India's Digital Personal Data Protection Act (DPDP Act) 2023 is the first comprehensive data protection legislation the country has had. For most businesses, the conversation has focused on customer data, consent frameworks, and breach notifications. Fleet operators have largely been absent from that conversation — which is a problem, because dashcam footage is squarely within its scope.
What counts as personal data under the DPDP Act?
The DPDP Act defines personal data as "any data about an individual who is identifiable by or in relation to such data." A dashcam recording a driver's face and behaviour is personal data. RFID boarding records linked to a named student are personal data. GPS traces showing where an employee commutes from and to are personal data. There is no carve-out for operational or fleet data.
The specific problem with school bus footage
Children's data gets heightened treatment under the Act. Any data fiduciary processing data of a child must, among other obligations, not undertake processing that is "detrimental to the wellbeing of the child." The Act also specifically restricts tracking and behavioural monitoring of children.
If a school bus has a dashcam — and most now do — the footage of children inside that bus is personal data of minors. If that footage is routed through a Chinese OEM cloud API, as it is with most dashcam vendors in India, it is being processed on servers outside Indian jurisdiction. The school or transport operator is the data fiduciary. They are responsible.
Ask your dashcam vendor this question directly: "Where is the live video stream processed before it reaches my dashboard?" If they cannot give you a complete answer — server location, company name, and data retention policy — that is your answer.
Employee transport and movement data
Corporate employee transport creates a different but equally serious exposure. GPS traces of employee cab routes reveal home addresses and residential neighbourhoods. Shift timings combined with location data reveal personal schedules. Boarding records linked to employee IDs create a surveillance dataset that most HR teams have not thought carefully about.
The question is not whether this data is necessary for transport operations — it clearly is. The question is who holds it, where it is processed, and whether the data processing agreement with your technology vendor is DPDP-compliant.
The chain-of-custody problem
Most Indian dashcam and fleet management vendors do not build their own video processing infrastructure. They integrate with Chinese OEM hardware and use the manufacturer's cloud SDK to decode and relay live video. The Indian vendor's Terms of Service may say "data is processed in India" — but if they are making API calls to an OEM server in Shenzhen or Singapore to decode the JT/T 1078 video stream, data is crossing a border that their ToS does not acknowledge.
The Bharatiya Sakshya Adhiniyam (Indian Evidence Act replacement) also requires an unbroken chain of electronic evidence custody for footage to be admissible. A video clip that has been through a foreign API hop has a chain-of-custody problem in any legal proceeding — insurance claim, accident investigation, or criminal case.
What compliance by architecture looks like
The only genuinely compliant posture is one where personal data — including video — never leaves Indian infrastructure at any point in the processing chain. This means:
- ▸The video protocol is parsed on Indian servers, not via an OEM cloud API
- ▸Storage is on Indian infrastructure (cloud or on-premise)
- ▸The data processing agreement with the vendor specifies Indian jurisdiction explicitly
- ▸Audit logs are tamper-evident and jurisdiction-anchored
At Veytra, we built the JT/T 1078 video parser ourselves specifically so that live dashcam footage never needs to touch a foreign server. Every frame is processed on Indian infrastructure. This is not a policy stance — it is the architecture. The data cannot leave India because there is no foreign endpoint to route it through.
DPDP Act compliance for fleet video is not a checkbox. It requires knowing — at the protocol level — where every byte of your fleet footage goes. If your vendor cannot tell you, assume it is not compliant.