Two cameras went into the cab on the same day — one forward-facing, one pointing back at me. The forward-facing one made obvious sense. The inward one was harder to get comfortable with. My employer said it was for safety. I wanted to know what that meant in practice: who owns the footage, how long it stays, what happens in an accident, and whether I have any rights over recordings of myself at work.
It took me longer than it should have to find clear answers. Here's what UK GDPR actually means for dashcam footage in a commercial HGV cab.
Yes, UK GDPR applies — and here's who the data controller is
Some operators have told drivers that GDPR doesn't apply to dashcam footage in a commercial vehicle. That's not right. Footage from a cab camera — particularly an inward-facing one that records your face and actions — is personal data. It's identifiable information about a specific individual. UK GDPR applies.
The employer — the transport operator — is the data controller. You, as the driver, are the data subject. That distinction matters because it's the data controller who has obligations under UK GDPR: they decide why the data is collected, how long it's kept, who can access it, and what rights they'll facilitate for data subjects. The driver doesn't get to control the footage, but the driver has specific rights in relation to it.
This is the same framework that applies to your tachograph card data — employer as controller, driver as subject. Cab camera footage is an additional category of personal data the operator holds about you, with its own retention and access considerations.
Lawful basis for recording drivers at work
UK GDPR requires a lawful basis for processing personal data. For cab cameras, operators typically rely on one of two bases — sometimes both.
The first is legitimate interests (UK GDPR Article 6(1)(f)). The operator has a legitimate interest in road safety, accident investigation, protecting against fraudulent insurance claims, and monitoring fleet performance. Those interests are real and substantial. For forward-facing cameras, this is the most common basis and is generally well-justified.
For inward-facing cameras — the ones pointed at the driver — legitimate interests still applies but requires a balancing test: do the operator's interests override the driver's right to privacy at work? The ICO's position is that this can be justified where there's a genuine safety rationale, particularly in industries where driver fatigue or distraction is a documented risk. HGV operations fit that category. But the operator needs to have done that balancing assessment and documented it, not just fitted the camera and called it a safety measure.
The second possible basis is legal obligation (Article 6(1)(c)) — where a law requires the recording. Most operators don't have a specific legal duty to fit cab cameras. They choose to. That means legitimate interests is usually the primary lawful basis, not legal obligation.
Whatever basis the operator relies on, it should be documented in a data protection policy — or at minimum in the privacy notice they provide to drivers. If you've never seen a privacy notice from your employer about cab camera data, that's a gap in their UK GDPR compliance. You're entitled to know, in accessible terms, how your personal data is being processed.
How long should the footage be kept?
There's no single legal minimum or maximum for dashcam footage retention in the UK — unlike tachograph data, which has specific retention obligations under drivers' hours law. The operator decides the retention period, but UK GDPR says it should be no longer than necessary for the purpose it was collected for.
The common industry standard for routine footage (no incident, no claim, no dispute) is 28 to 31 days. Some operators use 56 days to provide a buffer for slower-emerging claims. The logic is straightforward: if nothing happened on a given journey, the footage from that journey serves no ongoing purpose after a reasonable period, and keeping it indefinitely without good reason creates a data minimisation problem under UK GDPR.
Where something did happen — an accident, a near-miss, a complaint from a third party, an insurance claim, a DVSA investigation — the relevant footage should be retained for as long as it's needed for that specific purpose. Active insurance claims can run for years. An incident that looks minor in the cab but produces a civil damages claim eighteen months later means the footage from that day needs to be retained. Smart operators flag footage automatically when drivers report incidents, and store it separately from the routine 28-day cycle.
What your employer can share — and with whom
UK GDPR doesn't prevent operators from sharing footage with legitimate third parties. Insurance companies can request footage in relation to claims. Solicitors can request it through the civil disclosure process. DVSA and the police can request it under their enforcement powers.
What the operator can't do is hand footage over freely to anyone who asks, or use it for purposes unrelated to why it was collected. If footage was collected for road safety and fleet management, sharing it with a marketing agency to make a promotional video would require a different lawful basis — or your consent. Consent in an employment relationship is complicated, because it's rarely freely given, but that's a separate discussion.
The key point for drivers: if your employer's footage ends up in a third-party insurance claim or a court hearing, that's entirely lawful under UK GDPR. The footage is evidence. It was collected for road safety and risk management purposes. Using it to investigate an accident is exactly what it was collected for.
Your right to a copy under UK GDPR Article 15
Data subjects — that includes you, the driver — have the right to request a copy of personal data held about them. This is a Subject Access Request (SAR) under Article 15 of UK GDPR. You can make one in writing, by email, or verbally. There's no mandatory form. There's no fee (in most cases). The operator has one calendar month to respond.
For cab camera footage, the SAR response should include footage in which you're identifiable — typically inward-facing footage. Forward-facing footage where you're not visible in the image may be in scope if it can be connected to you as the driver through vehicle records.
One practical issue: if you submit a SAR after the 28-day routine retention period has elapsed and the footage has already been deleted, there's nothing to hand over. The operator's obligation is to provide what they hold. If they've deleted it in line with their documented retention policy — not to destroy evidence, but as part of normal data minimisation — that's lawful. The time window for requesting footage matters.
The right to erasure — and where it doesn't apply
You have a right to erasure (the "right to be forgotten") under UK GDPR Article 17. But it's not absolute. The right to erasure doesn't apply where the operator has a legitimate reason to keep the data — and for footage connected to an accident investigation, a live insurance claim, or a DVSA enforcement matter, they have exactly that.
You can ask for footage to be deleted. The operator should tell you whether they're retaining it and why. If they're keeping it because a claim is active, that's a proportionate and lawful reason. If they're keeping it because they forgot to clear it and have no ongoing reason for retention, that's different — and an erasure request should succeed.
The practical advice: if you want footage deleted and there's no active incident connected to it, make the erasure request promptly. After 28 days it's probably gone anyway. If there's an incident and you want the footage preserved — because it supports your account of events — submit a SAR quickly and ask the operator to flag the footage for extended retention before it drops off the 28-day cycle.
Inward-facing cameras — the specific issue with monitoring at work
Inward cameras are more intrusive than forward-facing ones. They record facial expressions, phone use, eating and drinking, conversations in the cab, and behaviour during breaks. Some systems use AI to detect fatigue or distraction and trigger alerts.
The ICO has issued guidance on employee monitoring that's relevant here. The key requirements: employees should be informed about monitoring (covered by the privacy notice obligation). Monitoring should be proportionate to the risk it's intended to address. And data from monitoring should be used fairly — not as a covert surveillance operation.
In practice, AI-triggered incident footage systems — where the camera only uploads when it detects a hard braking event, lane departure, or phone detection — are less intrusive than continuous recording. They collect data about specific events rather than the entire working day. That proportionality matters under the legitimate interests balancing test.
If your employer's inward camera records continuously and they've never explained why, it's worth asking. You're entitled to know what's being recorded, how long it's kept, who reviews it, and on what basis. Those are your rights as a data subject. A privacy notice should answer them. If it doesn't exist, ask for one.
What to do if you have a dispute about footage
If you believe footage is being used unfairly, retained beyond its purpose, or processed without a lawful basis, you can complain to the Information Commissioner's Office (ICO). The ICO is the UK's data protection regulator. They can investigate complaints and take enforcement action against controllers who breach UK GDPR.
More practically: if there's a specific piece of footage that matters to you — because it shows what happened in an incident and your account differs from the operator's — get a SAR in immediately. Get your union rep or legal adviser involved. Don't rely on the operator to preserve footage on your behalf if there's any dispute about the incident.
When DVSA or police request your footage
DVSA and the police have powers to require operators to produce records relevant to road transport enforcement. Footage from a cab camera can be requested under those powers. The operator isn't required to seek your consent before handing footage to DVSA or the police under a production order or as part of an investigation — UK GDPR has specific provisions for law enforcement processing.
If you've had a roadside check, a prohibition notice, or there's an active investigation into an incident, assume the footage may already have been secured. The operator may have been contacted before you even know an investigation is underway.
This isn't necessarily a bad thing. If the footage shows you drove professionally and the incident wasn't your fault, it's evidence in your favour. Footage is neutral. It shows what happened. Where it helps your account, it helps. Where it contradicts your account, that's a different problem — and the footage was always going to surface eventually in a civil or criminal process.
The privacy notice you should have been given
Under UK GDPR Article 13, data controllers must provide privacy information at the point of data collection. For cab cameras, that means before you first drive a vehicle with the cameras fitted, the operator should have given you written notice explaining: what data is collected, why, the lawful basis, who it's shared with, how long it's kept, and your data subject rights.
A lot of operators haven't done this properly. They've fitted the cameras, maybe mentioned them in a briefing, and never produced a compliant privacy notice for the camera data specifically. If you've never received one, you can ask for it. You're entitled to that information. Whether the absence of a notice changes what the operator can do with the footage is a matter for the ICO — the obligation is theirs, and failure to provide notice is a breach of UK GDPR regardless of whether the underlying processing is otherwise lawful.
If you're tired of wondering what your employer holds about you and want a compliance tool that's actually on your side, ShiftOwt tracks your hours and rest — data you generate, in your control — £5.99/mo for drivers.