Subject Access Request to DVSA

DVSA and the DVLA are different agencies and hold different records, which is the first thing to get right. DVSA runs the theory test, the driving test, approved driving instructor registration, MOT tester approval and roadside checks on lorries and buses. Your driving licence record, your penalty points, vehicle tax and vehicle registration belong to the DVLA, and that is a separate request route — see the DVLA page. DVSA says so itself: "There's a separate process to request information from the Driver and Vehicle Licensing Agency (DVLA), who deal with things like driving licences, vehicle tax and vehicle registration." What a request returns, in DVSA's own list: "data collected from online or paper forms, data collected from one of our services or reports, CCTV footage, images from a body-worn camera, voice recordings from contacting our Customer Service Centre". Examiners wear body-worn cameras and some test centres have CCTV. Ask early, because the clocks are short and they differ by record. DVSA keeps a driving test report for 5 years and a test booking for 7, but call recordings for 182 days and CCTV for 12 to 40 days depending on the site. Name the record and the date when you write. If you failed your test, the driving test report is the examiner's marking sheet and DVSA holds it for 5 years — but a request cannot change the outcome. DVSA's own page says "If DVSA agrees with your complaint, your test result cannot be changed but you might get a refund or a free retest." The timing matters more in Scotland than in England and Wales: an appeal to a court is 21 days in Scotland and 6 months in England and Wales, while DVSA's target for answering a request is one calendar month. A Scottish candidate who waits for the marking sheet before appealing will be out of time. MOT history does not need a request at all. Anyone can look up a vehicle's MOT results by registration number at GOV.UK's MOT history service, free and instantly. An approved driving instructor's file is larger than most people expect. It includes motoring and non-motoring convictions, a DBS reference, standards check history with dates and results, complaints from learner drivers and members of the public, and pass-rate and fault statistics from the candidates you present. DVSA keeps it for 10 years from last activity, and 15 years for scanned records. Instructors give their ADI reference number instead of photographic identification. DVSA publishes a second data protection contact at the same Nottingham building, and it is not the request route. information.handling@dvsa.gov.uk and the Data Protection Manager at 1 Unity Square are for complaining that your data has been mishandled. Requests go to the Public Liaison Team at the address above. Two limits worth knowing before you write. DVSA covers Great Britain. And you can ask on someone else's behalf only with proof of their permission — DVSA also says "We cannot respond to requests made by online portals unless we're able to verify your identity." The registration number on this page is the Department for Transport's. DVSA is an executive agency of the department and has none of its own; DVSA's charter says "The data controller for DVSA is DfT" and gives that number.

Made under UK GDPR Article 15, subject to the exemptions in Schedule 2 of the Data Protection Act 2018

Central government departments hold large, long-lived files, and requests to them are usually tied to a decision the person is challenging: an immigration application, a benefit decision, a tax assessment. Naming the decision, the date and any reference number substantially improves what comes back.

Departments also have exemptions available to them that most organisations do not. Part 1 of Schedule 2 of the Data Protection Act 2018 lets them restrict access where complying would be likely to prejudice the prevention or detection of crime, the apprehension or prosecution of offenders, or the assessment or collection of a tax or duty. HMRC relies on the last of these. Separately, an immigration exemption lets the Home Office restrict access where complying would be likely to prejudice effective immigration control. Both are limited to the extent of the prejudice — neither is a blanket refusal, and a department has to justify withholding rather than assert it.

The immigration exemption in particular has been narrowed by litigation. The Court of Appeal found it incompatible with the UK GDPR twice, in 2021 and again in December 2023, and it was amended after each judgment. Since the amendments in force on 8 March 2024 the Home Office must decide case by case, separately for each right, and afresh each time, must show a substantial risk that outweighs the risk to your interests, must record its reasons, and must tell you it has applied the exemption unless saying so would itself be prejudicial.

Departments run their own subject access routes rather than one central one, and several also publish a faster self-service channel that answers the same question for free. Using the wrong one is the most common cause of delay: a request sent to a general enquiry address gets rerouted, and a request for information already sitting in an online account gets refused as unnecessary.

• Immigration and visa application files
• Benefit claim records and decision notes
• Tax records and correspondence
• Records of a decision you are appealing
• Internal notes and assessments about you

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.