which you may extend only if the request is genuinely complex. You may verify the requester's identity without demanding more documents than necessary. The first copy is free of charge. If you refuse, you explain why and mention their right to complain to the authority.

May I keep a photocopy of the driving licence and the ID card?

The rule is to verify at the counter, not to collect. Keeping a copy requires a precise purpose, a stated retention period and protected storage; where it is enough, record the document references instead of the image. For the transmission of renters' data required by Italian security rules, the decree of the Ministry of the Interior governs: check the text in force and the authority's opinion, because this area has been amended over time.

Do I need the customer's consent for the GPS in a rental car?

Usually consent is the wrong basis, because the customer cannot refuse it and still rent. The correct route is a necessary and disclosed purpose, a notice handed over before the keys, proportionate collection and short retention. No silent tracking, and no continuous recording when events are enough for theft protection.

Does my agency have to appoint a data protection officer?

It is not automatic for a small rental business: it depends on the nature and the scale of the processing. If you run systematic monitoring through telematics across the whole fleet, the assessment has to be done seriously and its conclusion written down, whatever it is. The criteria are published by the authority, and a professional opinion costs less than a dispute.

A customer asks for erasure: do I have to delete everything?

No. What you must keep for tax obligations, for ongoing litigation or to defend yourself against a claim stays, and you explain that to them. You erase the rest: contact details used for marketing, copies no longer needed, duplicate records. A good answer lists what was deleted and what remains, with the reason.

My laptop with scanned contracts was stolen: do I have to report it?

Most likely yes, and speed matters. You assess the risk to the people involved, document that assessment, notify the breach to the authority without undue delay and inform customers if the risk to them is high. Having the procedure written in advance, with roles and contacts, is what separates a managed incident from a lost day.

All articles