GDPR and driving licence checks at the rental counter

Yes, your agency can and must check the driving licence of whoever drives the car away, but checking is not the same as keeping a photocopy. The RGPD, the Spanish version of the GDPR, and its national implementing law, the LOPDGDD, let you verify that a licence is valid and record the details you genuinely need to perform the contract; keeping a full image of the document needs its own justification, a defined retention period and an explanation you can defend before the AEPD, the Spanish data protection authority.

The gap between a calm counter and an uncomfortable file is almost never about technology. It comes down to two decisions: which fields you store and for how long. We will take those two field by field, then turn to foreign and digital licences and to refusing a rental.

Verifying is not keeping a copy

The operational duty is plain: you cannot hand a vehicle to someone who is not entitled to drive it. That is why you look at the document, confirm it is in force, confirm the category covers the vehicle and confirm the person in front of you is the holder. Done attentively, that visual check is the heart of the control, and on its own it creates no file for you to guard.

The trouble starts at the next step, when the licence goes through a scanner or a phone camera and the image ends up in an inbox, a shared folder or a chat. At that point you have created a processing operation you must be able to explain: what it is for, who can see it, where it lives and when it disappears. The AEPD has consistently pointed out that a full copy of an identity document is disproportionate when verifying a few specific details would do, and the same reasoning carries over to the driving licence. This is living guidance: review the AEPD's current material before you fix your procedure.

Which licence details you actually need

A driving licence carries far more information than a rental agency uses. The test is simple: if a field does not appear in the contract, plays no part in the verification and would not be needed to answer an authority, it has no business in your system either.

• Full name as it appears on the document: this identifies the party to the contract.
• Licence number and issuing authority: these let you trace the check if anyone questions it later.
• Authorised categories and expiry date: these are the entitlement check itself.
• Licence seniority, if your terms require a minimum: without it you cannot apply your own condition.
• The photograph, the signature and the codes on the back rarely serve any purpose of their own in a rental: look at them at the counter and leave them on the document.

Lawful basis and retention, field by field

The table is a starting point for your record of processing activities, not a legal opinion. The actual periods depend on your accounting and tax obligations and on how long your potential claims stay alive; the authority that will tell you whether your version holds up is the AEPD, with help from your adviser.

Two cautions about the last rows. If you do capture the image, the legitimate interest balancing test has to be written before the first scan, not improvised when someone asks. And deletion has to be automatic: a deletion that depends on somebody remembering is not a retention period, it is an intention.

Foreign licences, international permits and the digital licence

This is where independent agencies improvise most and, oddly enough, where the RGPD gets in the way least: checking a foreign document does not change the lawful basis, only how hard the check is.

• Licences issued in the European Union and the European Economic Area: valid as they are. Watch the expiry date and the category, which are not always written the Spanish way.
• Licences from outside that area: the international driving permit is a supporting multilingual document that travels with the original and never replaces it. Ask for both.
• The digital licence in the DGT app: it works for a holder resident in Spain, but confirm its reach outside the country on the DGT website before you accept it as the only document.
• Automated checks against DGT records: the lawful basis for this has been examined by the AEPD. If a supplier offers it, ask in writing which lawful basis applies and what is retained.
• Write your policy down and apply it the same way in high season and in November: consistency is what holds up if someone complains.

When the licence does not add up: refusing without discriminating

You may refuse a rental. What you may not do is refuse because of how the person in front of you strikes you. The difference lies in the criterion: objective, written down and applied to everyone.

1. 1Set out the grounds for refusal in your terms: expired document, insufficient category, seniority below your minimum, a document you cannot verify.
2. 2Run the same check on every customer, in the same order, regardless of origin, language or appearance.
3. 3If the document leaves you unsure, ask for a second identity document and cross-check the details before deciding.
4. 4Explain the refusal by the specific fact, and record that fact in writing rather than your impression.
5. 5Where there are signs of forgery, the matter belongs with the competent authority, not with an argument at the counter.

Inside the counter: routines that save you trouble

The boring part is the part that decides a case file, and none of these routines costs money: they cost writing them down once.

• A privacy notice visible at the counter and in the contract: what you process, what for, and where to go to exercise rights.
• A current record of processing activities, with its own entry for driver verification.
• A processor agreement with any software that stores customer data, including your accountant's.
• No documents in personal chats or in the phone's camera roll: one place only, with per-person access and scheduled deletion.

What counter technology can contribute

An orderly back-office helps, because most breaches come not from bad faith but from scattered data. DRIVO is a European marketplace where independent agencies and private owners list their vehicles; its back-office brings bookings, calendar and fleet management together in one place, with verified profiles and reviews, multilingual listings in five languages and automatic Stripe payouts. Listing your fleet costs 0 €, with no monthly fee, and commission is charged only on completed bookings, so an empty week costs nothing. None of that relieves you of your role as controller, and the guidance still sits with the AEPD and in the BOE, the official state gazette, not in a tool.