The most common data protection failure for fleet camera operators is not a technical one — it is the absence of a written retention policy. UK GDPR does not set a fixed retention period for vehicle camera footage, but it does require you to set one yourself, document it, communicate it to your drivers, and apply it consistently. A fleet operator who has cameras on twenty vehicles and no documented retention schedule is processing personal data without meeting the storage limitation principle, regardless of how good the cameras are or how diligently the footage is used for claims evidence.
Article 5(1)(e) of UK GDPR requires that personal data is kept in a form that permits identification of data subjects for no longer than is necessary for the purposes for which the data is processed. This is the storage limitation principle, and it is what governs how long fleet camera footage can be kept.
There is no minimum retention period for vehicle camera footage — and no statutory maximum either. The ICO’s position is that the purpose of the recording determines the appropriate retention period. Footage that has not been flagged for any incident, investigation, or claim has no purpose that justifies keeping it beyond a short operational period. Footage that is directly relevant to an open insurance claim, a legal dispute, or an active investigation has a clear purpose and can be retained for as long as that purpose exists.
The practical implication is that a fleet operator’s retention policy must be tiered — different periods for different categories of footage, matched to the purpose of retaining each category.
For routine footage that has not been flagged — normal journey recordings with no incident, complaint, or investigation — the ICO’s guidance suggests that retaining footage “for a week or so” is appropriate where nothing has happened. In practice, most commercial fleet operators set a routine retention period of 30 days, which aligns with common MDVR storage capacity at standard resolution settings and is widely accepted as a proportionate period for road safety monitoring and driver performance review.
Retaining routine, unflagged footage for months — or indefinitely — is inconsistent with the data minimisation and storage limitation principles. The ICO has noted explicitly that “holding onto months of old footage unnecessarily is not only a waste of storage but could also be a breach of data minimisation rules.” A documented 30-day deletion schedule for unflagged footage demonstrates that the retention period is proportionate to the purpose.
Loop recording systems that automatically overwrite older footage as new footage is created are inherently compliant with this aspect of the storage limitation principle — provided that flagged incident footage is extracted and separately retained before the overwrite window closes. This is where the practical failure most often occurs: the system is configured correctly, but no process exists to flag and extract relevant footage before it is overwritten.
Footage that is flagged as relevant to a specific incident — a collision, a near-miss, a damage claim, a driver conduct investigation — has a defined purpose that justifies longer retention. The appropriate period depends on the nature of the incident:
The key requirement in each case is that the extended retention is documented — the reason for retention beyond the routine period, the specific footage preserved, and the review date at which retention will be reassessed or footage deleted.
A retention policy for vehicle camera footage does not need to be long, but it must cover specific elements to satisfy UK GDPR’s accountability requirement:
A question that comes up consistently among fleet managers is how to handle footage that was deleted before they knew it was relevant — for example, where an incident is only reported three days after it occurred and the routine footage has already been overwritten. The answer is that a documented retention policy, consistently applied, demonstrates compliance even where footage no longer exists. What cannot be defended is the absence of any policy, or a policy that exists on paper but is not applied.
A Data Protection Impact Assessment is required under Article 35 of UK GDPR where processing is likely to result in a high risk to individuals. The ICO’s guidance identifies systematic monitoring of employees as a category likely to require a DPIA. A fleet with cameras on all vehicles, recording driver behaviour continuously, is likely to meet the threshold for systematic monitoring of employees.
A DPIA for a fleet camera system documents:
Completing a DPIA is not only a compliance obligation where the threshold is met — it is also the document that demonstrates the legitimate interest assessment underpinning the processing. Fleet operators who use legitimate interests as their lawful basis (which most do, alongside legal obligation for compliance-related footage) must be able to demonstrate that they have balanced the interests of the business against the interests of the data subjects. The DPIA is where that balance is documented.
Drivers must be informed that cameras are fitted, what they record, the purposes of the recording, and the retention periods that apply. This is not simply good practice — it is a requirement of the transparency principle under UK GDPR. The notification must be given before the cameras are operational, and new drivers must receive it as part of their induction.
For cameras that record members of the public — external cameras covering the road and footpath — vehicle signage notifying that CCTV is in operation is required. The signage must be visible to a person approaching or alongside the vehicle. A standard CCTV notice with the operator’s name and a contact point for data subject enquiries meets this requirement.
A practical concern raised by fleet managers who have fitted external and driver-facing cameras simultaneously is whether the driver-facing camera requires separate documentation. Driver-facing cameras record an employee at work, which is a more sensitive category of monitoring than external cameras recording road conditions. The DPIA should specifically address driver-facing cameras, and the driver notification should explicitly cover internal recording and its purposes.
Most commercial organisations that operate vehicle cameras are required to register with the ICO and pay the annual data protection fee. The fee is determined by organisation size and turnover: micro-organisations pay £40 per year; small and medium organisations pay £60 per year; larger organisations pay £2,900 per year. Registration is not optional — failure to register where required is a criminal offence, and the ICO actively enforces registration obligations.
The registration covers the organisation’s data processing activities as a whole, not just vehicle cameras specifically. An organisation that already processes employee data (payroll, HR records) is likely already registered. The addition of a vehicle camera system does not necessarily require a new registration — but it should prompt a review of the organisation’s data processing record to ensure vehicle camera footage is listed as a processing activity.
No. UK GDPR does not set a fixed maximum retention period. Thirty days is a widely adopted default for routine, unflagged footage and is proportionate for road safety monitoring purposes. Footage relevant to an open insurance claim, investigation, or legal proceedings can legitimately be retained for as long as that purpose exists — in some cases, up to six years from the date of incident. The requirement is that your retention period matches your documented purpose, not that it meets a specific statutory number.
A subject access request requires you to provide footage that you hold at the time of the request. If footage has been deleted in line with your documented retention policy before the SAR is received, you are not required to recreate it. You should respond to the SAR confirming that no footage from the specified period is held, and the reason why. The documented retention policy is what demonstrates that the deletion was lawful — a retention policy that exists solely to justify deleting footage after a claim is raised would not meet this standard.
Driver-facing cameras do not require a different lawful basis from external cameras, but they do require more detailed documentation because they involve monitoring employees in the workplace. Legitimate interests remains a valid basis, but the LIA must specifically weigh the interests of the business (road safety, driver welfare, claims evidence) against the more significant privacy intrusion of internal monitoring. The DPIA should address driver-facing cameras specifically, and the driver notification must cover what internal footage is recorded, who can access it, and for what purposes.
The Data (Use and Access) Act came into law on 19 June 2025 and has placed some ICO guidance under review. The core principles — storage limitation, data minimisation, transparency, and accountability — are not changed. The Act introduces some modifications to the UK data protection framework but does not fundamentally alter the retention requirements for vehicle camera footage. Fleet operators should check for ICO updates to specific guidance documents, but the tiered retention approach set out above remains the correct framework.
Loop recording automatically overwrites older footage as storage capacity is used — the system manages the 30-day routine deletion without manual action. A formal deletion process is needed for footage that has been extracted from the loop (event-locked clips, uploaded incident footage, downloaded evidence for a claim). This footage does not self-delete — it must be manually deleted when the retention period expires. The retention policy should specify who is responsible for reviewing and deleting extracted footage, and how deletions are logged.
A printable template covering all elements of a UK GDPR-compliant data retention policy for fleet camera footage — routine and incident retention periods, DPIA, driver notification, and SAR process.
Related guides: Safety Compliance for Construction Fleets · Operator Licence Safety Requirements
4 August 2026
Monday to Friday:
8.30am-5.30pm
