Dealership document retention comes down to three anchors: the FTC Safeguards and Disposal Rules, IRS recordkeeping triggers, and a documented legal-hold process. Classify records by category, keep tax and financing files longer than the old three-year default, suspend destruction the moment litigation or an audit becomes likely, and document every disposal. Tools exist that can help operationalize that matrix once the categories are set.
TL;DR:
- Records related to sales, titles, and odometer disclosures must be retained well beyond the vehicle transfer and are protected as required records under DOJ doctrine.
- Financing, customer data, and protected information must be kept as long as the dealer holds it, with destruction only allowed once a business need no longer exists and proper secure methods are used.
- Tax records require a minimum retention of three to six years depending on the situation, with employment and property records needing longer, especially if underreported income is involved.
- Legal holds override scheduled destruction, requiring immediate flagging, preservation, chain-of-custody documentation, and suspension of routine deletions during investigations or audits.
- Electronic and paper records should be destroyed so they cannot be reconstructed, with vendors vetted for compliance, and relevant proof kept for regulator or legal reviews.
Table of Contents
- Federal rules that shape dealership retention obligations
- Which records to classify and how long to keep them
- Reconciling state dealer codes with federal minimums
- Building a retention matrix with legal-hold controls
- Secure disposal in practice and vendor due diligence
- Audit and subpoena readiness: what gets requested most
- How Loturn’s tools support a dealer’s retention matrix
- What to fix first if you’re behind
- Get your retention templates in order
- Where to verify these rules yourself
- Sources
- FAQ
Federal rules that shape dealership retention obligations
Three federal frameworks set the floor for dealership record policies. The FTC’s Safeguards Rule FAQ clarifies that financing-related personally identifiable financial information stays protected customer information for as long as a dealer holds it, even after a loan has been assigned to a lender. A dealer can dispose of it once there is no remaining business need, but not before.
The FTC Disposal Rule governs what happens when that need ends. It requires that consumer report information be destroyed so it cannot be read or reconstructed, through methods like shredding, pulverizing, or secure electronic erasure, and it holds dealers responsible for vetting any destruction vendor they use.
The IRS recordkeeping guidance sets tax-specific triggers that often run longer than three years, including six years for underreported income and four years minimum for employment-tax records. On the enforcement side, the DOJ’s civil resource on odometer fraud notes that certain records, including odometer statements, count as required records that regulators can compel even from a sole proprietor.
- FTC Safeguards Rule: protects financing and customer data while in dealer possession.
- FTC Disposal Rule: dictates how records are destroyed once retention ends.
- IRS guidance: sets tax-driven retention periods by category.
- DOJ required-records doctrine: certain files must exist and be producible on request.
Which records to classify and how long to keep them
Every dealership record falls into a category with its own retention logic, driven by tax law, contract exposure, or state title rules rather than a single company-wide rule.
- Sales, title, and odometer records: tied to title transfer and odometer disclosure; treat as required records and keep well past the sale.
- F&I and credit files: contain protected customer information under the FTC Safeguards Rule; retain while a business need exists, then dispose securely.
- Tax and accounting records: follow IRS retention triggers, generally three to seven years depending on the item.
- Service and repair records: support warranty and liability defense; retain based on warranty terms and state statutes of limitation.
- Inventory and acquisition records: support cost basis and title history for each unit.
- Advertising and marketing materials: support compliance with state advertising rules and truth-in-lending disclosures.
- HR and payroll records: employment-tax records need at least four years per IRS guidance.
- Corporate and legal records: retain for the life of the entity plus a buffer for statute-of-limitations exposure.
Pro Tip: Assign a named owner to each category, not just a department, so no one assumes someone else is holding the file.
Litigation, audit, or a fraud investigation overrides any baseline period. When one of those triggers appears, the record stays regardless of its scheduled destruction date.
Reconciling state dealer codes with federal minimums
Federal rules are the floor, not the ceiling. State dealer statutes and DMV administrative codes frequently add longer minimums or require specific documents that federal law does not mention by name.
- Identify your state’s dealer licensing statute and the regulator that enforces it, usually the DMV or a state motor vehicle board.
- Check title and odometer disclosure rules for any state-specific retention period or form requirement, which our odometer disclosure guide breaks down in detail.
- Verify state tax and employment retention rules alongside the federal IRS baseline, since states can diverge on timing.
- Record the exact statutory citation, the retention period it sets, and the internal owner responsible for tracking it.
- Revisit the state log annually or whenever your state updates its dealer code, since these rules change more often than federal ones.
A central state-rules log, reviewed on a set schedule, keeps a multi-location dealer from applying one state’s minimum to a lot operating under a different code.
Building a retention matrix with legal-hold controls
A written matrix turns policy into something staff can actually follow. Each row should carry these fields:
- Category (sales, F&I, tax, HR, and so on)
- Record owner
- Retention trigger (sale date, tax year, employment end date)
- Retention period and destruction date
- Destruction method
- Legal-hold flag
- Audit trail entry showing who did what and when
Legal holds override the schedule. The moment a subpoena, audit notice, or foreseeable lawsuit appears, someone needs to flag the affected records, notify anyone who could destroy them, and suspend routine deletion immediately. Preserve chain-of-custody documentation throughout, log every preservation action, and lift the hold only after counsel confirms the matter is closed.
Pro Tip: Build the legal-hold flag into whatever system stores your records so a hold blocks deletion automatically instead of relying on someone remembering to check a list.
Automate what you can, review the matrix at least annually, reconcile it against your state log, and loop in tax counsel for anything involving depreciation, bad debt, or unfiled returns where the limitation period never really closes.
Secure disposal in practice and vendor due diligence
Once a record clears its retention period and carries no legal hold, disposal has to meet the FTC Disposal Rule’s standard: destroyed so it cannot be read or reconstructed.
- Paper records: cross-cut shredding, burning, or pulverizing.
- Electronic records: secure erasure or physical destruction of the drive, with verification.
- Vendor use is allowed, but the dealer remains responsible for due diligence on that vendor.
The Disposal Rule focuses on outcome, not method, which means a shredding vendor is acceptable only if you’ve checked their certifications, requested references, reviewed a sample certificate of destruction, and confirmed contract terms covering liability and insurance. After destruction, keep the evidence: the vendor agreement, pickup logs, certificates of destruction, and scanned confirmations where available. That paper trail is what proves compliance if a regulator asks later, and it protects against the quieter risk of over-retention, since holding sensitive customer data longer than needed only expands breach exposure.
Audit and subpoena readiness: what gets requested most
Regulators and litigants tend to ask for the same handful of records: odometer statements, title documents, tax filings, and F&I credit files. The DOJ’s required-records doctrine means some of these must exist and be producible even without a specific request triggering the obligation.
- Keep deal jackets indexed by VIN and date so they can be pulled quickly.
- Maintain searchable digital exports alongside paper originals.
- Be ready to produce certified copies with a documented chain of custody.
- Loop in counsel before responding to any subpoena, and log the retention or destruction decision either way.
How Loturn’s tools support a dealer’s retention matrix
Loturn’s document management resources and audit trail guidance map directly onto matrix fields like owner, trigger, and audit log. Per-VIN attachments, encrypted storage, and logged access give dealers a practical way to keep records organized without building a system from scratch.
What to fix first if you’re behind
If your retention policy is a single “shred after three years” rule, that’s the first thing to change. Tax records, F&I files, and anything tied to a fraud allegation need their own longer clocks, and a legal hold has to be able to stop destruction on short notice. The more common failure isn’t missing paperwork, it’s destroying something on schedule the week before someone needed it, with no record of a hold process that should have caught it.
— Eric Dosset
Get your retention templates in order
Building a compliant retention matrix by hand across sales, F&I, tax, and HR files can be time-consuming for dealership managers. Some software systems attach documents directly to each vehicle record, keep an audit trail of who accessed or changed what, and store everything with strong encryption, so the matrix you build lives inside the same system tracking your per-car profit.
If you’re ready to see how that works for your lot, check Loturn’s pricing plans, which range from the Flipper plan at $99 per month to Multi-Lot at $699 per month depending on your dealership’s size, and get started with free data import.
Where to verify these rules yourself
- FTC Safeguards Rule FAQ: federal customer-data protection for dealers.
- FTC Disposal Rule guidance: destruction standards and vendor duties.
- IRS recordkeeping guidance: tax-driven retention periods.
- DOJ odometer resource: required-records doctrine.
- Loturn’s dealer forms hub: state-by-state form requirements.
This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.
Sources
- Automobile dealers and the FTC’s Safeguards Rule Frequently Asked Questions | Federal Trade Commission
- Disposing of consumer report information? Rule tells how | Federal Trade Commission
- How long should I keep records? | Internal Revenue Service
- Odometer | U.S. Department of Justice
FAQ
How long should a dealership keep sales and title records?
Sales and title records, including odometer disclosures, should be kept well beyond the sale since they count as required records under DOJ doctrine and support title history disputes. Many dealers retain these for the life of the vehicle’s ownership chain plus several years, reconciled against their state’s specific rule.
What does the FTC Safeguards Rule require for customer financing data?
The FTC’s Safeguards Rule FAQ states that financing-related personal financial information remains protected customer information for as long as the dealer possesses it, even after the loan is assigned to a lender. Dealers may dispose of it securely once no business need remains.
How long does the IRS require tax and accounting records to be kept?
IRS guidance generally requires three years, but six years applies if income was underreported by more than 25%, and employment-tax records need at least four years. Records tied to property should be kept until the limitation period expires for the year it was disposed of.
What counts as acceptable disposal under the FTC Disposal Rule?
The FTC Disposal Rule accepts shredding, burning, or pulverizing for paper and secure erasure for electronic files, as long as the information cannot be read or reconstructed afterward. Using a vendor is fine, but the dealer must vet that vendor and keep proof of destruction.
What should a dealer do when a legal hold applies to records scheduled for destruction?
Routine destruction must stop immediately once litigation, an audit, or an investigation becomes known or reasonably foreseeable. The dealer should flag the affected records, notify anyone with deletion access, preserve chain-of-custody documentation, and lift the hold only after counsel confirms the matter is resolved.