Definition
A flight school processes more sensitive personal data than its size suggests: identity documents, addresses and contact details, medical certificate status, training records and assessments, flight and duty records, payment details, and sometimes background or security-vetting results.
Four points do most of the work in applying the regulation to that.
**Lawful basis is mostly not consent.** Schools reach for consent because it feels safest, and it is generally the wrong basis for data they must hold anyway. Retaining training records to satisfy a regulatory obligation rests on the legal-obligation basis; delivering the course a student enrolled on rests on contract. Basing either on consent creates a right to withdraw that the school cannot honour, because it still has to keep the records. Consent belongs to the genuinely optional processing — marketing, most obviously.
**Special-category data needs an additional condition.** Health data — which is what a medical certificate and any associated limitation is — is not processed under the ordinary Article 6 basis alone; it requires a condition under Article 9 as well. Most schools should be holding the fact of a valid medical and its expiry rather than accumulating medical detail they have no need for.
**Retention is set by aviation rules, not by preference.** Record-keeping obligations for training records and personnel files are prescribed, and the storage-limitation principle asks that data not be kept longer than necessary — the aviation requirement usually *is* the necessity, which makes the retention schedule a matter of reading the regulation rather than of choosing. What does need a decision is the data outside that scope: enquiry records, marketing lists, CCTV, and the accounts of students who never enrolled.
**Data-subject rights are real but bounded.** Access and rectification apply straightforwardly. Erasure does not override a legal retention obligation, so a request to delete training records generally cannot be honoured while the obligation runs — but the school has to be able to explain which data it keeps and why, which it can only do with a retention schedule it has actually written.
Two practical points complete the picture. A school using a software provider is a **controller** and the provider a **processor**, and the relationship needs a written processing agreement. Transfers of personal data outside the EEA — a common consequence of cloud services or of sponsoring airlines abroad — need their own transfer mechanism.
Why It Matters for Flight Schools
For a school, the highest-value single artefact is a written retention schedule: what is held, on what basis, for how long, and what happens at the end. Most GDPR difficulty for schools is not a failure to protect data but an inability to explain what they hold and why.
The second is minimisation on medical data, because it is the category with the sharpest consequences. A school that files complete medical documentation when it needs only validity and expiry has taken on special-category exposure it had no need for.
The third is access control. Instructors, office staff, maintenance and management need very different views of a student record, and a system where everyone can see everything is both a security risk and a difficult thing to defend to a supervisory authority.
This entry describes the shape of the obligations rather than providing legal advice; a school's own counsel or data protection officer should confirm how they apply to it.
How Aviatize Handles This
Aviatize supports the practical side of this. Document management holds student and staff documents in separate libraries with upload, staff approval and expiry tracking — which is what lets a school record that a medical is valid and when it lapses rather than accumulating medical detail it has no need to hold. Access is role-based, so instructors, office staff and management see the parts of a record their role requires.
Two-factor authentication is available and can be enforced across an organisation, and a detailed activity log records what happened in the account, which is the evidence a school needs when it has to account for access to personal data. Advanced CSV export covers substantially the whole system and a REST API is available, so responding to an access request, or moving data out entirely, does not depend on the vendor's goodwill. The controller responsibilities — lawful basis, retention schedule, processing agreements and transfer mechanisms — remain the school's own.
Frequently Asked Questions
- Does GDPR apply to flight schools?
- Yes, wherever a school processes personal data about people in the EU or EEA, which covers students, instructors and staff. Flight schools handle an unusually sensitive mix — identity documents, medical status, training assessments and flight records — so the obligations bite harder than the size of the organisation suggests.
- Is consent the right lawful basis for student training records?
- Usually not. Records a school must retain to satisfy an aviation regulatory obligation rest on the legal-obligation basis, and delivering the enrolled course rests on contract. Using consent creates a right to withdraw the school cannot honour, since it must keep the records regardless. Consent belongs to genuinely optional processing such as marketing.
- How should a flight school handle medical certificate data?
- As little of it as possible. Health data is special-category and needs a condition under Article 9 in addition to an ordinary lawful basis. Most schools need only the fact of a valid medical and its expiry date to make scheduling and compliance decisions; retaining fuller medical documentation takes on exposure with no operational benefit.
- Can a student ask a flight school to delete their training records?
- They can ask, but erasure does not override a legal retention obligation. While an aviation record-keeping requirement runs, the school generally cannot delete the records — though it must be able to explain what it retains and why, and delete anything outside that scope. That explanation depends on having a written retention schedule.