The short answer
DVLA keeps two records about you: a driver record and a vehicle record. It can pass both to a long list of other bodies, and it doesn't need your permission first. You can see what it holds for free, get mistakes fixed and complain if it gets things wrong. What you can't realistically do is stop the core sharing.
What may surprise you is the parking letter. A private parking company can get your name and address from the vehicle register. DVLA's own leaflet says plainly that it doesn't need to ask you. The law lets it release the details to anyone with "reasonable cause", and chasing a parking charge counts.
Want someone else's keeper details instead? That's a different route, covered in how to check who owns a car by its number plate.
Part of our guide to laws and fines.
What DVLA holds about you
DVLA's privacy policy, as updated on 30 October 2026, says it holds more than 53 million driver records and 48 million vehicle records. Two registers sit behind those numbers.
The driver register
DVLA's leaflet on releasing information, INF266, lists what the driver register holds. Your name, address, date of birth and photograph. What you're entitled to drive. Your endorsements, which are the penalty points and convictions recorded against your licence.
It also holds "relevant medical information that may affect a person's ability to drive". That's the medical detail you've reported, not your whole health record. If you've ever notified a condition, our guide to reporting a medical condition to DVLA covers that journey.
The driver register covers Great Britain only. Northern Ireland licences are run by the Driver & Vehicle Agency, and the gov.uk request page sends Northern Ireland drivers there.
The vehicle register
This one is UK-wide. For each vehicle it holds the registration number, the VIN (the vehicle identification number stamped on the car), the make and model, emissions and tax status. It also holds the registered keeper's name and address, and the dates the vehicle was acquired and disposed of. DVLA's retention annex adds that the record names previous keepers too.
The registered keeper is the person responsible for registering and taxing the vehicle. Not necessarily the owner, and not necessarily the driver.
Everything else
The policy also lists the smaller records DVLA builds about you. Your Driver and vehicles account, if you've opened one. Webchats and letters. Your contact details if you've asked about a Clean Air Zone charge, or bought a personalised registration.
Calls may be recorded and transcribed. On some calls the summary is written by artificial intelligence, then checked by an adviser before it's stored.
Why you have to give it
You can't withhold this data, because the law makes you provide it. The privacy policy puts it bluntly. "By law, drivers must provide their personal information to get a driving licence." And "by law, vehicle keepers must provide us with their details."
It's an offence not to register, tax or SORN a vehicle correctly. A SORN is a Statutory Off Road Notification, the declaration that a car is off the road. It's also an offence not to tell DVLA when your details change. For the address on your licence, gov.uk says the fine can be up to £1,000.
So this isn't consent. DVLA's stated legal basis is that it's performing a public task the law gives it. For licensing and registration it also cites a legal obligation.
There's no consent to withdraw. The only processing the policy lists as consent-based is a minor one: registering interest in a number plate sale.
Who else gets it
The policy says "where it is lawful to do so" DVLA may share your personal information with 18 kinds of organisation. Grouped, the list reads like this.
| Group | Who the policy names |
|---|---|
| Police and prosecution | Police and enforcement bodies, prosecution authorities |
| Courts | Courts, tribunals and parties to legal proceedings |
| Government | Other government departments, local government, other DfT agencies such as DVSA, foreign authorities under international agreements |
| Money | Debt collection, tracing and ID verification agencies, financial organisations |
| Motoring trade | Vehicle leasing and rental companies, private car parking management companies, insurance industries |
| Work | Current and prospective employers |
| Others | Suppliers, translation providers, survey and research organisations, industry regulators, "someone making a legitimate query or complaint" |
"May share" is the policy's own verb. It doesn't mean every group gets your data, or gets all of it.
Keeper details and reasonable cause
Regulation 27 of the Road Vehicles (Registration and Licensing) Regulations 2002 is the gateway. It lets DVLA release register details to police, councils and the Motor Insurers' Bureau, and to anyone who shows "reasonable cause" for wanting them. INF266 says reasonable cause "relates to motoring incidents with driver or keeper liability".
Parking is the everyday case. A private operator has to belong to an accredited trade association to get keeper details. Our guide on how to dispute a UK parking fine explains what that means for an appeal.
The fee is small. The KADOE spreadsheet, the published log of keeper-at-date-of-event enquiries, says the fee per enquiry is "currently set at £2.50". INF266 says the charge covers DVLA's cost and that it "does not profit at the expense of customers". That's DVLA's statement, not an audit.
Getting details under false pretences is an offence. DVLA says it releases them only for the stated purpose.
Debt collection and profiling
DVLA says it shares data with debt collection service providers. Those providers, in the policy's words, "may contact debtors using the postal addresses, telephone numbers and e-mail addresses which may relate to them, held by third parties". The next sentence, added on 3 August 2026, says: "To understand someone's ability to pay, debt collection service providers may carry out profiling of a debtor."
The policy points to DVLA's vehicle enforcement policy for more. That page says DVLA can use debt collection agencies to collect outstanding fines, such as an unpaid late licensing penalty for an untaxed car. It names the agencies and says they're regulated by the Financial Conduct Authority and contact you only by letter, text, phone or email.
Neither page says what DVLA actually hands over. Neither says whether the profiling is automated or what it feeds. Don't read it as DVLA selling your record to debt collectors, because the policy doesn't say that either.
Clean Air Zones
DVLA's role here is narrower than you might think. Its contact centre answers CAZ queries and takes payments on behalf of the Joint Air Quality Unit (JAQU). It may pass JAQU your registration number, name and email. It may also write to keepers of non-compliant vehicles before a zone starts, on behalf of a council or JAQU.
Nothing in the policy says DVLA shares camera data with councils. The only ANPR the policy mentions is DVLA's own, used to enforce vehicle tax and to spot plates displayed incorrectly.
Employers, hire firms and insurers
Employers and hire companies check your licence with your say-so. You create a check code through the gov.uk driving-licence service, and gov.uk says the code is valid for 21 days. INF266 says driver details go to such firms "with the driver's authorisation". The policy's list names employers without repeating that condition, so I've gone with the leaflet and the service page.
Insurers can get keeper details on reasonable cause. INF266 gives accident claims, fraud investigation and tracing uninsured drivers as the examples. The Motor Insurers' Bureau also sends insurance data to DVLA for continuous insurance enforcement.
Medical, fraud and abroad
Medical reports go to doctors and the Department for Transport's medical advisory panels only where you've authorised it. The policy adds a hard edge: "If you do not provide us with the required authorisation, you could lose your driving entitlement."
DVLA also shares with a fraud prevention agency, Cifas. If it detects a fraudulent application, the policy warns that a fraud marker "may result in others refusing to provide you with services, financing or employment."
Abroad, the policy names one agreement. Spain gets vehicle registration data for eight road-safety offences, from speeding to using a phone while driving. It doesn't list other countries.
Vehicle data without your name
DVLA also supplies bulk vehicle data to companies. INF266 says it "does not include keeper name and address details", and that it lets firms offer a checking service to used-car buyers. A car history check runs on vehicle data, not on who you are.
Our free car check is that kind of service. It shows a vehicle's current tax status and MOT history from the plate, but never a keeper's name.
DVLA publishes who asks
DVLA's "Who DVLA shares data with" page carries a quarterly spreadsheet naming every company and authority that has used the KADOE service, month by month, from April 2018. You can look a parking operator up by name.
Read the counts carefully. They're volumes of enquiries, not people, and the file says the same vehicle can appear more than once.
How long DVLA keeps it
Annex 1 of the privacy policy sets the periods. The core ones are long, and the annex states them plainly.
| Record | How long, per Annex 1 |
|---|---|
| Vehicle record, including current and previous keepers | The lifetime of the vehicle, then "made null and void" when DVLA is told it's scrapped or destroyed |
| Driver record | 120 years from date of birth. Cut to "the bare minimum" 3 months after a death notification |
| Endorsements | "Pruning after 4 or 11 years depending on the offence type" |
| Call recordings, webchats, and email enquiries or complaints | 6 months |
| Clean Air Zone enquiries | 90 days, then name and email only. CAZ complaints 7 years |
| Complaints referred to the Independent Complaints Assessor | 7 years |
One gap worth knowing. The annex gives no period for medical information, so I can't tell you how long that's kept.
What you can do about it
You have real rights to see, correct and complain. The right to stop the sharing is much weaker.
See it
This is a subject access request, or SAR. It's free. DVLA's request page covers your driver record, your current vehicle, and any vehicle that used to be registered in your name.
Four ways to send it, per the gov.uk page:
- email the form to SubjectAccess.Requests@dvla.gov.uk
- post it to Subject Access Request (SAR) Enquiries, DVLA, Swansea SA99 1BX
- email or post a letter with the information the form asks for
- apply by webchat or phone
For the driver record, include your full name, date of birth, current address, the address on your licence if different, and your 16-character licence number. For a vehicle, include your name, your address and the one on the V5C, the registration, the make and model, and what you want to know.
DVLA says it will respond within one month unless the request is complex. The ICO's guidance says an organisation may stop the clock while you clarify an unclear request, and can take up to two more months on a complex one. That guidance is marked as under review after the Data (Use and Access) Act 2025, so treat the extensions as a maximum rather than a promise.
The same Act added a limit. DVLA only has to carry out "a reasonable and proportionate search", not an unlimited one.
A SAR is about you, so it won't get you someone else's details.
On who has had yours, UK GDPR gives you a right to be told the recipients, or the categories of recipient, your data has gone to. DVLA's pages don't say which it gives. If you want names, say so in your request. The KADOE spreadsheet is the published route too, at volume level only.
The online driving-licence service shows a subset, such as your entitlements and penalty points. It's quicker, but it isn't everything DVLA holds.
Correct it
You can ask DVLA to correct inaccurate or incomplete data "without undue delay". For an address, the faster fix is the gov.uk change-of-address service, which also tells you to update the V5C and any Direct Debit. Our guide to keeping your V5C updated covers the vehicle side.
Object, or ask for erasure
The policy lists a right to object where processing rests on the public task. UK GDPR Article 21 then lets DVLA carry on if it shows "compelling legitimate grounds" that override yours. Erasure doesn't apply where processing is needed for a legal obligation or a public task. The policy says it won't apply where DVLA has a legal right or obligation to hold the data.
The policy also lists the right to object among the rights that "do not apply where processing is based on a legal obligation". For licensing and registration it cites a legal obligation. For releasing keeper details, including to parking firms, it names the public task instead. So DVLA doesn't need your permission, you can object to that release on grounds particular to you, and the law gives DVLA room to refuse.
Would I bother objecting to keeper-data release? Only if something specific to me made it dangerous, such as a safety risk at my address. For an ordinary parking dispute, I'd put the effort into the appeal instead.
Complain
Start with DVLA's complaints procedure, which has a data protection route. DVLA aims to reply in full within 10 working days, and then its Head of Complaints aims for another 10. That's DVLA's target. The legal duty, from 19 June 2026, is to acknowledge within 30 days and respond without undue delay.
Data protection complaints can't go to the Independent Complaints Assessor. The next step is the regulator, which the statute now calls the Information Commission. Online it still trades as the ICO.
The ICO says it recommends raising your concern with the organisation first. It says "recommends", not "must".
If your details were obtained wrongly
INF266 says DVLA will investigate every allegation that information was requested unlawfully, and may suspend a company's access. It gives an email, kadoeservice.support@dvla.gov.uk, and asks for the registration number and how the information was misused. That leaflet dates from March 2022, so if the address bounces, use the complaints procedure. DVLA also says it has "no authority to arbitrate" the underlying dispute.
If you got a letter because of this
Three common cases. A parking letter usually means your keeper record pointed at you on the date in question.
- A private parking charge. Follow the parking guide linked above.
- A debt collector's letter. If it's about a DVLA fine, DVLA's vehicle enforcement policy names the agencies it uses. Neither that policy nor the privacy policy says what DVLA passed on. A SAR to DVLA tells you what it holds. Asking the collector is a separate request to a separate company.
- A Clean Air Zone letter before a zone starts. That may be DVLA writing on the council's or JAQU's behalf. The charge itself is the council's.
If the letter is for a car you sold, the register still had you as keeper on that date. Fixing that is a V5C job, not a data protection one.
FAQs
What information does DVLA hold about me?
Two records. Your driver record holds your name, address, date of birth, photo, what you can drive, your penalty points and convictions, and any medical condition you've reported. Your vehicle record holds the car's details plus your name and address as keeper, with the dates you got and sold it. DVLA also keeps records of calls, webchats and letters, for periods set out in its retention annex.
Can I find out who DVLA has shared my details with?
Partly. A subject access request shows what DVLA holds, and the law gives you a right to be told the recipients, or the categories of recipient. If you want names, ask for them. DVLA also publishes a quarterly spreadsheet of every organisation that used its KADOE keeper-lookup service, by month. That tells you a parking firm has access, but not whether it looked up your car.
Does DVLA need my permission to give my address to a parking company?
No. DVLA's own leaflet says it doesn't need the keeper's consent because the law allows the release. The company has to show reasonable cause and belong to an accredited trade association. You can object on grounds specific to you, but DVLA can refuse if it shows compelling grounds.
How do I ask DVLA for a copy of my data, and what does it cost?
It's free. Email the form to SubjectAccess.Requests@dvla.gov.uk, post it to the SAR team at DVLA, Swansea SA99 1BX, or apply by webchat or phone. Give your full name, date of birth, address and licence number for your driver record. For a vehicle, give the registration, make and model, and the address on the V5C. DVLA says it will answer within a month unless the request is complex.
Who do I complain to if I think DVLA has misused my data?
DVLA first, through its complaints procedure, which has a data protection option. It aims to reply within 10 working days and must acknowledge within 30. If you're still unhappy, go to the Information Commission, still known as the ICO. The ICO recommends you try the organisation first. The Independent Complaints Assessor doesn't take data protection complaints.
Does DVLA share my data with debt collectors?
The policy says it shares data with debt collection providers. Those providers may contact debtors using contact details held by third parties, and may profile a debtor's ability to pay. The profiling line was added in August 2026. DVLA's vehicle enforcement policy says it uses debt collection agencies to collect outstanding fines, and names them. Neither page says what data DVLA passes. A subject access request is how you'd find out what it holds on you.