Dashcam data protection: writing a fleet camera policy that holds up

Dashcam data protection is now a routine part of fleet governance: a forward-facing camera records the public road, a driver-facing camera records an employee at work, and both produce footage that UK data protection law treats as personal data when people can be identified. Fleets fit cameras to resolve insurance disputes, coach safer driving and protect drivers from false claims, but each of those purposes has to be justified and documented before the cameras are switched on.

This guide sets out what the regulator’s guidance on video surveillance and on monitoring workers expects from employers, including the impact assessment, audio recording, retention, subject access and how to explain the system to drivers. It reflects the position as of November 2026, after the main data protection changes in the Data (Use and Access) Act 2025 took effect.

Who the regulator is and which guidance applies

The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025. According to the government’s commencement plans, last updated on 12 October 2026, most of the main data protection changes in Part 5 commenced on 5 February 2026, and the office of the Information Commissioner was abolished with its functions transferred to a new Information Commission on 30 September 2026. The commencement notes on Part 6 of the Act confirm those transfer provisions came into force on that date. Existing guidance from the regulator, still published at ico.org.uk, remains the practical reference.

Two pieces of guidance matter most for fleets. The video surveillance guidance covers CCTV, body worn video, ANPR and dashcams, although the regulator notes it is under review because of the 2025 Act. The guidance on monitoring workers applies whenever the camera records employees or contractors, including drivers in gig economy arrangements.

The DPIA comes before the cameras

The regulator’s guidance on complying with the data protection principles says a data protection impact assessment is a legal requirement for processing likely to result in a high risk, that this applies in most surveillance cases, and that it should be completed before deployment. Its list of processing likely to result in high risk includes tracking geolocation or behaviour, processing employees’ location data, data processing at the workplace and connected vehicles. A camera that also logs GPS position, speed and harsh braking events will usually hit several of those markers at once.

A useful fleet DPIA puts dashcam data protection into practical questions:

• What is each camera for: collision evidence, driver protection, coaching or investigation of complaints?
• Is a forward-facing camera enough, or is a driver-facing lens genuinely needed?
• Does the system record continuously or only around triggered events?
• Who can view footage, and under what approval?
• What lawful basis applies, and has a legitimate interests balancing test been written down?
• Can the camera be disabled during authorised private use of the vehicle?

The monitoring workers guidance adds that consent is rarely appropriate in employment because of the power imbalance, so most fleets rely on legitimate interests, and that where a high risk cannot be reduced the regulator must be consulted before monitoring starts. Our piece on deciding what telematics is for before building a dashboard makes the same point about purpose from an operational angle.

Audio, driver-facing cameras and covert use

Audio is the feature most likely to fail a proportionality test. The video surveillance guidance says audio recording, particularly if continuous, is more intrusive than video, needs much greater justification, and should be switched off by default, used only in exceptional circumstances such as via a trigger switch. If audio is used, people should be told clearly that sound is being recorded, in addition to any notice about video. The same guidance says continuous video or audio monitoring of particular individuals is likely to be justified only in the rarest circumstances.

For a cab-facing camera, that guidance points towards event-triggered recording with audio disabled, unless a specific risk such as assaults on drivers has been evidenced. The monitoring workers guidance treats covert monitoring as an exception for suspected criminal activity or gross misconduct, requiring senior management authorisation, a DPIA, a time limit and use only for the intended purpose.

Dashcam data protection in retention and access

Neither UK GDPR nor the Data Protection Act 2018 sets a fixed retention period for surveillance footage. The regulator’s guidance says the purpose should determine retention, the period should be the shortest needed for that purpose, and footage should not be kept because of storage capacity, manufacturer defaults or a feeling it might be useful later. In practice, a fleet might overwrite routine footage on a short cycle while extracting and keeping clips linked to a collision, claim or complaint for as long as that matter remains open.

Drivers and third parties can request their footage. The regulator’s right of access guidance says controllers should respond without delay and within one month, extendable by two further months for complex requests, normally without a fee. Section 78 of the 2025 Act confirms that a data subject is entitled only to what the controller can provide after a reasonable and proportionate search, treated as having applied from 1 January 2024. Footage that also shows other road users needs a decision about whether they can be obscured or disclosure is reasonable without their consent.

Telling drivers what is recorded

Transparency is the part of dashcam data protection that drivers see. The monitoring workers guidance says employers must tell workers about any monitoring, keep privacy information up to date and should seek and record workers’ or representatives’ views when planning it. For a camera policy, that means a short, specific notice in the vehicle and the handbook covering what each lens records, when it records, whether audio is captured, who can view footage, how long it is kept and how to ask for a copy. Workers should also be able to see and challenge monitoring results used in performance or disciplinary decisions.

Communication works best when it is built into existing processes, such as the induction and familiarisation covered in our article on driver familiarisation across the full shift. A camera introduced without explanation tends to be read as surveillance; one explained alongside its protective uses is more likely to be accepted.

Key points for fleet managers

• Treat dashcam data protection as a design decision: write down the purpose of each camera and complete a DPIA before installation.
• Prefer forward-facing and event-triggered recording; justify any driver-facing lens.
• Keep audio switched off unless an evidenced risk justifies it, and tell drivers when it is on.
• Set short default retention and extract only the clips needed for open incidents.
• Prepare a process for subject access requests that covers third parties in the footage.
• Brief drivers in plain terms and give them a route to see and challenge footage.

This article is general information, not tax, legal or financial advice.

Sources

• ICO: CCTV and video surveillance
• ICO: How can we comply with the data protection principles when using surveillance systems?
• ICO: Data protection and monitoring workers
• ICO: Examples of processing likely to result in high risk
• ICO: Right of access
• legislation.gov.uk: Data (Use and Access) Act 2025
• legislation.gov.uk: Data (Use and Access) Act 2025, section 78
• legislation.gov.uk: Data (Use and Access) Act 2025, Part 6
• GOV.UK: Data (Use and Access) Act 2025, plans for commencement

Sources checked in November 2026. Rules, rates and schemes can change after publication, so check the linked official pages before acting.