Guidance

Motorcycle training and instructor: privacy notice

Updated 2 December 2024

1. About this service

The Driver and Vehicle Standards Agency (DVSA) is responsible for the regulation and administration of regulated motorcycle training courses, compulsory basic training (CBT), the direct access scheme (DAS), and the voluntary enhanced rider scheme (ERS). DVSA provides this service to administer the register of certified motorcycle instructors and the register of ERS instructors. DVSA is an executive agency of the Department for Transport (DfT).

We carry out checks against Driver and Vehicle Licensing Agency (DVLA) databases to verify details of riding entitlements and endorsements. This service lets you show that you are appropriately qualified and a fit and proper person to carry out motorcycle and moped training as a certified motorcycle instructor, ERS instructor and/or the approved training body (ATB) authority holder.

The data controller for DVSA is DfT – a data controller determines the reasons and how personal data is processed. For more information, see the Information Commissioner’s Office (ICO) Data Protection Public Register. DfT’s registration number is Z7122992.

2. What data we need

The personal data we collect from ATBs will include:

• trading name
• ATB registration number
• registered and correspondence addresses, email address or addresses and telephone number(s)
• authority holder’s name, address, telephone number and email address
• certified instructor names, certificate numbers and certificate expiry dates
• approved training site address or addresses and authorisation documents including photographs of the site
• details of instructor standards checks including dates, results and follow up correspondence
• details of ATB compliance checks including dates, results and follow up correspondence
• details of CBT and ERS training certificates and returns issued to trainees training incident reports
• complaints and follow up correspondence

The personal data we collect from CBT, DAS and ERS instructors include:

• name, address, telephone number and email address
• driving licence number
• date of birth
• details of convictions
• details of driving licence endorsements and disqualifications
• court proceedings
• driving licence medical restrictions
• assessment attendance dates
• details of standards’ checks including dates, results and follow up correspondence ATB details
• signed photograph
• details of ERS theory test, instructor qualification(s) and advanced riding qualifications – for ERS instructors

The personal data we collect from CBT, DAS and ERS trainees include:

• name
• certificate number
• date of training
• driving licence number

The personal data we collect from the person reporting a training incident reports will include:

• name
• job role or name of employer
• business address and phone number

The personal data we collect from the instructor and trainee about the incident will include:

• name
• certificate number
• ATB number
• date and time of incident
• location of incident
• description of incident
• activity taking place at the time – CBT, DAS, ERS or other
• estimated speed of trainee’s motorcycle at time of incident
• ratio of trainees to instructors at incident of location and whether instructor was in radio contact with trainee and which communication took place between instructor and trainee before the incident
• which trainee was injured
• weather and surface conditions at time of incident
• persons involved in incident
• description of injuries or suspected injuries
• gender of trainee
• whether ambulance was called and if any persons were taken for medical attention
• whether we reported it to the Health and Safety Executive
• type of helmet in use
• training start times and planned finish times
• time of last refreshment break before the incident
• activity at time of incident

The personal data we collect about any witnesses includes:

• name
• contact number
• address

The personal data we collect about any police officers who attended the incident includes:

• name
• contact details
• any action taken, including crime reference number

The lawful basis for processing this data is public task.

Our legal powers are contained within:

• The Motor Vehicles (driving licences) regulations 1999 (as amended), part V details Approved Training Courses for Riders of Motor Bicycles and Mopeds. Regulation 58(3) deals with authorisation of those conducting courses, regulation 60 deals with certified instructors and regulation 62 allows for withdrawal of authorisation to provide training courses or to act as an instructor
• The Road Traffic Act section 97(3)(e)

The lawful basis for processing data for the “find your nearest” service is consent, as you do not have to include your details in this service. The data need for the “find your nearest” service are:

• ATB name
• ATB contact details including address, phone number and email
• the instructor’s name is also required (for ERS)

3. Why we need it

We need the personal data we collect from you to:

• conduct assessments and administer the register of CBT, DAS and ERS
• carry out checks of riding entitlements and endorsements
• administer the schemes for CBT, DAS & ERS pupils
• investigate incidents reported to DVSA which have happened during CBT, DAS or ERS training
• add your business details to the “find your nearest” service, where consent has been given

4. What we do with it

We collect, use and store the data you give us for the reasons set out in this policy.

We may share incident details with:

• the Health and Safety Executive where you’re involved in an incident which meets the criteria for reporting to them – we have a duty to do this under the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013
• solicitors in response to a civil or injury claim
• the police where it’s part of an investigation and it’s an on-road incident

5. Trainers

We shall share your instructor personal data with your ATB.

We will tell DVLA when you become an instructor. They will then inform us if you are given any motoring convictions. This is because being an instructor is considered as a ‘notifiable occupation’ for motoring convictions. We scan paper forms about your registration. The digital scans are then stored by an external company called Iron Mountain. Your data will appear on the ‘find your nearest service’ where you have given your consent. You can manage your consent, including withdrawing it, by writing to cbt@dvsa.gov.uk. Please note, it may take up to 21 days to update your data. Should your ATB close then we shall remove your information from the ‘find your nearest’ service.

6. Trainees

We will share the trainee data collected on CBT certificates and returns with DVLA so they can update your driving licence.

We will not:

• sell or rent your data to third parties
• share your data with third parties for marketing purposes

We will share your data if required to do so by law – for example, by court order, or to prevent fraud or other crime.

7. How long we keep your data

We’ll only keep your personal data for as long as it is needed for the reasons set out in this policy or as long as is required by law.

We will hold your personal data for:

• 2 years for paper records relating to CBT and DAS (including copies of CBT certificates)
• 3 years for electronic records of CBT certificate returns plus another 2 years for anonymised data
• 2 years for complaint records
• 5 years after the last recorded activity for paper records relating to ERS
• 10 years after the last recorded activity for electronic data held on live systems
• 4 years for health and safety incident reports and records
• 15 years for data held in archive systems with Iron Mountain

8. Where it might go

Our IT infrastructure and technology has been checked to make sure it’s safe and secure.

All your data is held on DVSA servers based in the UK or hosted within cloud services based in the European Economic Area (EEA). They meet security safeguards equivalent to those required by data protection legislation.

9. Protecting your data and your rights

The DVSA personal information charter sets out what steps are taken to protect your data, and the rights you have over your data.

10. Automated decision making and profiling

Your data is not subject to automated decision making or profiling as defined in data protection legislation.

11. Changes to this notice

We may change this privacy notice at its discretion at any time.

When we change this notice, the date on the page will be updated. Any changes to this privacy notice will be applied to you and your data as of the revision date.

We encourage you to periodically review this privacy notice to be informed about how your data is protected.

12. How to contact us

If you have any questions about anything in this document or if you consider that your personal data has been misused or mishandled, you can contact the DVSA data protection manager

DVSA data protection manager

Data Protection Manager
DVSA
1 Unity Square
Nottingham
NG2 1AY

Email information.handling@dvsa.gov.uk

Contact DVSA customer services if you have a query that is not about how your personal data is used.

You may also make a complaint to the Information Commissioner, who is an independent regulator.