Guidance

DVSA enforcement: privacy notice

Updated 12 November 2024

1. About this service

The Driver and Vehicle Standards Agency (DVSA) carries out enforcement work to help the public stay safe on Britain’s roads. Our vision is for safer drivers, safer vehicles and safer journeys for all. DVSA is an executive agency of the Department for Transport (DfT).

We carry out:

• roadside enforcement by targeting non-compliant lorries, coaches and buses for roadworthiness defects and drivers’ hours offences
• remote enforcement including earned recognition scheme
• hazardous chemical (hazchem) compliance checks on lorries, coaches and drivers
• disability access checks on buses
• standards control audits and investigations into compliance with legal requirements and this work includes educational support to new operators joining the system
• investigations into complaints about bus operators’ scheduled services
• investigations into fraud associated with the bus operators subsidy grants

The data controller for DVSA is DfT - a data controller determines the reasons and how personal data is processed. For more information, see the Information Commissioner’s Office (ICO) Data Protection Public Register. DfT’s registration number is Z7122992.

2. What data we need

2.1 Roadside or remote enforcement

The personal data we collect from you through roadside enforcement will include:

• name
• address
• date of birth
• email address
• phone number
• operator licence number and information
• vehicle registration marks (number plates)
• driving licence number
• details of any offences and/or defects
• details of unauthorised vehicles including impoundment
• payment card details in the event a fixed penalty notice is issued

Payment card details are captured for the purpose described above at the time of payment, but are not stored.

2.2 Tachograph records

The personal data we collect from you when looking at your tachograph records will include:

• name
• address, email and phone number
• place of birth
• country from which the driver qualification card originated
• driver qualification card number and status
• driving licence number, issuing country, entitlements, endorsements
• operator name and address
• your driving hours, journeys, breaks and rest periods

2.3 Hazardous chemical compliance

The personal data we collect from you when carrying out a hazardous chemical compliance check will include:

• name
• contact number
• position
• operator/company name, address, email and phone number
• vehicle registration marks (number plates)
• testing reports and outcome

2.4 Bus, coach and lorry compliance

The personal data we collect from you when investigating bus, coach and lorry compliance will include:

• applicant and/or operator’s name
• address
• vehicle registrations (number plate)
• vehicle test date and result
• mileage reading
• test number
• reasons for failure
• advisory notices
• reasons and outcome of impounding a vehicle
• funds returned to the operator

2.5 Post collision examination

The personal data we collect from you when carrying out post collision examinations will include:

• operator/company name, address, email, and phone number 
• vehicle registration marks (number plates) 
• mileage reading 
• vehicle test date and result 
• details of any defects found
• prohibition notices and advisory notices
• outcome of examination

2.6 Information about staff

The personal data we collect about staff will include:

• information contained in the MC/ECMS systems - your name and identity number
• information contained in your pocketbook - encounters you have handled, your witness statement which will include details about your employment with DVSA, any information to be used in court
• information contained against your warrant card, Hazchem card, ID card and Power to Stop accreditation card - your name, epaulette number, card number and expiry date - each card will represent the activities the enforcement officer is permitted to carry out
• for any officer accredited with the powers to stop, we will collect their driving licence number, details of any licence endorsements, and details of any Disclosure Scotland checks, plus any convictions found

2.7 Information about members of the public

The personal data we collect about members of the public will include:

• name
• address
• contact number
• email address
• witness statements

2.8 Lawful basis for processing this data

The lawful basis for processing this data is public task in helping the public stay safe on Britain’s roads.

Enforcement delivery takes enforcement action against high-risk vehicle operators, MOT garages, illegal driving instructors and others fail to comply with the regulatory areas, which DVSA enforces.

Our statutory powers are set out in:

• Police and Criminal Evidence Act 1984
• Criminal Procedure and Investigations Act 1996
• Regulation of Investigatory Powers Act 2000
• Fraud Act 2006
• Road Traffic Act 1988, including sections 66A, 68(1), 68(3), 99 and 123
• Transport Act 1968 (production of Tachograph charts and other documents) section 99. These powers are also contained within Article 14(2) of the Community Recording Equipment Regulations 3821/85
• Road Traffic (Foreign Vehicles) Act 1972 (power to direct and detain the vehicle and driver)
• Road Transport (Working Time) Regulations 2005 (Powers of entry into premises, examination of records and investigation in respect of working time) schedule 2

We are seeking to ensure compliance of operators, drivers and vehicles with the following statutory requirements:

• Regulations EC 85/3821, EC 98/2135, EC 2014/165, EC 1071/2009, EC 1072/2009, EC 1073/2009, EC 1503/2017, EC 68/2016
• Road Traffic Act 1988
• The Goods Vehicles (Licensing of Operators) Act 1995, specifically section 2
• The Public Passenger Vehicles Act 1981
• Motor Vehicles Test Regulations 1981
• The Motor Cars (Driving Instruction) Regulations 2005
• The Road Transport (Working Time) Regulations 2005

3. Why we need it

We need the personal data we collect from you to:

• perform roadside enforcement / mobile compliance activities to ensure UK roads are safe by targeting non-compliant lorries and buses for roadworthiness defects and drivers’ hour offences
• create and maintain a record of encounters with vehicle operators in our mobile compliance system
• examine tachograph data to check driving times, breaks and rest periods for drivers who carry goods and passengers by road
• maintain a register of vehicles impounded under the Goods Vehicle (Enforcement) Regulations and Public Vehicle (Enforcement) Regulations, and to ensure transactions are conducted promptly and accurately
• create and maintain a register of vehicles examined as part of our post collision examination scheme
• enable efficient reporting towards the single enforcement budget
• carry out hazchem compliance checks on lorries, drivers and disability access checks on buses including certification under International Carriage Of Dangerous Goods By Road (ADR)
• undertake bus and lorry testing which consists of statutory annual test administration and recording including maintenance of technical records and plating applications
• maintain examiner records contained within pocket books which are official accountable documents that are used to record the earliest record of enforcement matters, these are, and remain, official property and must be used at all times when on duty as they can be used as evidence in a court case
• maintain and administer a register of warrant cards, hazchem cards, ID cards, powers to stop accreditation cards and epaulettes so that we can verify that a DVSA officer is entitled to carry out activities associated with these cards
• manage the powers to stop scheme, and ensure our officers are suitable to be in the scheme
• pay for fixed penalty notices in the event of one or more offences being committed

4. What we do with it

We collect, use and store the data you give us for the reasons set out in this policy. Payment card details will not be stored.

We will not:

• sell or rent your data to third parties
• share your data with third parties for marketing purposes

We get your data from or share it with:

• Transport for London to support the low emission zones tests 
• DfT and Ministry of Defence for the inspection and certification of vehicles that carry dangerous goods by road 
• DfT to provide bus operator account management to the bus services operator grant
• Police forces in England and Wales and Police Scotland in relation to post collision examinations

We have access to:

• the registered keeper details and driver details within the Driver and Vehicle Licensing Agency (DVLA)’s vehicle services system and driver validation service for the purposes of enforcement activities
• driver details within DVLA’s tachonet application to verify the status of each digital tachograph driver card that has been presented to us at the roadside  
• the Home Office’s Police National Computer to review any relevant previous conviction history when we are to prosecute you for various offences relating to the operation of lorries and buses, operators and drivers

If we establish there is sufficient evidence that an offence has been committed, we may share your personal data with the Police and Crown Prosecution Service (CPS), and with the Traffic Commissioners.

If your vehicle has been impounded, your personal data will also be shared with our impounding and immobilisation contractor. The vehicle registration mark (number plate) and livery details will be published in the Edinburgh and London Gazettes.

Your personal data may also be shared with the Police and Law Enforcement Agencies when targeted joint stopping/inspections are planned.

We may be asked to comment on successful prosecutions but will not release any information which is not classed as a public record.

We will share your data if required to do so by law - for example, by court order, or to prevent fraud or other crime.

5. How long we keep your data

We’ll only keep your personal data for as long as it is needed for the reasons set out in this policy or as long as is required by law.

We will hold your personal data for:

• 7 years or 21 years if in relation to a fatal accident for data captured as part of roadside enforcement activities
• 21 years in relation to the post collision examination scheme
• 5 years in relation to records of encounters with vehicle operators in our mobile compliance system
• 5 years in relation to tachograph data
• 7 years in relation to application information or vehicle testing outcomes for data collected for Hazchem compliance checks on lorries
• such time DVSA is notified that a vehicle has been scrapped in relation to Electronic records collected for bus and lorry testing. The paper part is destroyed one month after the test, while plating applications are retained for 7 years.
• 5 years for data collected in pocket books
• 3 years in relation to data collected for Warrant card records and power to stop register

6. Where it might go

All enforcement data is stored on servers based in Ireland and the UK.

7. Protecting your data and your rights

The DVSA personal information charter sets out what steps are taken to protect your data, and the rights you have over your data.

8. Automated decision making and profiling

Your data is not subject to automated decision making or profiling as defined in data protection legislation.

9. Changes to this notice

We may change this privacy notice at our discretion at any time.

We encourage you to periodically review this privacy notice to be informed about how your data is protected.

When we change this notice, the date on the page will be updated. Any changes to this privacy notice will be applied to you and your data as of the revision date.

10. How to contact us

If you have any questions about anything in this document or if you consider that your personal data has been misused or mishandled you can contact the DVSA data protection manager.

DVSA data protection manager

Data Protection Manager
DVSA
1 Unity Square
Nottingham
NG2 1AY

Email information.handling@dvsa.gov.uk

Contact DVSA customer services if you have a query that is not about how your personal data is used.

You may also make a complaint to the Information Commissioner, who is an independent regulator.