Flight schools in the EU/EEA process substantial personal data — training records, medical information, ID documents — and are fully subject to GDPR. Retention is complicated by aviation rules requiring records be kept for years, so schools need documented retention schedules and a compliant data processor setup.
Flight schools in the EU/EEA are full-scope GDPR data controllers: they process identity documents, medical information (special-category data), training performance records, financial data and often data on minors. The regulation's core duties all apply — lawful basis per processing purpose, transparency, data-subject rights (access, rectification, erasure), processor agreements with every vendor touching the data, breach notification within 72 hours, and documented retention schedules.
Aviation adds a genuine tension: EASA and national rules require training and organisational records to be kept for years (commonly three or more after course completion), which lawfully overrides erasure requests for those records during the mandated period — but only for the records the mandate actually covers. Marketing data, old CRM leads and CCTV enjoy no such shelter, and the school must be able to tell the categories apart.
Why it matters for flight schools
The practical exposure is concrete: a former student's erasure request is a legal clock, and 'we keep everything forever, it's aviation' is not a defensible answer — Datatilsynet and its peers expect purpose-mapped retention and evidence of deletion where no mandate applies. Vendor architecture matters equally: every platform holding student data needs a DPA, and where the data physically lives (EU versus US processing) is a question schools must be able to answer about their own toolchain. Getting this wrong now carries regulator attention and reputational cost in a market where students are increasingly privacy-aware.
How FlightLogger handles it
FlightLogger acts as data processor under a DPA, with structured retention supporting the aviation-mandated records — helping schools separate what must be kept, for how long, from what must be deletable on request.
Frequently asked questions
Can a former student demand deletion of their training records?
They can request it, but records the school is legally required to retain under aviation regulations are exempt from erasure for the mandated period — the school should explain the legal basis and the date the obligation lapses. Data outside the mandate, like marketing profiles, must be handled on normal GDPR terms.
How long should a flight school keep student data?
Per a documented, purpose-mapped retention schedule: aviation-mandated training records for the regulatory minimum (often 3+ years post-completion, longer under some national rules), other categories only as long as their purpose and legal basis justify — then deletion, demonstrably.