How should a car dealer collect documents for a finance application?
Collect only what the lender asks for, through a secure upload rather than WhatsApp or email, and pass it to the lender rather than keeping copies around. The usual set is photo ID, proof of address, recent payslips and bank statements. Leave the PPS number to the lender: in Ireland only bodies named in law may use it, and lenders collect it for the Central Credit Register under the Credit Reporting Act 2013. Under GDPR the dealer should hold these documents securely, limit who can open them, and delete them once they are no longer needed.
What lenders usually ask for
Each lender sets its own list. Ask for what that lender needs for that application, not a standard bundle "just in case". Fewer documents means less to protect and less to delete later.
- Photo ID: passport or driving licence.
- Proof of address: a recent utility bill or bank statement.
- Proof of income: recent payslips, or accounts for the self-employed.
- Bank statements, usually for the last few months.
- Details of the car and the deal: price, deposit, trade-in and term.
The PPS number belongs with the lender
The PPS number is not a general ID number. Under the Social Welfare Acts only bodies specified in legislation, and their agents, may use it. Lenders collect it because the Credit Reporting Act 2013 requires them to report loans to the Central Credit Register and to check the register before lending €2,000 or more, and the PPS number is one of the details used to identify the borrower.
So the dealer does not need it, and should not be the one storing it. If the customer types their PPS number into a message or an enquiry form, it should not sit in your inbox. Let the customer give it to the lender on the lender's own application.
Why WhatsApp and email are the wrong channel
- The documents end up on personal phones and in inboxes, where they are kept indefinitely and seen by anyone with access.
- Nobody can say later who opened them or where all the copies are.
- Deleting them means finding every phone, chat and email thread.
- A forwarded message is enough for someone's bank statements to reach the wrong person.
What GDPR expects from the dealer
The GDPR principles apply directly: collect only what is needed for the purpose (data minimisation), keep it secure, limit access to the people who need it, and keep it no longer than necessary. Tell the customer, in plain words, what you will do with the documents and who they go to.
In practice: one secure place to upload, access limited to the people who handle finance, the documents passed to the lender, and a clear point when they are deleted, for example once the application is decided and any query period is over. Write that period down so it is the same for every customer.
How 10X Dealership handles it
Finance applications from dealer websites built on 10X arrive on the lead with an upload for each document the customer is asked for: ID, proof of address, payslips, bank statements. The files are stored privately, not as public links, and only staff with access to finance can open them. When a customer sends several documents, the dealer gets one summary email rather than one per file.
10X removes PPS numbers from enquiries and messages before they are saved: a number typed into an answer or a message is replaced, and the rest of the enquiry is kept.
Related questions
Can a car dealer ask for my PPS number?
In Ireland only bodies named in law may use the PPS number. Lenders collect it for the Central Credit Register when you apply for credit, so the right place to give it is the lender's own application, not the dealer.
Can customers send payslips and bank statements on WhatsApp?
They can, but it is a poor choice: the files stay on phones and in chats, nobody can control who sees them, and they are hard to delete. A secure upload linked to the application is safer for both sides.
How long should a dealer keep finance documents?
No longer than needed for the application and any follow-up questions. Set one retention period, write it down, and delete the documents when it ends.
