Road training
Data protection
for driving schools
Driving schools manage pupil files containing identity data, examination results and, on occasion, health data from the psychophysical assessment. Communications with the DGT and file retention give rise to specific data protection obligations.
Art. 9
GDPR — psychophysical health data
Art. 6.1.c
GDPR — communication with DGT
4 years
tax data retention
24 h
personalised proposal
Sector challenges
General obligations for driving schools
Pupil file
Identity data, licence type, lesson history and examination results make up the pupil file. It must be retained for the time necessary to address any potential claims.
Communications with the DGT
Exam booking and licence processing require transmitting pupil data to the DGT, grounded in the legal obligation to cooperate with the public administration.
Psychophysical assessment
The pre-licence medical assessment report contains health data (special category under art. 9 GDPR). Its processing must be strictly limited to the purpose of the licensing process.
Photographs for the licence
Pupil photographs are personal data that must be handled with care. They must be collected solely for licence processing and may not be used for any other purpose without consent.
Under-18 pupils
Certain licences (AM for mopeds, A1 for motorcycles) may be obtained before the age of 18. Where the pupil is a minor, the training contract must be formalised by their parents or legal guardians on their behalf. Each situation must be assessed individually.
Driving school management software
Pupil management, lesson booking and accounting platforms may act as data processors when they process data on the driving school's instructions. The precise legal relationship depends on each provider's terms and should be reviewed and documented.
The service
What the service includes for your driving school
RoPA (Record of Processing Activities)
Tailored record: pupils, employees, communications with the DGT and management software.
Information clauses
Texts for the pupil enrolment contract and web forms.
Privacy policy and legal notice
Documentation for the driving school's website.
Data Processing Agreements (DPA)
DPAs for pupil management software and self-study platforms.
Data breach protocol
Response procedure with 72-hour notification.
Data subject rights management
Documented procedure for requests from pupils and employees.
Document management platform
Access to a private platform with documents and electronic signature.
Ongoing support
Unlimited queries. Updates in response to regulatory changes.
External DPO (if applicable)
As a general rule, driving schools are not listed in the exhaustive provisions of art. 34 LOPDGDD or art. 37 GDPR. The final requirement will depend on the scale, volume and exact nature of each entity's processing activities. Each case requires individual analysis. Independent contract.
Do you need a proposal for your driving school?
Tell us about the size and number of pupils. Proposal within 24 hours.
FAQ
Frequently asked questions about data protection in driving schools
Are driving schools required to comply with the GDPR?
Yes. Driving schools process pupil identity data, examination results and, in some cases, health data from the required psychophysical assessment prior to licence issuance. The GDPR applies from the very first enrolled pupil.
What data is shared with the Directorate-General for Traffic (DGT)?
Driving schools transmit to the DGT the data necessary for booking driving tests: the pupil's identity data, the type of licence applied for and the fees paid. This communication is grounded in the performance of a legal obligation (art. 6.1.c GDPR).
How long must a driving school retain a pupil's file?
The pupil's file must be retained for the time necessary to address any potential claims relating to the training received (generally 3 to 5 years) and for the tax retention period applicable to billing documentation (4 years). Medical assessment data must be erased once the process is concluded.
Does the medical assessment prior to licence issuance contain health data?
Yes. The psychophysical assessment report (visual, auditory and psychomotor aptitude) carried out at driver assessment centres is health data (art. 9 GDPR). A driving school that receives the result of this assessment processes it with enhanced protection and solely for the purpose of the licence-obtaining process.
Can driving instructors access all pupil data?
Only the data necessary for conducting driving lessons: the pupil's name, type of licence and stage of the training process. Financial data and the full file must be accessible only to authorised administrative staff.
Are photographs of pupils taken for the driving licence personal data?
Yes. A photograph is personal data that enables the identification of the individual. A driving school that collects pupil photographs for licence processing handles them within the framework of the issuance process and must inform the pupil of this purpose. Photographs may not be used for any other purpose without the explicit consent of the person concerned.
Sector resources
Learn more
Driving schools
Driving school student data: files, exams and DGT communication
How a driving school manages the student's file under the GDPR: legal bases, communication with the DGT, theoretical and practical test results, retention periods and delivery of the certificate of fitness.
7 min·Read article
Driving schools
GDPR at driving schools: basic information and mandatory documentation from the first student
Minimum proportionate documentation for the driving school under the GDPR: proportionate RoPA, registration information notice referencing the DGT, art. 28 contracts with technology providers and operational security policy.
7 min·Read article
Free tool
Data protection self-check
Check in 5 minutes your overall adaptation level in personal data protection.
No email · Anonymous · No commitment
Road training
GDPR compliance
for your driving school.
An expert analyses your activity and proposes the right solution. No intermediaries.
Proposal within 24 h · info@certix.es
Legal notice: This content is for informational and educational purposes only; it does not constitute specialist legal advice. The application of the regulations to each specific case requires individual analysis.