DSA, as an executive agency of the Department for Transport (DfT), is a data controller as defined by the Data Protection Act 1998. Listed below are the key services for which DSA processes personal data, with information about how and why that data is processed.

Test booking services

Personal data is used to:

• confirm identity and entitlement, book and provide tests and results, and create statistical management information (including analysis and research to improve road safety and customer service).
• process payment details, which are submitted via a secure server using industry standard encryption.
• Inform the Driver and Vehicle Licensing Agency – DVLA (another executive agency of the Department for Transport) of test passes to ensure the lawful issue of driving licences.
• maintain the integrity of the driving test. We may use personal data for the purposes of preventing or detecting crime and catching or prosecuting offenders. This may include hidden monitoring when appropriate.

For the purpose of administering and conducting a variety of Driver Theory Tests, Pearson Driving Assessments Limited (Pearson) act as DSA’s data processors and are authorised to collect and process personal information on DSA’s behalf. Personal data is processed by Pearson in both the United Kingdom and United States of America. For the USA processing, compliance with the requirements of the UK Data Protection Act 1998 is established via the US Department of Commerce’s ‘safe harbor’ framework.

• Safe harbor

No further disclosures shall be made by DSA other than in accordance with the law, to comply with legal obligations and in accordance with the Data Protection Act 1998.

Register of approved driving instructors (ADIs)

Personal data is used to:

• help administer the Register of ADIs and practical driving test
• provide statistical analysis to assess equality and improve our customer service
• maintain the integrity of the driving test. We may use personal data for the purposes of preventing or detecting crime and catching or prosecuting offenders. This may include hidden monitoring when appropriate.
• check the continued fitness of ADIs to remain on the register
• DSA does not disclose or share personal data with any third parties other than in line with the Data Protection Act 1998. This may include, but is not restricted to, disclosure to the police, HM Revenue and Customs, local governments and DVLA. In the case of transfers from DVLA, this may include details of endorsements for the purpose of ensuring that registered ADIs continue to be fit to remain on the register.

In order to ensure that Potential Driving Instructors (PDIs) and ADIs are fit to be entered onto/remain on the register, DSA uses the services of the Criminal Records Bureau to obtain criminal record disclosures for individuals normally resident in England and Wales, and of Disclosure Scotland for individuals normally resident in Scotland.

Driver certificate of professional competence (Driver CPC)

Personal data is used to:

• record the periodic training that is necessary to qualify for the Driver CPC and for the issue of a Driver Qualification Card (DQC). Both of these functions enable professional bus and lorry drivers to comply with EU legislation.
• confirm entitlement to relevant enforcement bodies, including the police and the Vehicle and Operator Services Agency —VOSA (another agency of the Department for Transport).
• inform the DVLA so that they can include the Driver CPC qualification information (but not training information) on the driver’s record.
• determine, via the police or other enforcement bodies, a driver’s entitlement to hold a Driver CPC in relation to a particular vehicle category.
• maintain the integrity of the Driver CPC and issue of DQC systems. Data may be used by the DSA Fraud and Integrity Team as part of investigations into fraudulent/criminal activities and may be used as evidence for prosecuting offenders.
• data collected will not be shared with any third parties other than for the statutory duties listed above.

The data collected will also be used by bodies working on DSA’s behalf, for example, to produce DQC cards, or to provide management information to the Joint Approvals Unit for Periodic Training (JAUPT).

Driver trainers

Personal data is used to:

• administer the Integrated Register of Driver Trainers and other driver training registers
• administer the practical driving test
• provide statistical analysis to assess equality and improve customer service.

Formal consultations and feedback forms

Any personal data provided to DSA in order to take part in a consultation will be processed by DSA for the purpose of administering the consultation. Formal responses to consultations will be retained and used to inform future policy. Further guidance is provided to individuals as part of each consultation.

Surveys

DSA may contact you to ask you how satisfied you were with the service you received from us or one of our service providers. This contact may be by email, telephone or post. Your participation is not compulsory and your response will be anonymised before it is collated to provide management data for the agency. Where the survey relates to one of our service providers, we will not disclose information to them that would allow you to be identified.