Who Can Look, and For How Long

General orientation, not legal advice.

The justification written at deployment is tested by who can open a clip on an ordinary Tuesday.

Who should have access

The named reviewer and their deputy.

Not every depot manager, which is the default in most deployments and the configuration that turns a safety system into general supervision.

Not the driver's line manager as a matter of course, for the same reason coaching and discipline are separated.

And the driver, to their own data, which is both a right and the cheapest error correction available.

Logging access

Every view recorded: who, when, which clip, and why.

Visible to the driver, which is unusual and is the single practice that most changes how the system is perceived.

Reviewed periodically, because an access log nobody reads is a record rather than a control.

A pattern of one manager repeatedly viewing one driver is a finding, and it will not surface any other way.

Retention by category

Video: days, with an incident hold. Weeks at the outside.

Event records: long enough for a quarterly trend, which is months.

Scores: as long as the events they derive from.

Coaching records: per your HR retention, and separately from the raw data.

Set each explicitly. Platform defaults are generous in this category and a fleet holding a year of cab footage has acquired an obligation nobody decided to take.

Deletion that happens

Automated, because manual deletion does not occur.

Verified: try to retrieve something past its period and confirm it is gone rather than hidden from a view.

Including exports, which is the leak nobody tracks — a clip downloaded for a meeting sits outside every control.

And including the provider's copies, which needs to be in the contract.

The incident hold

Scoped to a vehicle and a window, triggered at report.

With a record of who triggered it and why.

And a release when the matter closes, so a hold does not quietly become indefinite retention for that driver.

The check

Who currently has access, listed, and does each still need it?

When did anyone last read the access log?

Has a deletion actually run?

And could a driver see when their footage was viewed? In most deployments the answer is no, and changing it costs a configuration setting.

Read the access log

Because a log nobody reads is a record rather than a control.

Quarterly: who viewed what, and did the reason hold.

A pattern of one manager repeatedly viewing one driver is a finding that will surface no other way.

And where drivers can see their own viewing log, that pattern surfaces faster — which is an argument for enabling it.

Follow the difficult record

Use the booking workflow example to frame one representative case. The useful evidence is the record created when a value is challenged, corrected, approved and exported.

Independent reference

For a thematic point of reference, see the National Institute of Standards and Technology. It provides useful context beyond supplier documentation and should be checked in its current form.