Policy paper

DVLA privacy policy

Updated 15 April 2024

© Crown copyright 2024

This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: psi@nationalarchives.gov.uk.

Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.

This publication is available at https://www.gov.uk/government/publications/dvla-privacy-policy/dvla-privacy-policy

This privacy notice explains how DVLA processes your personal data. In particular, it explains how we collect, use, disclose, transfer and store your data.

1. Introduction

DVLA aims to comply with all applicable data protection laws when processing your personal information. These laws are in place to safeguard your personal information and include measures covering data security, your rights regarding your personal data, and the use and disclosure of your data.

Further information on the standards you can expect from us is set out in our personal information charter.

Who we are

We are an executive agency of the Department for Transport. We are responsible for driver licensing in Great Britain (GB), as well as vehicle tax collection and enforcement, and registering vehicle keepers in the United Kingdom (UK). We hold more than 50 million driver records and 40 million vehicle records, and collect more than £7 billion annually in vehicle tax.

Our address is:

DVLA
Longview Road
Morriston
Swansea
SA6 7JL

What information DVLA collects about you

We collect information for a number of purposes. These include:

We also process your data for research and statistical purposes.

Your rights

You have the following rights regarding how we use your data.

You have the right to know if we hold data about you, what it is, its source and how we use it. Find out how to make a request for the data we hold on you.

You have the right to complain to the Information Commissioner if you believe that we have handled your data inappropriately or we have not exercised any of your rights.

If you believe that the data we hold about you is inaccurate or incomplete, you have the right to request that we correct it without undue delay. We may need to investigate further to confirm that this is the case.

You have the right to have your data erased where there is no need for us to carry on holding it. However, where we have a legal right or obligation to hold your personal data, this right will not apply.

You have the right to have the processing of your personal information restricted where it is inaccurate or where the processing is unlawful.

You have the right not to be subject to decisions which have a legal or significant effect based solely on ‘automated processing’. This includes:

  • automatic individual decision-making (a decision is made solely by automated means without any human involvement)
  • profiling (personal data is processed automatically to evaluate certain things about an individual); profiling can be part of an automated decision-making process

You have the right to object to us processing your personal data in any of the following circumstances:

  • when it is based on ‘legitimate interests’ - this is when the processing is necessary for the controller’s or third party’s legitimate interests, except where these interests are overridden by your interests or fundamental rights and freedoms which protect your personal data
  • when it is based on the ‘public task condition’ - this means carrying out a specific task in the public interest which is laid down by law, or carrying out official authority (for example, a public body’s tasks, functions, duties or powers) which is laid down by law
  • direct marketing (including profiling)
  • scientific or historical research and statistics purposes

The following rights do not apply where processing is based on a legal obligation:

  • the right to object to processing
  • the right to data portability, which allows individuals to get and reuse their personal data for their own purposes across different services
  • the right to withdraw consent

These rights are explained fully on the Information Commissioner’s Office website.

We will consider any request you make to us to exercise these rights within the timescales required by data protection law.

How long we keep information about you

How long we keep your information will depend on why we collected it and our ongoing need to keep it for those purposes. We will also adhere to any legal or regulatory requirements for keeping or deleting the data.

If we cannot specify how long we will need the data for, there will be a process in place to review this need at regular intervals.

Further information on the retention of data can be found in Annex 1.

Who we may share personal information with

Where it is lawful to do so, we may share your personal information with:

  • current and prospective employers
  • other government departments
  • suppliers
  • debt collection, tracing, and ID verification agencies
  • financial organisations
  • vehicle leasing and rental companies
  • police and enforcement bodies
  • prosecution authorities
  • courts, tribunals and parties to legal proceedings
  • industry regulators within UK and Europe
  • local government
  • someone making a legitimate query or complaint
  • survey and research organisations
  • foreign authorities in accordance with international legislation or agreements (for example, for the exchange of a driving licence or re-registration of a vehicle in another country)
  • translation service providers (some of the linguists are based in the EU)
  • private car parking management companies
  • insurance industries
  • other DfT agencies, for example the Driver & Vehicle Standards Agency

Find out more about who we share your data with.

We share information with a third party fraud prevention agency to prevent fraud and protect your identity. Where we detect a fraudulent application for a driving licence or vehicle registration certificate, the fraud protection agency will keep a record of any fraud risk and this may result in others refusing to provide you with services, financing or employment. Find out more on the Cifas website.

We are a joint controller for the advertising we carry out with social media and search engine providers. Further privacy information can be found on the relevant sites using the following links:

2. Information we hold about you

You can ask for information that DVLA holds about you, by making a ‘subject access request’. To do this make a subject access request to DVLA

You can either download a form, to attach to an email and send to SubjectAccess.Requests@dvla.gov.uk or print and send to

Subject Access Request (SAR) Enquiries
DVLA
Swansea
SA99 1BX

You will need to provide us with information to help prove your identity and find the information you are asking for so that we can process your request.

If you would like information about your current vehicle or a vehicle that used to be registered in your name, you will need to provide:

  • your full name
  • your current address and the address on your V5C registration certificate (log book) if it is different
  • the registration numbers of the vehicles you are asking about

If you would like information from your driver record you can get this by using our online service.

Or you can write to us providing your full name, current postal address, and your driving licence number (or date of birth if you don’t know your driver number).

If the data you require about yourself is not related to your vehicle or driver record, you must tell us exactly what further information you need.

There is no fee for making a subject access request. We will respond to a request within one month of receiving it, unless it is a complex request. In these cases, we will write to explain why there is a delay and when you can expect to get a response.

3. If you use an online service and we need to check your identity

Some of our services require us to verify your identity. To do this we rely on your consent (UK GDPR Article 6.1.a) and will ask you to provide your name, address, date of birth, GB driving licence number (if you have one which we will validate using our records) and details of an identity document you hold.

When you use your National Insurance number or UK passport number, we will contact Department for Work and Pensions (DWP) or His Majesty’s Passport Office (HMPO) to help confirm your identity. If you use your non-UK passport, European national identity card, Biometric Residence Permit (BRP) or Biometric Residence Card (BRC) we will contact the Home Office to help confirm your identity.

We may also use an identity checking service provider to check whether there is a record of you existing over time. The identity platform does use an element of automated processing when verifying your identity. This is done using a specific set of rules. If you do not wish for your data to be processed in this way you are able to submit your applications via the manual route.

4. When you open a Driver and vehicles account

You will need to set up an account using an email address, mobile telephone number (optional) and create a password.  These credentials will be saved so you can log in to your account. To be eligible to use the service, you will need to prove your identity.

Within the service you can:

  • view your driving record, for example vehicles you can drive
  • check your penalty points or disqualifications
  • add and view details of your vehicles - including when the MOT expires
  • check the tax rates for your vehicles
  • set up vehicle tax reminders by email and SMS
  • opt in to take part in research for the development of new services (please note you can opt out of this at anytime within your account)

DVLA relies upon UK GDPR Article 6.1.e as the lawful basis to process your data when is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

DVLA will not use this service to collect further personal details or driving licence information about you.  It is a service designed to allow you to have access to your driving licence and vehicle data.

If you no longer wish to have an account, you can delete it from within the service.

5. When you apply for a driving licence

We may collect and process your personal information to allow us to carry out our legal obligations under the following legislation.

Road Traffic Act 1988

  • To issue provisional and full driving licences, replace lost licences, update licences with amended personal details or driving entitlement, and renew licences if you are disqualified from driving or your driving entitlement expires.
  • To record and enable the investigation of medical conditions that may affect your fitness to drive.

Road Traffic Offenders Act 1988/Road Traffic (New Drivers) Act 1995

  • To record details of road traffic disqualifications and convictions.
  • To administer driving entitlement revocation where required by this legislation.

Other

We are also obliged by law to record details of non-driving offences that lead to being disqualified from driving.

Who we share your driver data with

We may share information from your driving licence record with third parties where necessary, and when the law allows it. Find out more about the release of information from DVLA’s registers.

If you have authorised us to release information provided to us during the course of a medical investigation, we may share any supporting documents (including medical reports) where necessary with doctors, registered health care professionals, optometrists or other eye care professionals, paramedical staff, driving assessors, occupational therapists and members of the Department for Transport’s Medical Advisory Panels. We only share the minimum data needed to assess your medical fitness to drive. If you do not provide us with the required authorisation, you could lose your driving entitlement.

We capture data on behalf of NHS Blood and Transplant (NHSBT) when you specify on your driving licence application that you wish to become an organ donor. We share this information with NHSBT and provide them with change of address details. This information is recorded by means of a code on your driving licence. If you no longer wish to be an organ donor you should contact NHSBT to remove your details from their records, and return your driving licence to us to have the code removed and a new licence issued.

Who provides us with information about you

The following organisations may give us information about you:

  • the courts tell us when a driver has been convicted of a driving offence or disqualification and are also legally bound to tell us about any medical conditions disclosed during the court case
  • Traffic Commissioners provide outcomes of large goods vehicle (LGV) and passenger carrying vehicle (PCV) driver conduct cases
  • the police and other third parties (such as members of the public) may tell us if they are concerned about someone’s fitness to drive
  • your GP, specialist or consultant may provide us with information about a notifiable medical condition which may affect your fitness to drive; this is required for us to be able to check you meet the current legal standards to drive

Why you must provide your personal data

By law, drivers must provide their personal information to get a driving licence. It is an offence not to tell us about a change in personal details or about a medical condition that may affect your fitness to drive, or to drive a vehicle without the required driving entitlement. If you do not comply with these requirements, you could be prosecuted.

When you notify us online, about a medical condition that could affect your fitness to drive, there is an element of automated processing within the service. This process gives a recommendation, to a person dealing with your notification, on the next steps to take in your case.

When you use any of our online services or send in a DVLA form in relation to your driving licence, you have the option of providing your telephone number and email address. This information will only be used to contact you about these matters.

Changes to HGV and bus driving licences

From 15 November 2021 there will be a change to HGV and bus driving licences and tests. This means that when you view your driving licence on a DVLA online service such as View your Driving Licence Information, you may notice different driving entitlements shown on your licence. For further information on this change, please visit Changes to HGV and bus driving licences and tests from 15 November 2021.

6. When you apply for a tachograph card

We collect personal data to process tachograph applications and issue tachograph cards on behalf of the Driver and Vehicle Standards Agency (DVSA) in the UK, and the relevant licensing authorities in the Isle of Man, Jersey and Guernsey. We process your data in line with the UK General Data Protection Regulation and Data Protection Act 2018, and tachograph Regulation (EU) 165/2014, as it has an effect in the UK.

Who we share your tachograph data with

We may pass the information on your digital tachograph record to other government organisations, EU/EEA tachograph issuing authorities and law enforcement agencies. We may do this to check tachocard applications, prevent and detect crime, for statistical purposes or where there are other legal powers to do so.

7. When you apply to register or tax a vehicle

We may collect and process personal data about you to allow us to carry out our legal obligations under the following legislation.

The Vehicle Excise and Registration Act 1994 and the Road Vehicles (Registration and Licensing) Regulations 2002

  • To register vehicles, assign registration numbers and issue V5C registration certificates.
  • To collect Vehicle Excise Duty (VED) and enforce against VED evasion (this includes the payment of penalties, out of court settlements and using automated number plate reader technology and wheelclamping).
  • To contact the keeper of a vehicle where automated number plate recognition technology has identified that a vehicle registration mark is being displayed incorrectly.

Where medical evidence is provided as part of an Enforcement appeal, this evidence will be passed over to the Drivers Medical department in DVLA for further consideration.

  • To consider requests for information from public and private sector organisations.

The Retention of Registration Marks Regulations 1993

  • To operate the scheme for keeping (retaining) a registration number.

The Road Traffic Act 1988

Who we share your vehicle data with

We may share information from your vehicle record with law enforcement agencies and other bodies where necessary, and in accordance with the law.

Find out more about the release of information from DVLA registers.

Who provides us with information about you

The Motor Insurers’ Bureau provides us with insurance data to allow us to operate the continuous insurance enforcement scheme.

DVSA provides us with MOT data to prevent vehicles from being taxed if they are unroadworthy.

We receive information from the Foreign and Commonwealth Office for us to issue vehicle and driving licence permits to foreign diplomatic and consular staff in the UK.

We receive information from the Insolvency Service when you invoke your right to breathing space under The Debt Respite Scheme (Breathing Space Moratorium and Mental Health Crisis Moratorium) (England and Wales) Regulations 2020.

Taxing your vehicle by Direct Debit

We process Direct Debit mandate holder data and payment card details to collect VED and any penalties for not paying VED, and continuous insurance enforcement.

Why you must provide your personal data

By law, vehicle keepers must provide us with their details. It is an offence not to correctly register, tax or make a Statutory Off Road Notification (SORN) on a vehicle. Failure to comply with these requirements may lead to enforcement action such as a late licensing penalty, out of court settlement or ultimately, prosecution.

When you use any of our online services or send in your V5C to tell us about a change such as change of address, you have the option of providing your telephone number and email address. This information will only be used to contact you about these changes.

8. When you apply for a trade plate

We may collect and process the personal data of individuals applying for a trade plate to carry out our legal obligations under the following legislation.

The Vehicle Excise and Registration Act 1994 and the Road Vehicles (Registration and Licensing) Regulations 2002

  • To maintain a register of all customers issued with a trade plate licence.

Who we share your trade plate data with

We may share information about people who have been issued with trade plates with law enforcement agencies and other bodies where necessary, and in accordance with the law.

9. When you apply to register for and pay the HGV road user levy

We use a third party supplier to collect and process personal data to administer, enforce and collect payment for the HGV levy. This is covered in the HGV Road User Levy Act 2013.

The data collected is required to fulfil the Department for Transport’s legal obligations under that Act.

What information the supplier collects

When you register to pay the HGV levy, the supplier will collect personal information including payment details, name, address, registration number, and the dates the vehicle enters and leaves GB.

How the HGV levy data is shared

This data is shared with the Driver and Vehicle Agency (Northern Ireland) and law enforcement bodies for enforcement purposes where necessary.

10. When you apply to register a trailer

We may collect and process personal data about you to allow us to carry out our legal obligations under the following legislation.

The Haulage Permits and Trailer Registration Act 2018 and the Trailer Registration Regulations 2018

  • To register trailers, assign registration numbers and issue registration certificates.

Who we share your trailer data with

We may share information from your trailer record with law enforcement agencies and other bodies where necessary, and in accordance with the law.

Find out more about the release of information from DVLA registers.

What information we collect

When you register a trailer we collect your name, address and details of the trailer. By law, this information must be provided in order for us to process your application.

11. When you buy a private (personalised) registration number

We may collect and process your personal information to allow us to carry out our legal obligations in accordance with the following legislation.

The Sale of Registration Marks Regulations 1995

  • To enable the sale of vehicle registration numbers.

What information we collect

When you buy a private (personalised) registration number, we collect your:

  • name
  • address
  • email address
  • company name
  • telephone number
  • payment card details

Where applicable, we will also collect the nominee name and nominee address.

When you note your interest in registration numbers for sale, we collect your contact details including your email address, name, address and phone number to inform you of forthcoming sales and to ask you for feedback on the service. These details are held for a maximum of 5 years after which you’ll have to re submit your interest in a registration number that has not yet been made available to purchase. Once the registration number has been made available to purchase and we’ve contacted you, your record of interest will be deleted.

If you no longer wish to receive email or postal updates on registration numbers for sale, you can use the opt-out facility provided.

When you bid for a registration number, our contracted auctioneer retains bidder information until the auction is closed. They do not retain any payment card details but keep a copy of the customer invoice for 7 years.

Who we share your data with

We will only share this information with law enforcement agencies and other bodies where necessary, and in accordance with the law.

12. When you apply to become a number plate supplier

We may collect and process the personal data of individuals applying to become a number plate supplier in accordance with The Vehicles Crime Act 2001 and The Vehicles Crime Act (Registration of Registration Plate Suppliers) Regulations 2008.

Who we share your data with

We may share register of number plate suppliers information with law enforcement agencies and other bodies where necessary, and in accordance with the law.

13. When you contact us about Clean Air Zones

We process your personal data on behalf of the Joint Air Quality Unit (JAQU), which is a joint initiative by the Department for Environment, Food & Rural Affairs (DEFRA) and the Department for Transport (DfT).

To enable local authorities to manage their Clean Air Zones (CAZ), JAQU has developed the Drive in a Clean Air Zone service which includes an online tool for users to check if they have to pay a daily charge for driving into or within a CAZ. For more information see the JAQU privacy policy.

DVLA’s contact centre deals with CAZ service queries and takes CAZ payments from individuals on behalf of JAQU.

When required, we may share with JAQU the:

  • vehicle registration number
  • customer name
  • customer email address

We may provide a copy of the telephone recording for appeals or enforcement purposes when requested to do so by the relevant local authority.

In some instances, DVLA may also issue letters to the registered keepers of non-compliant vehicles likely to be affected by the introduction of a Clean Air Zone on behalf of the relevant local authority or JAQU.

14. When you subscribe to receive DVLA email alerts

We use a third party supplier when you subscribe to receive DVLA email alerts. They collect your email address, phone number and IP address to provide you with relevant information you have requested as part of your subscription. You can unsubscribe from using this service at any time.

If do not want to receive survey invitations by email from DVLA, please email DVLAResearch.responses@dvla.gov.uk and put ‘unsubscribe’ in the subject box.

15. Transfers of data outside of the UK

Transfers of data from the UK to the European Union (EU) take place under the EU:UK adequacy decision that was adopted on 28 June 2021.  When we transfer data to a country which does not have an adequacy decision in place under Article 45 of the UK General Data Protection Regulation (GDPR), we rely mainly upon appropriate safeguards under Article 46 of the UK GDPR, such as Standard Contractual Clauses (SCCs) or International Data Transfer Agreements (IDTAs).  Where that is not appropriate, we rely upon Article 49 (1) (d) of the UK (GDPR):  the transfer is necessary for important reasons of public interest. DVLA has an administrative agreement in place with the Republic of Ireland.

If you are outside of the UK and requesting a copy of your personal data from DVLA, we will apply the appropriate derogation under Article 49 of the UK GDPR for the transfer of your personal data.

Data sharing agreement with Spain

We may collect and process personal data about you to allow us to carry out our legal obligations under the following legislation.

Road Safety Act 2006 – Section 49

  • Disclosure to foreign authorities of licensing and registration information.

DVLA has an agreement in place with Spain that facilitates the sharing of vehicle registration data for 8 specific road-safety related traffic offences. The offences are:

  • speeding
  • failing to use a seatbelt
  • failing to stop at a red traffic light
  • drink-driving
  • driving while under the influence of drugs
  • failing to wear a safety helmet
  • the use of a forbidden lane
  • illegally using a mobile telephone or any other communication devices while driving

16. When you have a query or complaint

We may process your personal data when we get a query or complaint either from you or a third party acting on your behalf.

To investigate your query or complaint, we may need to access your driver or vehicle record to resolve any issues.

To improve our complaint procedure, we carry out customer satisfaction surveys and we may contact you for feedback on how we have dealt with your complaint.

When you contact us through webchat, DVLA will process the information submitted as part of our official authority. The contact details you provide will only be used for this purpose.

Who we share your data with

We may share details of your complaint to the Independent Complaints Assessor and the Ombudsman or the Information Commissioner’s Office where necessary, and when you require us to do so.

17. When you are a key stakeholder or supplier who have contracts and services with us.

We collect the names and sometimes the telephone number of our key stakeholders and suppliers who have contracts and services with us. These details will only be used in connection with the contract or service involved.

We use software to collect details of our key stakeholders and suppliers involved in our business continuity plan in the event of disaster recovery. Processing this data is necessary for the purposes of the legitimate interests pursued by the controller or by a third party.

18. When you are an external visitor to a DVLA site

This includes:

  • external training providers
  • job applicants
  • suppliers and tradespeople
  • staff from other government departments

We capture the following personal data when you visit a DVLA site:

  • name
  • organisation/company which you represent
  • date and time of your visit
  • duration of visit if more than one day
  • vehicle registration number

These details are needed so we can issue you with the appropriate visitor pass. You must wear your visitor pass throughout your visit.

Closed-circuit television (CCTV) operates outside and inside the building for security purposes. The information is viewed by appropriate personnel on a live feed, and is recorded and held for 31 days before being automatically deleted, unless it is required for a specific incident such as an accident, acts of criminality or breaches of security.

Security staff wear body worn cameras which are activated where necessary for their safety or for acts of criminality. The recordings are held for 31 days before being automatically deleted, unless required for a specific incident.

The purpose for processing the above information is for security and safety reasons. The lawful basis we rely upon to process your personal data is article 6(1)(f) of the UK GDPR, which allows us to process personal data when it is necessary for the purposes of our legitimate interests.

We have Guest Wifi on site for the use of visitors. To access the Guest Wifi you will need to provide your name and the email address, company name and an email address of a DVLA sponsor. The DVLA sponsor is usually the person that has asked you to attend the site. The DVLA sponsor will receive an email from the system granting the Guest Wifi access for a 24-hour period of time. To access the wifi we ask you to agree to the terms noted on the screen. Your personal data will be held for 12 months.

Please note that all internet activity involving the DVLA Guest Wifi network is automatically recorded. These records (of websites visited, files transferred, emails sent, etc.) are not actively monitored, but if any misuse is suspected, they may be analysed in accordance with the relevant legislation that applies.

The purpose for processing Guest Wifi information is to provide you with access to the internet whilst visiting our site. The lawful basis we rely upon to process your personal data is article 6(1)(f) of the UK GDPR, which allows us to process personal data when it’s necessary for the purposes of our legitimate interests.

19. How to contact DVLA’s Data Protection Manager

If you wish to contact our Data Protection Manager, please write to:

DVLA SAR Enquiries
DVLA
Swansea
SA6 7JL

Or you can write to the Data Protection Manager by email at: SubjectAccess.Requests@dvla.gov.uk

20. Review

We review our privacy policy at least annually. By doing this we will make sure you are always aware of what information we collect, how we use it and under what circumstances (if any) we will share it with other parties.

Back to top