When a learner driver books a lesson online, they hand over personal data. Their name, phone number, email address, home postcode, sometimes their driving licence number. They trust that the platform they're using keeps that data safe.
But how much thought has actually gone into that? How many driving instructor platforms encrypt data on the device? How many use proper certificate pinning? How many have had a security audit in the last year?
We built PassReady from scratch in 2026. Security wasn't an afterthought bolted on at the end. It was designed in from day one. But beyond what we do, there are things the wider industry and the government could be doing better.
If a platform handles student data and takes payments, these should be non-negotiable:
We also published a student safety guide with practical advice for learner drivers on how to verify their instructor is qualified, what to check before their first lesson, and how payments work.
There are some straightforward things that would make the industry safer for everyone.
The DVSA maintains a register of Approved Driving Instructors. But there's no API to check it programmatically. The only options are a web form (which not all instructors are listed on, because it's voluntary) or phoning the DVSA directly.
If the DVSA published a simple API that returned whether an ADI badge number is valid and current, every booking platform could verify instructors automatically at sign-up. Students would know for certain that the person teaching them is qualified. Fake instructors would be caught immediately instead of relying on students to manually check a website.
The data already exists. It just isn't accessible.
Currently, ADIs choose whether or not to appear on the DVSA's Find an Instructor database. This means a student searching for a local instructor might not find a perfectly legitimate ADI simply because they didn't opt in.
If listing were mandatory (with the option to hide contact details for privacy), the register would be complete and reliable. Platforms could cross-reference against it. Students could trust that if someone isn't on the list, there's a reason.
Driving instructors are required to have a DBS check. But subscribing to the DBS Update Service (which allows ongoing verification) is optional and costs £13 per year. Many instructors don't bother.
Without the Update Service, a DBS certificate is a snapshot from one moment in time. There's no way to check whether anything has changed since it was issued. If the Update Service were included as part of ADI registration, employers, schools, and platforms could verify DBS status continuously rather than relying on a piece of paper that might be years old.
There are currently no minimum security requirements for platforms that handle driving instructor and student data. Any developer can build an app, collect personal data (including driving licence numbers and addresses), and there's no obligation to meet any particular security standard beyond the general requirements of UK GDPR.
A set of industry-specific guidelines — even voluntary ones — would give instructors and students a way to assess whether the platform they're using takes data protection seriously. Something as simple as a checklist: does it encrypt data at rest? Does it use a certified payment processor? Has it had an independent security review?
Driving instruction involves sensitive personal data. Home addresses. Phone numbers. Driving licence numbers. The pickup locations of 17-year-olds. The schedules of people who work alone in a car with strangers.
The industry deserves better tooling, and the people using it deserve to know their data is handled properly. We've tried to set a standard with PassReady. We'd like to see the rest of the industry — and the government — raise theirs.
PassReady is a free-to-use booking platform for UK driving instructors and schools. Every instructor is verified. Every payment is encrypted. Every student's data is protected. Learn more at passready.co.uk