Running an MDVR system on a UK commercial fleet is legal, widely practised, and — when done correctly — entirely straightforward to comply with. The difficulty is that the regulatory obligations span three different frameworks: road vehicle construction rules, data protection law, and the transport-specific requirements that apply to larger vehicles operating in urban areas. Fleet managers who understand each framework separately can build a compliant policy without confusion. Those who don’t often discover gaps when they receive a Subject Access Request or a spot check on vehicle installation.
This guide sets out what each framework requires, where the obligations specifically apply to fleet MDVR systems (rather than consumer dashcams), and what a compliant operation looks like in practice.
The Road Vehicles (Construction and Use) Regulations 1986 govern what can be mounted in a vehicle and where. For camera systems, the key rule is that any device mounted on the windscreen must not intrude more than 40mm into the area swept by the wiper blades. In practice, this means mounting behind the rearview mirror or at the top of the windscreen. Devices mounted too low — particularly those that impede the driver’s view through Zone A of the windscreen — risk failing the MOT and a fine of up to £1,000 for the driver.
For MDVR systems with externally mounted cameras (cab-mounted forward-facing, nearside, offside, rear), windscreen placement rules apply to any camera using a suction cup or adhesive mount on glass. Cameras mounted externally — bolted to mirror housings, roof bars, or body panels — fall outside windscreen placement rules but must not obstruct the driver’s line of sight and must be installed in a way that does not create a road safety hazard.
The MDVR unit itself is typically installed in the cab or behind the driver’s cab panel and does not create windscreen placement issues. Cabling runs should be checked during installation to ensure they do not cross the driver’s operational controls or impede entry and exit from the vehicle.
A fleet MDVR recording footage of roads, third parties, passengers, and drivers is processing personal data. UK GDPR applies. The fleet operator is the data controller — the entity responsible for ensuring that processing is lawful, transparent, and proportionate.
A question that comes up in almost every fleet compliance review is which lawful basis covers MDVR operation. The standard answer for commercial fleets is legitimate interests: the operator has a genuine and documented interest in recording — driver safety, incident evidence, fraud prevention — that outweighs the privacy interests of individuals who are incidentally recorded. This basis must be documented in a Legitimate Interests Assessment (LIA), which does not need to be submitted to anyone but must exist and be reviewable if challenged.
The Data (Use and Access) Act 2025 strengthens this position for commercial operators by introducing “recognised legitimate interests” for activities including crime prevention and road safety. For fleet operators, this reduces the burden of justifying the legitimate interests basis — the categories of processing MDVR systems perform are explicitly recognised in the updated legislation.
Fleet operators processing personal data — which includes MDVR footage — are required to register with the Information Commissioner’s Office and pay an annual data protection fee. For most small and medium-sized businesses, the fee is £35 per year. Larger organisations (more than 250 staff or turnover above £36M) pay £60 per year.
Operating commercial MDVR systems without ICO registration is not a grey area. The ICO can issue enforcement notices and fines for non-registration. Registration takes approximately 10 minutes via the ICO website and is renewed annually. If your business already has ICO registration for other reasons (website analytics, customer data), MDVR operation is covered by the same registration — you do not need a separate registration, but your registration should reflect the full scope of data processing activities.
Recording employees without their knowledge is a GDPR violation. Fleet operators must inform drivers that vehicles are equipped with MDVR systems, what is recorded, how footage is used, and how long it is retained. This information is typically provided in the employment contract or through a fleet camera policy document issued at induction.
For driver-facing cameras specifically — cameras recording the cab interior and the driver’s face and behaviour — explicit notification is essential. Recording someone’s face is processing biometric data, which carries enhanced obligations. Driver-facing camera footage used for coaching or disciplinary purposes must have a documented purpose, be disclosed to the driver as part of their data protection rights information, and handled with the same security controls as other sensitive personal data.
A fleet camera policy document — setting out what the system records, who can access footage, for what purposes, and for how long — satisfies the notification obligation and provides a written record that notification was given. Operators who run MDVR systems without this documentation are exposed if a driver raises a complaint with the ICO or brings a claim based on unlawful data processing.
Third parties captured by MDVR systems — pedestrians, drivers of other vehicles, bystanders — must be informed that recording is taking place. The standard mechanism is a “CCTV in Operation” notice on the vehicle, visible from outside. The notice should direct individuals to where they can find the operator’s full privacy information — typically the company website or a printed privacy notice available on request.
The notice does not need to be large or prominent beyond what is necessary for a passing pedestrian to see it. A sticker on the rear and nearside of the vehicle, readable at close range, satisfies the requirement for most fleet operations.
MDVR footage is personal data. Retaining it indefinitely is not compliant — footage must be deleted when it is no longer needed for the purpose for which it was recorded. The standard approach for continuous MDVR recording is loop overwrite: footage older than 30 days (or whatever retention period is documented in the fleet camera policy) is overwritten automatically. This is not just operationally convenient — it is the compliant default.
For incident footage — footage that has been extracted or locked because it relates to a specific claim, investigation, or legal matter — retention extends to the duration of the related proceedings. Once the matter is closed, incident footage should be deleted. Retaining footage indefinitely because “it might be useful” is not a documented legitimate interest and does not satisfy the data minimisation principle.
Subject Access Requests (SARs) are requests from individuals — drivers, third parties, or anyone captured in footage — to receive a copy of personal data held about them. Operators must respond within 30 days. If the SAR relates to MDVR footage, the operator must identify whether footage of the individual exists within the retention window and, if so, provide a copy or explain why the request is refused. Having a clear retention policy makes SAR responses manageable. Without one, identifying what footage exists and what should be disclosed becomes a significant operational problem.
The Direct Vision Standard (DVS) and Progressive Safe System (PSS) apply to HGVs over 12 tonnes operating in Greater London. From October 2024, vehicles not meeting a minimum DVS star rating must be fitted with the PSS — a package of safety technology that includes nearside camera monitoring and blind-spot protection for vulnerable road users.
For fleet operators with vehicles operating in London, the PSS requirement is not optional. Vehicles without a compliant system face a fine of up to £550 per entry into the zone. Camera systems used to satisfy PSS requirements must meet TfL’s published specification — not all MDVR camera configurations automatically qualify, and the system must be signed off through TfL’s approved process.
For fleets operating primarily outside London, DVS/PSS does not currently apply. But the direction of travel in UK transport policy is towards expanded camera and sensor requirements for larger vehicles. Specifying an MDVR system that meets current PSS requirements means the hardware is positioned for any future regulatory extension.
Yes. Any business processing personal data — including MDVR footage that captures individuals — must register with the ICO and pay the annual data protection fee. For most SMEs, the fee is £35 per year. Non-registration is a compliance failure regardless of the scale of the operation.
Yes. Footage that captures identifiable individuals — pedestrians, other drivers, your own drivers — is personal data under UK GDPR. The fleet operator is the data controller and must have a documented lawful basis for recording, typically legitimate interests. The Data (Use and Access) Act 2025 supports this basis for road safety and crime prevention purposes.
A Legitimate Interests Assessment (LIA) documents the legal basis for processing personal data under the legitimate interests ground. For fleet MDVR systems, the LIA sets out what is being recorded, why, and why the operator’s interests outweigh the privacy interests of those recorded. You do not need to submit it to anyone, but it must be available if your processing is challenged. A one-page internal document is sufficient for most fleet operations.
Yes. Recording employees without informing them is a GDPR violation. Drivers must be told what the system records, how footage is used, who can access it, and how long it is kept. This is typically covered in a fleet camera policy issued at induction and referenced in the employment contract.
DVS and PSS currently apply to HGVs over 12 tonnes entering Greater London. Vehicles must either have a minimum DVS star rating or be fitted with the PSS package including nearside camera monitoring. For operations outside London, DVS/PSS does not currently apply, but the regulatory direction suggests requirements may expand to other urban areas.
There is no fixed statutory period for fleet MDVR footage. The GDPR principle is that data should be retained only as long as necessary for the purpose it was collected. For continuous recording, a rolling 30-day window is standard and widely accepted. Incident footage linked to an active claim or legal matter can be retained until the matter closes. Whatever retention period you set must be documented in your fleet camera policy and adhered to consistently.
A printable compliance checklist for UK fleet operators covering ICO registration, lawful basis documentation, fleet camera policy, vehicle signage, data retention, installation rules, DVS/PSS requirements, and Subject Access Request readiness.
Related guides: Common MDVR Errors and How to Fix Them · MDVR Systems for Waste Collection Vehicles
4 August 2026
Monday to Friday:
8.30am-5.30pm
