Guidance

Report a serious safety defect: privacy notice

Updated 23 June 2026

1. About this service 

The Driver and Vehicle Standards Agency (DVSA) provides the service to report a serious safety defect.  DVSA is an executive agency of the Department for Transport (DfT). 

You can use this service to report a serious defect that affects the safety of your vehicle, one of its parts, or an accessory to DVSA.  

The data controller for DVSA is DfT - a data controller determines the reasons and how personal data is processed. For more information, see the Information Commissioner’s Office (ICO) Data Protection Public Register. DfT’s registration number is Z7122992. 

2. What data we need 

The personal data we collect from you will include: 

• your name 

• your address 

• your email address 

2.1  Vehicle defect data 

The data we collect from you about the defect will include: 

• vehicle registration (number plates) 

• vehicle’s identification number (VIN) 

• where the vehicle is kept 

• any photos showing the defect (if you have them) 

2.2 Lawful basis 

The lawful basis for processing this data is ‘public task’ under the: 

• Regulation (EU) 2018/85 

• The Road Vehicles (Approval) Regulations 2020 

• Regulation (EU) 167/2013 

• Regulation (EU) 168/2013 

• The General Product Safety Regulations 2005 

• Fraud Act 2006 

3. Why we need it 

We need the personal data we collect from you to: 

• investigate the safety defect 

• use as evidence in any case against the manufacturer 

• contact you for more information to help us investigate the defect 

4. What we do with it 

We collect, use and store the data you give us for the reasons set out in this policy. 

We will review the information you’ve sent and decide what to do next. This may include: 

• sharing the data with DVSA examiners and asking them to investigate the defect 

• sharing the data with the vehicle manufacturer so they can investigate the defect  

• asking you for more information  

We will share your data if required to do so by law - for example, by court order, or to prevent fraud or other crime. 

We will not: 

• sell or rent your data to third parties 

• share your data with third parties for marketing purposes 

5. How long we keep your data 

We’ll only keep your personal data for as long as it is needed for the reasons set out in this policy, or as long as it’s required by law. 

We will hold your personal data for whichever of these is longest: 

• no more than 20 years after the end of an investigation 

• 20 years after the end of any court sentence has expired following information you gave to us 

6. Where it might go 

All investigation data is held on DVSA servers based in the UK or hosted within cloud services based in the European Economic Area (EEA). They meet security safeguards equivalent to those required by data protection legislation. 

7. Protecting your data and your rights 

The DVSA personal information charter sets out what steps are taken to protect your data, and the rights you have over your data. 

8. Automated decision making and profiling 

Your data is not subject to automated decision making or profiling as defined in data protection legislation. 

9. Changes to this notice 

We may change this privacy notice at our discretion at any time. 

When we change this notice, the date on the page will be updated. Any changes to this privacy notice will be applied to you and your data as of the revision date. 

We encourage you to periodically review this privacy notice to be informed about how your data is protected. 

10. How to contact us 

If you have any questions about anything in this document or if you consider that your personal data has been misused or mishandled you can contact the DVSA data protection manager 

DVSA data protection manager

Data Protection Manager
DVSA
1 Unity Square
Nottingham
NG2 1AY

Email information.handling@dvsa.gov.uk

You may also make a complaint to the Information Commissioner, who is an independent regulator.