The DVLA will not tell you about a driver. It will tell the driver, and let them tell you.
A driving record is the driver’s personal data, and the DVLA releases it to an employer only where that driver has consented. The D906 is that consent. Everything else about licence checking depends on it existing, being valid, and not having quietly expired.
Signed on a phone, in about a minute.
1. Invitation
The driver gets a single-use link, sent to them or scanned from a QR code in person. There is nothing to install and no account for them to create.
2. Their own details
They confirm their name, date of birth and driving licence number. The driver checks their own data, which is also why it is right.
3. Signature
They sign on the phone screen and submit. No printer, no scanner, no post, no one chasing a piece of paper round a depot.
4. Three years
The mandate is stored against the driver and stands for three years. You are told before it runs out, not after a check has been refused.
The authorisation is charged once every three years at £1.00 — see the price list. Everything else follows from it: once a driver has authorised, checks run on whatever schedule you set without asking them again.
Why we keep the signed authorisation.
The DVLA requires anyone who checks a driving licence to keep the driver’s signed authorisation for two years from the enquiry. That is Schedule 4, clause 1.3 of the Access to Driver Data agreement — a contractual duty owed to the DVLA by every organisation checking licences, including yours.
The purpose of it is that any enquiry made can afterwards be shown to have been lawfully made. Which means the authorisation is not our paperwork, it is your evidence: proof that the checks you ran were authorised by the drivers you ran them on. It is the document that answers the question if anyone ever asks why you were looking at somebody’s driving record.
So we keep it, including after you stop being a customer. A provider willing to delete it on request would be leaving you without the one record that justifies the checks already made. It is the authorisations we retain and not your commercial data — your driver data leaves with you — and they expire on their own clock rather than being held indefinitely.
Note the two periods are different and do not run together. A mandate stays valid for three years, which is how long you can keep checking without asking the driver again. The retention duty is two years from the enquiry, so each check starts a clock of its own.
Still accepted, just no longer the normal way.
A paper D906 is still a valid mandate and there are drivers for whom it remains the practical answer — someone without a usable smartphone, or a depot where that is simply how things are done. The D906/ADD driving licence information fair processing declaration can be completed by hand and returned; ask us for a copy and we will send it over.
It is a fallback rather than the default, because the paper route is where the work actually went: printing, signing, scanning, filing, and then finding the document again three years later to discover it expired eight months ago.
The thing that changes with the digital version is not really the signing. It is that the expiry becomes something the system tracks instead of something a person is supposed to remember.
Understanding the D906 form goes through what the driver is actually consenting to, what happens if they refuse, and what expiry means for checks already run.