Driving school student data: files, exams and DGT communication

A driving school is not only a training centre: it is also an administrative cog that submits each student's licence application file to the DGT (Spain's General Traffic Directorate). That dual nature (training centre + administrative intermediary) has clear consequences in data protection terms.

This guide reviews student file management, communication with the DGT, the handling of theoretical and practical test results and the delivery of the certificate of fitness, under the GDPR (Regulation (EU) 2016/679), the LOPDGDD (Spain's Organic Law 3/2018) and Spanish Royal Decree 818/2009, approving the General Drivers Regulation.

Typical processing operations at a driving school

Daily life at any driving school revolves around a few perfectly identifiable data flows:

The student file: content and custody

The student's administrative file gathers the documentation the driving school needs to submit the licence application to the Provincial Traffic Office and to evidence the training process. Typical content:

• Licence application signed by the student (official DGT form).
• Photocopy or verification of DNI/NIE.
• Psychotechnical certificate issued by an authorised centre.
• Proof of payment of the corresponding fee.
• Registration form and student responsible declaration.
• Internal record of theory classes attended and practical sessions completed.
• Specific documentation for professional licences (CAP, ADR where applicable).

Custody must follow basic criteria: restricted access to staff with direct functions, physical archiving under lock and key, digital archiving with individual passwords and two-factor authentication when managed from cloud platforms. The driving school documents in its operational security policy who accesses, how and for what purpose.

Communication with the DGT: legal obligation, not consent

Communication between the driving school and the DGT during the file process does not require student consent: it is a legal obligation arising from Spanish Royal Decree 818/2009, which defines the administrative framework for obtaining the licence. The information notice provided at registration must state this expressly:

• Identification of the DGT as recipient of the file data.
• Specific purpose: application processing, exam session assignment, recording of results, issuance of the licence.
• Legal basis: legal obligation of the controller under the General Drivers Regulation.
• Retention periods derived from traffic regulations themselves and from tax and commercial rules.

The driving school acts as the controller of its student's documentation; the DGT acts as the administrative controller of the drivers' register and the examination process. There is no processing arrangement between them: there are two controllers acting under different legal frameworks.

Theoretical and practical tests: communicating the result properly

Managing the exam result is one of the points where driving schools most frequently fail in practice. Operational rules:

• The result is communicated to the student directly, not through collective channels. Posting "Juan, María and Pedro have passed" in a WhatsApp group discloses personal data to third parties without legal basis.
• If the student wishes a family member to be informed, they must expressly authorise it in writing, identifying the person.
• For minors, parents or guardians may receive the information by virtue of parental authority.
• Internal results (mock exams, the driving school's own tests) are academic data of the student and are managed under the same criteria.
• Lists of students attending a session, when displayed in the classroom, must use minimum references (initials or file number) and not full lists with name, surname and DNI.

Certificate of fitness and licence delivery

When the student passes the tests, the driving school receives DGT confirmation and delivers to the student the document certifying fitness to drive until the physical licence is issued. Relevant aspects:

• The certificate is delivered to the data subject or a person expressly authorised in writing.
• The delivery record is added to the file and remains during the documentation retention period.
• The student's official photograph used in the file follows DGT administrative rules; the driving school must not use it for different purposes (website, social media, promotional material) without specific consent.
• The student's contact data is not transferred to third parties (finance companies, garages, insurers) save with express and independent consent, separate from the registration consent.

Retention periods and blocking

The driving school retains file documentation and student data for the periods arising from the various overlapping rules:

• Administrative file documentation: for the periods linked to the power to review administrative action and potential claims from the student.
• Billing and accounting: six years (Spanish Commercial Code) and at least four years of tax limitation (Spanish General Tax Act), extendable depending on the case.
• Data for commercial use (marketing): while consent or supportable legitimate interest is in force, with the right to object and unsubscribe on every send.
• Teaching staff data: labour and social security periods.

Once the longest applicable period for each block has elapsed, the data enter blocked status (restricted retention only to respond to potential authority requests) and subsequently undergo secure destruction.

Driving school data protection checklist

• Information notice delivered at registration, expressly mentioning the DGT as recipient.
• Differentiated consent sheet for optional uses (image, marketing, transfers).
• Policy on result communication without collective channels.
• Custody protocol for physical and digital files.
• Art. 28 GDPR contracts with the management platform, payment gateway, external accountant and, where applicable, the simulator provider.
• Differentiated retention policy by block and secure destruction procedure.
• Procedure for handling rights exercises (access, rectification, erasure, objection, restriction, portability).
• Breach protocol with AEPD (the Spanish Data Protection Authority) notification template.

Frequently asked questions

This content is for informational and educational purposes only and does not constitute legal advice. Applying the regulation to each specific case requires individual analysis. Regional sectoral regulations may extend or modify time limits and requirements.