The route sheet QR: what the rules require of the code and the link

The QR code on the route sheet has to be inside the PDF itself and carry the unique web address of that document. That address has to start with “https://”, with TLS 1.2 or higher, and opening it has to download the PDF directly: no password, no page asking you to identify yourself and no download buttons. Moreover, the link cannot expire before the service ends.

These requirements are set by the resolution of the Spanish Directorate-General for Road and Rail Transport that regulates the electronic route sheet. Here they are one by one, with what they mean in practice and how they are met in Bus Center.

What the QR carries and where it goes

The QR carries the web address of the document, and it is printed inside the PDF. The resolution says (our own translation) that the generated files must include in the PDF itself a QR code with the unique, specific web address of the document. In addition, the QR can be made available as a separate file.

That code is what is shown at a check. When the inspectorate or the road transport enforcement officers ask for it, the driver presents the route sheet with the QR code or, failing that, just the QR code. That is why the copy the driver carries, on the mobile or on paper, has to contain the QR.

What the web address has to be like

Each PDF has its own address: each file stored in the repository will have a unique, specific web address. If you generate a new PDF to correct a detail, that PDF will have a new address and therefore a different QR.

The address will use a secure protocol under the TLS v1.2 standard or higher, so it must necessarily start with “https://”. How to build it is left freely to whoever generates the document, and it can carry security measures such as encryption, tokens or link expiry keys. The repository's domain can be anything and requires no prior notification.

Direct download: no passwords or buttons

When the address is opened, the PDF has to download without anyone touching anything else. The resolution requires that, for as long as the service lasts, the road transport enforcement officers can download the file, and that calling the address produces the direct download of the PDF.

And it closes the door on shortcuts: no address is valid that leads to a web page requiring credentials or authentication, or that includes download buttons or other elements implying manual interaction. Whatever security measures are put in place cannot limit that direct download.

In practice, this rules out links to a customer area, to a shared folder that asks you to log in or to a page with a “download” button. The officer scans the QR and has to get the PDF.

It is easy to test before it matters: scan the QR with a mobile where you are not logged in anywhere. If the PDF downloads without asking for anything, the link does what the rule requires.

How long the link has to work

The link has to work, at the very least, until the service ends. Security measures can include expiry keys, but guaranteeing in every case that the link does not expire before the service is finished.

After that there is some leeway: once seven calendar days have passed since the service ended, the download option for that address may be deactivated. It is a possibility, not a duty.

It must not be confused with retention. Deactivating the download is not deleting the file: the transport company has to keep the generated files for at least one year. We separate the two in how long to keep the route sheet.

A link without a password, with personal data

The route sheet carries the name and tax ID (NIF) of the driver and of whoever contracts the service, and the rule does not allow it to be protected by a password. The consequence is simple: whoever has the link can download the PDF. That is why it makes sense for the address to be impossible to guess or to run through by trying numbers, which is exactly what the resolution allows by admitting tokens in the link.

How to assess that data processing in your company is a matter for your data protection adviser. What is in your hands is not to hand the link out more than necessary: the driver needs it, and so does whoever has to read it on the road.

How Bus Center meets it

In Bus Center the route sheet is issued from the service itself: PDF with a QR code and a direct download link. The QR is inside the PDF, the direct download address does not ask for a password from whoever has to read it on the road, and the link carries a random code that cannot be guessed. The PDF does not exceed 5 MB.

The PDF is served as a static file and not through the program's process, a decision taken to reduce unavailability to a minimum. If you issue a new version, the new PDF has a new URL and QR and the earlier one is kept off the public address; if the service is cancelled, the PDF stops being served and is kept. The driver sees in their portal the same link as the one in the QR. More detail in the route sheet section (in Spanish) of the home page and in the electronic route sheet.

Sources consulted

Checked on 11 October 2026. We link to the original source so that you can consult the current text.

• Resolución de 5 de junio de 2026, de la Dirección General de Transporte por Carretera y Ferrocarril, por la que se establecen las características que deben reunir los sistemas y los documentos electrónicos de control administrativo exigidos en los transportes por carretera (texto consolidado). BOE.
• Orden FOM/1230/2013, de 31 de mayo, por la que se establecen normas de control en relación con los transportes públicos de viajeros por carretera (texto consolidado). BOE.