In-Cab Recording and ICO Guidance: Why You Need a DPIA Before You Switch It On

This article is general information for UK transport and logistics managers. It is not legal advice, and it does not replace advice from a qualified data protection practitioner or solicitor about your own fleet.

More operators are fitting inward-facing driver cameras, behaviour-monitoring systems, and in-vehicle audio, alongside the outward-facing dashcams that have been standard for years. Before any of that equipment is switched on, UK data protection law expects a specific piece of paperwork to already exist: a Data Protection Impact Assessment, or DPIA. It's the step meant to catch problems with a camera system before drivers are filming, not after.

What a DPIA is, and when the law requires one

A DPIA is a structured assessment of a new or changed way of processing personal data, carried out before that processing starts. Under UK GDPR, Article 35(1), a DPIA is required "where a type of processing in particular using new technologies" "is likely to result in a high risk to the rights and freedoms of natural persons" (UK GDPR, Article 35). Vehicle cameras and driver monitoring, combining new technology with identifiable footage and often behavioural data about a named employee, sit squarely inside that description for most fleets.

Why driver-facing cameras, audio and behaviour monitoring count as high risk

The ICO's own guidance on monitoring workers is direct about this. On driver behaviour monitoring specifically, it states: "It is harder for you to justify driver monitoring, such as monitoring driver behaviour and driving style, or using cameras or audio. This is due to the higher risk to workers' privacy and the privacy rights of any passengers," before concluding plainly: "You must carry out a DPIA as this type of processing would be considered high risk" (ICO, 2023a). Audio raises the stakes further: "Using audio recording, particularly where it is continuous, is considered more privacy intrusive than purely visual recording," and continuous audio and video together are something "you are unlikely to be able to justify in most circumstances" (ICO, 2023a).

Worth being precise about terminology here, since the ICO's guidance covers two different cameras under one "dashcams" heading. "Outward facing cameras or dashcams can capture recordings of other motorists or pedestrians" outside the vehicle. A separate category, "Inward facing systems," "can capture the driver and any passengers within a vehicle" (ICO, 2023a), and it's that inward-facing, driver-monitoring camera this article is mainly about. Both types carry the same general warning, that they "may be intrusive and can impact on the data protection rights and freedoms of workers and other people" (ICO, 2023a), but the inward-facing camera carries the sharper personal risk, because it is pointed at the driver rather than the road.

What a DPIA must contain, with a worked cab-camera example

Article 35(7) sets out the minimum contents: a systematic description of the processing and its purposes; an assessment of the necessity and proportionality of the processing in relation to those purposes; an assessment of the risks to drivers' rights and freedoms; and the measures envisaged to address those risks (UK GDPR, Article 35).

Applied to a fleet fitting inward-facing cameras with audio, that means working through in writing, before installation: what the system is for (safety, insurance evidence, or coaching); whether audio is genuinely necessary, or video alone would do; what could go wrong for the driver (continuous surveillance, private conversations picked up, use for unrelated disciplinary purposes); and the safeguards that will address each risk before the cameras go live.

A DPIA isn't the whole story: you still need a lawful basis

Doing a DPIA doesn't, by itself, make the processing lawful. Separately, under Article 6 of the UK GDPR, "you need to identify and document a lawful basis" for any use of a surveillance system (ICO, 2022a). Genuine consent is rarely realistic here: "it is often difficult to obtain genuine consent from individuals for processing their personal data in public spaces," which for most fleets leaves one of two routes, "it is likely the appropriate lawful basis will be either legitimate interests, or a reliance on public task (if you are carrying out your tasks as a public authority in the public interest or under official authority)" (ICO, 2022a). The ICO points to a legitimate interests assessment (an LIA) as the tool for this, noting it "can help you demonstrate lawfulness of the processing, and can naturally feed into a DPIA" (ICO, 2022a).

Two further checks matter if a system does more than record plain video. "You need to identify an Article 9 UK GDPR condition, if you are actively processing special category data, such as biometric data (for example when using facial recognition systems to uniquely identify individuals)" (ICO, 2022a). Ordinary video of a driver's face doesn't trigger this on its own; it's the active use of footage to biometrically identify someone, through facial recognition, that does. And separately, "if you process criminal conviction data, you need to comply with Article 10 UK GDPR" (ICO, 2022a), relevant if footage ends up being used in connection with a criminal investigation rather than routine safety or coaching purposes.

Practical controls worth building into that DPIA

Several controls come up repeatedly in ICO guidance. Audio should be off by default: "you should switch off any capability to record audio by default," triggered "only... in exceptional circumstances" (ICO, 2023a). The ICO's own example of a logistics firm fitting lorries with audio-capable systems makes the same point: even unintentional recording means "it is possible that conversations held by the driver can be picked up," so audio "should be switched off by default" (ICO, 2022b). Private use needs its own switch: continuous recording "whilst the vehicle is being used for private purposes" is likely to be seen as excessive, and "Drivers should have the option to deactivate the recording in these circumstances" (ICO, 2022b). Clear signage should tell drivers and passengers that recording is happening and under what circumstances (ICO, 2022b). Access to footage should be limited, a retention period must be set, and the DPIA should record that you sought and documented drivers' views, or your reason for not doing so (ICO, 2023b).

Two mistakes worth avoiding

The first is fitting cameras simply because an insurer or a customer has asked for them. The ICO is explicit: "You cannot justify monitoring workers solely because your customer makes it a condition of business," and "Ultimately the decision about whether the monitoring requested by the customer is appropriate rests with you" (ICO, 2023a).

The second is treating a driver's agreement as "consent" that solves the legal basis question. The ICO's guidance notes that "consent is not usually appropriate in the employment context, due to the imbalance of power," and is "only appropriate if circumstances mean workers have a genuine choice and control over the monitoring" (ICO, 2023b), which is rarely the case where a driver's job depends on accepting the camera.

One regulatory housekeeping point

On 30 September 2026, the regulator formerly known as the Information Commissioner's Office began operating as the Information Commission (ICO, 2026). Some existing ICO guidance, including parts of the monitoring-workers material cited here, is under review following the Data (Use and Access) Act 2025, so check the regulator's current site before relying on any single page as final.

A DPIA for cab cameras isn't a formality to get through quickly. It's the document that forces the necessity question to be asked and answered honestly, before the equipment goes in rather than after a driver or the regulator asks why it's there.

References

ICO (2022a) How can we comply with the data protection principles when using surveillance systems?. Available from: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/cctv-and-video-surveillance/guidance-on-video-surveillance-including-cctv/how-can-we-comply-with-the-data-protection-principles-when-using-surveillance-systems/ [Accessed 5 November 2026].

ICO (2022b) Video surveillance (including CCTV): surveillance in vehicles. Available from: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/cctv-and-video-surveillance/guidance-on-video-surveillance-including-cctv/additional-considerations-for-technologies-other-than-cctv/surveillance-in-vehicles/ [Accessed 4 November 2026].

ICO (2023a) Employment practices and data protection: monitoring workers – Specific data protection considerations for different ways or methods of monitoring workers. Available from: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/employment/monitoring-workers/specific-data-protection-considerations-for-different-ways-or-methods-of-monitoring-workers/ [Accessed 4 November 2026].

ICO (2023b) Monitoring workers – Data protection and monitoring workers. Available from: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/employment/monitoring-workers/data-protection-and-monitoring-workers/ [Accessed 4 November 2026].

ICO (2026) ICO welcomes transition to new Information Commission and marks new chapter with Manchester head office opening. Available from: https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/09/ico-welcomes-transition-to-new-information-commission-and-marks-new-chapter-with-manchester-head-office-opening/ [Accessed 4 November 2026].

UK GDPR, Article 35. Available from: https://www.legislation.gov.uk/eur/2016/679/article/35 [Accessed 4 November 2026].