Hire a Coach for Your Next Ride. Travel Comfortably with Our Local Experts.
Document Control
Project: Vehicle CCTV System
Organisation: Green Metro Coaches Ltd
Document Owner: Data Protection Lead Approved By: Managing Director Version: 1.0
Date Completed: 03 July 2026
Review Date: 03 July 2027 (or earlier if the system changes)
This Data Protection Impact Assessment (DPIA) has been completed to assess the privacy risks associated with the use of Closed-Circuit Television (CCTV) systems installed within company vehicles.
The DPIA demonstrates that the organisation has considered the impact on individuals’ privacy and has implemented appropriate safeguards to ensure compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
The organisation operates CCTV systems within vehicles used to transport passengers.
The system records digital video images of activities taking place within designated areas of the vehicle.
The system is designed to:
The CCTV system:
No live monitoring takes place unless required for maintenance or investigation.
The CCTV system may collect:
The organisation does not intentionally collect special category personal data. However, recordings may incidentally reveal:
Where this occurs, such information will only be processed where permitted by law.
Personal data may relate to:
The processing is necessary under:
The organisation has a legitimate interest in protecting passengers, staff, vehicles and property, investigating incidents and supporting safeguarding.
Where services are provided under statutory transport arrangements, processing may also rely upon:
Article 6(1)(e) – Public Task, where applicable.
Where special category data is incidentally processed, this will only occur in accordance with the Data Protection Act 2018.
The organisation has considered whether the objectives could be achieved by less intrusive means.
Alternative measures considered include:
These measures alone would not provide objective evidence of incidents or adequately protect vulnerable passengers.
Vehicle CCTV is therefore considered necessary and proportionate.
The cameras are positioned only to capture areas necessary for safeguarding and security purposes.
Audio recording has been disabled to reduce privacy intrusion.
Individuals whose information may be recorded include:
All individuals are informed through CCTV signage and the organisation’s Privacy Notice.
Potential privacy risks include:
The organisation has implemented the following controls:
Footage may only be disclosed where lawful and necessary. Possible recipients include:
All disclosures will be documented.
No routine sharing takes place.
Footage will never be shared on social media or for personal purposes.
Routine recordings will normally be retained for 31 days. Where recordings form part of:
they will be retained until the matter has concluded and then securely destroyed.
Individuals retain their rights under UK GDPR including:
Some rights may be limited where exemptions apply, including where disclosure would prejudice criminal investigations or affect the rights of others.
Security measures include:
The organisation has consulted:
The necessity of CCTV has been considered against the potential impact on individuals.
The benefits to passenger safety and safeguarding significantly outweigh the limited privacy intrusion.
Risk | Likelihood | Impact | Residual Risk |
Unauthorised access | Low | Medium | Low |
Data breach | Low | High | Low |
Excessive retention | Low | Medium | Low |
Unlawful disclosure | Low | High | Low |
Misuse by staff | Low | Medium | Low |
Cyber attack | Low | High | Medium |
Overall residual risk following implementation of controls is assessed as Low.
Following assessment, the organisation concludes that:
processing begins.
This DPIA has been reviewed and approved prior to the implementation of the Vehicle CCTV system.
Role | Name | Signature | Date |
Managing Director | |||
Data Protection Lead | |||
Safeguarding Lead | |||
This DPIA will be reviewed:
