ADI dashcams and the ICO: the £52 fix
Plenty of instructors run a dashcam in the tuition car. The ICO's own dashcam advice for small businesses says in-vehicle cameras "can help reduce insurance premiums and provide protection for drivers". When a pupil or a parent remembers a lesson differently from you, footage settles it.
What the box doesn't tell you is that a camera recording people in a business vehicle makes you responsible for that footage under UK GDPR. The ICO puts it plainly: "If any of your work vehicles have a dashcam or CCTV camera, you'll need to register and pay a data protection fee to the ICO." You also have to tell pupils they are being recorded, keep the footage safe and delete it when you no longer need it.
Most of it is a settings menu and a sticker.
Why a dashcam brings you under UK GDPR
Footage that identifies someone is their personal data. A cabin-facing camera records your pupil for the whole lesson, plus anyone in the back seat. A forward-facing camera still catches pedestrians, cyclists and number plates, and your pupil's face whenever they turn to check a blind spot.
The fee rules exempt recording done for your "personal, family or household affairs" (Data Protection (Charges and Information) Regulations 2018, Schedule). That covers the camera in your family car. It does not cover a tuition car used to run a business. You decide why the footage is recorded and what happens to it, so you are the controller.
What the ICO expects
Pulling the ICO's dashcam advice together with the wider UK GDPR rules, a sole-trader ADI with a dashcam needs to:
- pay the data protection fee
- have a lawful basis for recording, and a note of why it applies
- tell pupils they are being recorded, with a sign in the car and a privacy notice
- leave audio off unless something exceptional justifies it
- delete footage there is no reason to keep
- keep footage secure
- recognise and answer a request for a copy of footage
- report a breach to the ICO when it meets the threshold
Step 1: pay the ICO fee
The fee is set in law. Since 17 February 2025, a tier 1 controller pays £52 a year, or £47 by direct debit. Tier 1 means a turnover of £632,000 or less, or 10 staff or fewer, which takes in any sole-trader ADI. The ICO's fee checker on ico.org.uk confirms whether you need to pay.
The fee is per business, not per camera. If you already pay it for your pupil records (see our GDPR guide for driving instructors), the dashcam is covered by the same registration.
Action: check the ICO register of fee payers for your name. Not there? Pay the £52.
Step 2: choose a lawful basis and write it down
UK GDPR Article 6 needs a lawful basis for any processing. For a dashcam kept for insurance evidence and to protect you and your pupils, the usual basis is legitimate interests. You don't need a pupil's consent under that basis, but you do have to show your interest outweighs their privacy.
The ICO says legitimate interests only applies once you have done the three-part test, and that you should record the outcome:
- Purpose test. What is the interest? Evidence for insurance claims, safeguarding and settling disputes about what happened on a lesson.
- Necessity test. Is recording necessary for that? The ICO's dashcam advice asks you to "consider whether you could achieve the same benefits in a less intrusive way".
- Balancing test. Do the pupil's interests override yours? A forward-facing camera weighs less heavily than continuous cabin recording, and audio weighs more again.
Action: write your answers down. The ICO says the assessment "doesn't have to take any particular form", so half a page kept with your business records will do.
Step 3: tell pupils
The ICO's advice for sole traders: "if customers will be in or near your vehicle, you need to let them know you're recording. For example, by displaying a sign in your vehicle." You also need a privacy notice setting out how the footage is used and your lawful basis. It doesn't have to be in the car, but the sign should say where to find it, such as your website.
In practice that means:
- a sticker in the car saying the dashcam records, why, and where the privacy notice is
- a section in your privacy notice or lesson terms covering the recording
- a word at the first lesson so the pupil can ask questions
The privacy notice section should cover:
- what is recorded (video, and audio if it is ever switched on)
- why you record
- your lawful basis (legitimate interests)
- how long footage is kept
- who can see it
- how a pupil asks for a copy of footage of them
- how a pupil objects, and what happens if they do
On that last point, the right to object has teeth. Under legitimate interests you have to stop unless you can show compelling legitimate grounds that override the pupil's interests, or the footage is needed for a legal claim. Noting the objection and carrying on is not enough.
The ICO has a free tool for writing the notice, linked from its dashcam page.
Step 4: switch audio off
Many dashcams can record sound. The ICO's dashcam advice is direct: "If you decide to install a camera that has audio capability, switch this feature off by default and only use it in exceptional circumstances." Its example of what justifies audio is a threat to personal safety.
A lesson is a long private conversation. Pupils talk about their health, their families and their nerves. Insurance evidence and dispute resolution work from video alone.
Action: open the dashcam settings today and turn audio off. If you ever do switch it on, the ICO says you must tell the people in the car.
Step 5: keep footage for days, not months
UK GDPR says you delete personal data once you no longer need it. The ICO's dashcam advice gives a working figure: "if you're holding several weeks' worth of recorded footage just in case you need it, that's probably too long." For businesses recording the road in case of an accident, "if there hasn't been an accident, and you have no other reason to keep the footage, you should probably delete it after a week or so."
Loop recording helps. A dashcam set to overwrite the oldest footage as the card fills keeps you inside that window without you doing anything. The problem starts when you copy footage off the card "to be safe". That copy is personal data you are now choosing to keep.
When something does happen (a near miss, a collision, a complaint), save that clip straight away and keep it until the matter is closed. That is a separate, specific reason to hold it.
Avoid:
- a folder of every lesson "just in case"
- saved clips mixed in with personal photos
- posting or sharing footage of pupils without their permission
Action: check how many days your card holds before it overwrites. Then go through your phone, laptop and cloud storage and delete saved clips you no longer need.
Step 6: keep it secure
The ICO asks you to think about password protection and limiting access, because "you don't want your recordings on social media because the wrong person had access to them." For an ADI that means:
- the SD card isn't left loose in an unattended car
- any saved clips sit on a device or cloud account with a strong password and two-factor login
- if the dashcam pairs with a phone app over Wi-Fi, the default password is changed
Action: change the app's default password now.
Step 7: requests for footage
A pupil can ask for a copy of footage of them. That is a subject access request, and the ICO's guide to subject access says you must respond "without undue delay, and within one month of receipt of the request", extendable by up to two further months if the request is complex.
Footage often shows other people too. The ICO's video surveillance guidance says your system should be able to redact footage "if third parties need to be blurred or obscured". Check now whether your dashcam app or a free video editor can do that, before a request arrives.
A short loop also helps. Footage overwritten after a week is footage you no longer hold. You can also ask the pupil to clarify which lesson or incident they mean, which the ICO allows when it's reasonably needed.
Action: keep a simple log of any request, the date it arrived and when you replied.
Step 8: breaches
Stolen or leaked footage is a personal data breach. Under UK GDPR you report it to the ICO within 72 hours of becoming aware of it, where feasible, unless it is unlikely to result in a risk to the people in it. If the risk to them is high, you tell them too. Our GDPR guide has a short breach plan for solo ADIs.
For a dashcam, the realistic breaches are:
- the SD card is stolen from the car
- footage goes on social media without the people in it blurred
- someone else drives the car with the camera still recording
- your phone is lost with the dashcam app logged in
Action: write a paragraph in your business notes on what you would do in each case and who you would tell.
The checklist
- Pay the £52 ICO fee if you're not on the register.
- Turn audio recording off.
- Check the loop overwrites in about a week, and delete saved clips you don't need.
- Put a sign in the car that says where your privacy notice is.
- Add a dashcam section to your privacy notice.
- Change the dashcam app's default password.
- Write down your legitimate interests assessment.
Orbit doesn't store or process dashcam footage: that stays on your camera and your devices. What Orbit does hold is your pupils' contact details and lesson records, which our GDPR guide for driving instructors covers alongside the rest of your data protection basics.