GDPR Privacy Notice — Driving Instruction

🔒 [Business Name] 👤 [Your Name] 🪪 ADI Reg: [ADI Registration Number] 📅 Version date: [Date]

1. Who Is the Data Controller?

[Your Name], trading as [Business Name], [Your Town], is the data controller for the personal data collected in connection with the provision of driving instruction. Contact: [Your Email Address] | [Your Phone Number].

This notice explains what personal data is collected, why, and your rights as a data subject under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. What Personal Data Is Collected?

Category	Data Collected	Legal Basis
Identity & Contact	Full name, home address, telephone number, email address, date of birth	Contract (Art. 6(1)(b))
Licence Information	Provisional or full driving licence number, licence category, entitlement dates	Contract
DVSA Test Records	Theory test pass date and certificate number; practical test booking date(s); test result(s)	Contract / Legitimate interests
Eyesight Check	Confirmation that the DVSA eyesight standard has been verified by the Instructor at the start of tuition	Legal obligation / Contract
Lesson Progress Records	Lesson notes, competency assessments (DVSA syllabus), feedback, lesson dates and durations	Contract / Legitimate interests
Payment Records	Amounts paid, payment dates, payment method, any outstanding balances, receipts	Contract / Legal obligation
Health Information (limited)	Any notified medical conditions relevant to safe driving (e.g. DVLA notifiable conditions), eyesight concerns	Vital interests / Legal obligation (Art. 9(2)(c) & (b))

3. Why Is Your Data Used?

To provide driving tuition and track lesson progress against the DVSA standards.
To manage lesson bookings, cancellations, and payments.
To communicate with you about your lessons, test readiness, and scheduling.
To meet financial record-keeping obligations under HMRC rules.
To fulfil any legal obligation to the DVSA or other authorities.

4. DVSA Reporting Obligations

      Important — mandatory reporting: The Instructor has a legal and professional obligation to report to the DVSA (or relevant authorities) if there is a reasonable belief that a Pupil has a medical condition that makes them unfit or unsafe to drive, particularly a DVLA notifiable condition. This is a legal obligation (Art. 6(1)(c) UK GDPR) and overrides the Pupil's right to object to disclosure.
    

The Instructor will, wherever possible, discuss this with the Pupil before making any report. However, in cases of immediate risk, reporting will be made without prior notice.

5. Who Receives Your Data?

Your personal data is not sold or shared with third parties for marketing purposes. Data may be shared with:

DVSA — where legally required (e.g. fitness to drive concerns).
HMRC — in respect of financial records as part of self-assessment tax obligations.
Cloud storage providers — lesson records may be stored using encrypted cloud services (e.g. Google Drive, iCloud) based in the UK/EEA or with standard contractual clauses in place.
Payment processors — where applicable (e.g. Stripe, PayPal) for processing card or digital payments.

6. How Long Is Data Retained?

Lesson notes and progress records: Retained for 3 years after the last lesson, then securely deleted or destroyed.
Financial and payment records: Retained for 6 years from the end of the relevant tax year, in line with HMRC requirements.
Correspondence (emails, messages): Retained for up to 3 years after the last lesson, then deleted.

7. Your Rights

Under UK GDPR you have the right to:

Access — request a copy of the personal data held about you (Subject Access Request).
Rectification — ask for inaccurate data to be corrected.
Erasure — ask for data to be deleted, subject to legal retention obligations.
Restriction — ask for processing to be restricted in certain circumstances.
Portability — receive your data in a structured, machine-readable format where processing is automated and based on consent or contract.
Object — object to processing based on legitimate interests.

To exercise any of these rights, contact: [Your Email Address]. The Instructor will respond within one month.

You have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

8. Cookies and Website Data

If you use the Instructor's website or online booking system, a separate cookie/privacy policy applies. This Privacy Notice covers data collected in the context of driving instruction only.

9. Changes to This Notice

This notice may be updated from time to time. The current version will always be provided on request and made available with lesson documentation.