We understand that data protection questions are often the first concern raised. This page answers them directly — without jargon, without deflection.
Yes — and it is widely used across the UK. CCTV on school transport is a well-established safeguarding measure, operated lawfully under UK GDPR when properly implemented. Local authorities routinely mandate it for contracted school transport. Independent schools, nurseries, and sports clubs use it every day.
The legal basis for operating CCTV in this context is typically legitimate interests — the protection of children's safety and the welfare of staff — which is a recognised lawful basis under UK GDPR Article 6. In some cases, schools may also rely on a public task basis where applicable.
The key requirements are that the use is necessary, proportionate, and properly documented in your school's privacy notices and GDPR policy. We provide guidance on this as part of every installation.
The Information Commissioner's Office (ICO) publishes clear guidance on CCTV in education settings. We are registered with the ICO and operate in full compliance with that guidance.
This page provides general information only. For advice specific to your organisation's circumstances, consult your Data Protection Officer or the ICO directly.
Understanding the distinction between data controller and data processor is the most important GDPR concept for this context.
Your school, local authority, or organisation is the data controller for footage captured on your minibus. This means you determine the purposes for which footage is used and are responsible for compliance with UK GDPR in relation to that footage.
We supply and install the equipment. Once installed, footage is stored on an SD card inside the DVR on your vehicle. We do not have access to your footage, we do not store it remotely, and we do not process it on your behalf.
One of the most common concerns is where footage ends up. The answer is straightforward: it stays on your vehicle, in your control, until you choose to access or delete it.
Footage from all cameras is recorded continuously onto a 128GB (or 256GB) SD card inside the DVR unit, which is mounted discreetly under a seat on your vehicle. The footage never leaves the vehicle automatically.
Footage is downloaded to your desktop or laptop using MDVR software — only when you choose to review it. Access is controlled entirely by your organisation. We recommend restricting access to a designated member of staff.
The SD card overwrites older footage automatically as it fills. We recommend a documented retention period of 31 days for routine footage, with specific incidents retained for as long as required for their resolution. Your organisation sets and enforces this policy.
Important note on Live Feed systems: If you opt for a Live Feed system, footage is transmitted remotely to allow real-time viewing. This involves data leaving the vehicle and additional GDPR considerations apply. We provide specific guidance on Live Feed data handling at installation and recommend this is reviewed with your Data Protection Officer before deployment.
Yes — and this is straightforward to do. CCTV on school transport should be included in your school's privacy notice, which is provided to parents at the start of each year. The notice should explain that cameras operate on minibuses for the purposes of pupil safety and welfare. Most parents find this reassuring rather than intrusive. Signage on the vehicle itself is also good practice.
A parent or pupil can make a Subject Access Request (SAR) for footage in which they appear. You have one month to respond. Footage involving other pupils may need to be redacted before disclosure. Your GDPR policy should document how SARs relating to minibus footage are handled. We provide template guidance on this as part of our installation package.
Yes — this is one of the primary purposes of the system. Footage can be used in pupil disciplinary proceedings, staff investigations, and insurance or legal matters. It should be retained (not overwritten) for the duration of any active investigation and handled in accordance with your school's data retention and investigation policies.
You should add minibus CCTV as a processing activity in your Record of Processing Activities (ROPA). The entry should document the purpose, lawful basis, data subjects (pupils and staff), retention period, and access controls. We provide a template entry as part of our installation GDPR guidance pack.
Yes. The most commonly applicable lawful basis is legitimate interests — the protection of children's safety during transport. This is a well-recognised basis for school transport CCTV and is supported by ICO guidance on surveillance in education settings. Schools that are public authorities may additionally rely on public task. We recommend consulting your DPO to confirm the most appropriate basis for your specific context.
We do not have access to footage stored on your vehicles. As a supplier, we hold standard business data relating to your account — contact details, installation records, and maintenance history — which is processed in accordance with our Privacy Policy and ICO registration. We do not sell, share, or process your footage in any form.
Download our practical guide — written for school administrators, not lawyers. Covers lawful basis, privacy notices, retention periods, subject access requests, and your ROPA entry. Provided free to all enquirers.
We'll also send you a brief follow-up — no obligation, no hard sell.
Speak to us directly. We've answered these questions with dozens of schools and can talk you through the compliance picture for your specific situation.