Student Safety and Online Booking: What the Industry Needs to Fix

How safe is your data when you book driving lessons online? We look at what platforms should be doing, what we do at PassReady, and where the government could help.

When a learner driver books a lesson online, they hand over personal data. Their name, phone number, email address, home postcode, sometimes their driving licence number. They trust that the platform they're using keeps that data safe.

But how much thought has actually gone into that? How many driving instructor platforms encrypt data on the device? How many use proper certificate pinning? How many have had a security audit in the last year?

We built PassReady from scratch in 2026. Security wasn't an afterthought bolted on at the end. It was designed in from day one. But beyond what we do, there are things the wider industry and the government could be doing better.

What a booking platform should be doing (at minimum)

If a platform handles student data and takes payments, these should be non-negotiable:

• Encrypted connections everywhere. Every request between the app and the server should be over HTTPS with TLS 1.3. No exceptions. No fallback to unencrypted connections.
• No API keys in the app. Sensitive credentials should never be hardcoded into a mobile app. Anyone with basic tools can extract them in minutes. Server-side secrets stay on the server.
• No data stored unencrypted on the device. If a phone is lost or stolen, student data shouldn't be sitting there in plain text.
• Proper email authentication. DKIM, SPF, and DMARC should be configured correctly so that emails from the platform can't be spoofed. If a student gets an email that looks like it's from their instructor but isn't, that's a phishing risk.
• Payment data handled by a certified processor. No platform should be touching card numbers directly. PCI-compliant processors like Stripe exist for a reason.
• Access controls and security rules. A student should never be able to see another student's data. An instructor should never be able to see another instructor's students. This sounds obvious but it requires deliberate engineering.

What we do at PassReady

We also published a student safety guide with practical advice for learner drivers on how to verify their instructor is qualified, what to check before their first lesson, and how payments work.

Where the government could help

There are some straightforward things that would make the industry safer for everyone.

1. A public API for ADI verification

The DVSA maintains a register of Approved Driving Instructors. But there's no API to check it programmatically. The only options are a web form (which not all instructors are listed on, because it's voluntary) or phoning the DVSA directly.

If the DVSA published a simple API that returned whether an ADI badge number is valid and current, every booking platform could verify instructors automatically at sign-up. Students would know for certain that the person teaching them is qualified. Fake instructors would be caught immediately instead of relying on students to manually check a website.

The data already exists. It just isn't accessible.

2. Mandatory listing on the ADI register

Currently, ADIs choose whether or not to appear on the DVSA's Find an Instructor database. This means a student searching for a local instructor might not find a perfectly legitimate ADI simply because they didn't opt in.

If listing were mandatory (with the option to hide contact details for privacy), the register would be complete and reliable. Platforms could cross-reference against it. Students could trust that if someone isn't on the list, there's a reason.

3. DBS Update Service by default for ADIs

Driving instructors are required to have a DBS check. But subscribing to the DBS Update Service (which allows ongoing verification) is optional and costs £13 per year. Many instructors don't bother.

Without the Update Service, a DBS certificate is a snapshot from one moment in time. There's no way to check whether anything has changed since it was issued. If the Update Service were included as part of ADI registration, employers, schools, and platforms could verify DBS status continuously rather than relying on a piece of paper that might be years old.

4. Security standards for booking platforms

There are currently no minimum security requirements for platforms that handle driving instructor and student data. Any developer can build an app, collect personal data (including driving licence numbers and addresses), and there's no obligation to meet any particular security standard beyond the general requirements of UK GDPR.

A set of industry-specific guidelines — even voluntary ones — would give instructors and students a way to assess whether the platform they're using takes data protection seriously. Something as simple as a checklist: does it encrypt data at rest? Does it use a certified payment processor? Has it had an independent security review?

This matters more than people think

Driving instruction involves sensitive personal data. Home addresses. Phone numbers. Driving licence numbers. The pickup locations of 17-year-olds. The schedules of people who work alone in a car with strangers.

The industry deserves better tooling, and the people using it deserve to know their data is handled properly. We've tried to set a standard with PassReady. We'd like to see the rest of the industry — and the government — raise theirs.