Dashcam policy for a fleet

Dashcams film the road, other road users and, where the camera faces inward, the driver, and a business that fits them to its vehicles is a controller of all of it: the footage of the public, the recordings of its own staff at work, and the telematics that go with them. The policy has to state the purposes, record the assessment, tell the drivers what is recorded and why, draw the line on audio and in-cab recording that the regulator's guidance on monitoring workers draws, set the retention and the handling of footage after an incident, and cover the insurers, the police and the drivers who ask for their own footage. I draft the dashcam policy with the privacy notice and the cookie notice for the business for a fixed fee of £595, delivered in five working days, with guidance on the notices in the vehicles.

Who this is for

Delivery and logistics businesses, trades with vans, taxi and private hire operators, coach and bus companies, and any business in England and Wales with cameras in its vehicles.

What matters in a dashcam policy

Forward-facing, driver-facing and the data each one collects

A forward-facing camera records other road users, pedestrians, number plates and the vehicle's location and speed, which is personal data about members of the public the business films without their knowledge; a driver-facing camera records the business's own staff at work, continuously, which is workplace monitoring; and both may record audio; the policy should say which the business fits, what each records, and that the business is the controller under Article 13 of the UK GDPR for all of it, with a notice in the vehicle (a sticker visible to other road users and passengers) and the staff privacy notice covering the drivers.

The purposes, the assessment and the drivers who must be told

The policy should state the purposes (evidence in collisions and insurance claims, driver and public safety, the detection of fraud such as staged accidents, the investigation of complaints) and the lawful basis (legitimate interests under Article 6(1)(f) of the UK GDPR, with the balance against road users and drivers recorded), should record the data protection impact assessment under Article 35 that continuous monitoring of workers and filming of the public requires, and should say that drivers were consulted and told before the cameras were switched on, because the Information Commissioner's guidance on monitoring workers expects both and a driver who learns of the camera from a disciplinary hearing has a grievance the policy should have prevented.

Audio, in-cab cameras and the line the regulator draws

Audio recording in the cab captures drivers' private conversations and calls and is more intrusive than video, and the regulator's position is that it should be off unless a specific justification is recorded (and switched off when the vehicle is used for permitted private journeys); driver-facing cameras that record continuously, use fatigue or distraction detection, or analyse the driver's face process data about the driver's behaviour and, where they infer health, special category data under Article 9 of the UK GDPR, and the policy should justify them by the safety risk of the operation, limit the recording to what the safety purpose needs, say that footage is not used for routine performance management, and give drivers a way to raise concerns; a fleet of vans fitted with inward-facing audio-recording cameras for no stated reason is the case the regulator writes about.

Retention, access and the footage after an incident

The policy should set the retention (the camera's loop overwrites continuously, with footage preserved only when an incident is flagged automatically or by the driver, and the preserved footage retained for the period the insurance claim or investigation needs and then deleted), the roles that may access the cloud platform or the memory cards, the log of viewing and export, the security of the platform and its account, and the procedure after an incident (the driver reports, the footage is preserved and copied by a named person, the original is logged); footage the business has promised to keep for a stated period and has lost is a problem in the claim, and the policy should match the system's actual behaviour.

Insurers, the police and the drivers' own requests

The policy should provide for footage to be given to the business's insurer for a claim (the incident only), to the police on a written request for the investigation of an offence under the crime exemption in Schedule 2 to the Data Protection Act 2018 (recorded and reviewed), to the other party's insurer or solicitor where the business chooses or is required to disclose, and to a driver who makes a subject access request under Article 15 of the UK GDPR for the footage of themselves (within one month, with other people obscured where possible), while refusing requests from members of the public for footage of other people unless a lawful route applies; the driver who wants the footage that clears them is the request the policy should handle without delay.

Telematics, trackers and the rest of the vehicle's data

Dashcams usually come with telematics (location, speed, braking, driving style scores, hours) that monitor drivers as closely as the camera, and the policy should cover them with the same transparency, purposes, assessment and limits, should say whether tracking continues outside working hours (it should not, for a vehicle the driver may use privately, with a privacy switch provided), should address the driving for work policy's use of the data (safety coaching rather than surveillance), and should be issued to drivers with training recorded; the staff privacy notice drafted alongside covers the drivers, the privacy notice and the cookie notice cover the business's website and customers, and the business should be registered with the Information Commissioner's Office under the Data Protection (Charges and Information) Regulations 2018, which the notice can say.

What it costs

Website privacy and cookies pack, £595. Privacy notice, cookie notice and consent guidance. Five working days.

DPA and privacy terms, £795. Data processing agreement plus privacy notice. Five working days.

Buying online forms the engagement on payment. The scope is what the data protection agreements and privacy terms page describes, you accept the Terms of Service at checkout, and I email you within four working hours to get started. If you would rather ask something first, email me.

What you get

• A data processing agreement that meets the statutory requirements and can be used as a schedule to your main contract
• A privacy notice written for people to read rather than to be scrolled past
• Clear allocation of controller and processor roles, which is where most confusion starts
• International transfer provisions where you use overseas suppliers
• Sub-processor and security provisions proportionate to what you do
• A note on the operational steps the documents assume you are taking

What is not included

• Full compliance audits and data mapping exercises
• ICO registration, which you do yourself
• Breach response and regulatory correspondence
• Cyber security certification such as Cyber Essentials
• Advice on data protection law outside the UK and EU

Questions I am often asked

Can we fit driver-facing cameras in our vans?

With a recorded justification from the safety risk of the operation, an impact assessment, drivers consulted and told, recording limited to the safety purpose, audio off unless justified, and no routine performance management from the footage. The policy records each of those.

Do we need a notice in the vehicle?

A notice is needed for other road users and passengers: a visible sticker that cameras are in operation, with the business named and the privacy notice referenced. The drivers are told through the staff privacy notice and the policy.

A driver has asked for the footage of a collision they were in. Do we give it?

They do, as a subject access request, within one month, with other people obscured where possible. The policy makes the driver's request a short process because it is the footage that often clears them.

Related guidance and services

• Data protection agreements and privacy terms, £595, the service this page describes
• Terms and conditions drafting, £995
• SaaS and technology contracts, £995
• CCTV policy for a shop or workplace
• Driving for work policy

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: October 2026. Email geoffrey@caesar.co.uk.