What a DPIA is
A data protection impact assessment is a written look at what could go wrong for people before you start a processing activity, and what you will do about it. For a fleet it means describing what trackers and cameras record, asking if it is needed, and deciding on safeguards.
When to do one
Saudi rules (Implementing Regulations, Article 25) require an assessment for large-scale or regular processing with continuous monitoring, and UAE law (Decree-Law 45 of 2021, Article 21) asks for one for modern technologies with a high privacy risk. Driver tracking and DSM cameras fit that picture. Even when the law does not require one, a signed worksheet shows that you thought first. Source and date checked: 3 Nov 2026. Ask legal how it applies to you.
The three tests of legitimate interest
- Purpose: is the interest real, lawful and clearly stated?
- Necessity: do you need this data and this level of intrusion to reach it?
- Balance: do the drivers' rights and expectations outweigh your interest, once safeguards are counted?
Check with legal that this basis is open to you. Article 16 of the Saudi Regulations requires a documented assessment before processing and does not allow the basis for sensitive data.
Who should fill it in
Do not fill it in alone. Put fleet operations, HR, IT or security and the data protection contact in one session, and ask drivers or their representatives. Large customers and auditors often ask to see the finished worksheet when you propose a camera project.
Limits of this worksheet
It gives structure and prompts. It reaches no conclusion, it does not know your devices or your platform, and it does not say that your project meets any law.