A crew of eight lands in Manchester at 23:50 after a four-sector day. The hotel is forty minutes away on a good night. The first transfer vehicle arrives on time; the second is late, and when it comes it is from a different operator than the one booked. The last crew member reaches their room at 01:25.
Rest, in any sensible reading of fatigue and rest rules, starts when the crew member reaches the hotel, not when the aircraft stops on stand. Nobody wrote down 01:25. Six months later a safety review asks what time the crew actually got to bed before an early report. The operator has a hotel invoice, a transport invoice and an email chain.
That gap is where duty of care is now being tested. The expectation from safety teams, insurers, crew representatives and auditors has moved from "a room was booked" to "show us the evidence of the whole journey". Here is what that evidence looks like, and how to produce it without turning crews into data-entry clerks.
From a booking to a journey
For a long time crew accommodation and transport were procurement problems: negotiate a rate, book a room, book a car, pay the invoice. If the crew arrived safely and the invoice matched the rate, the job was done.
The questions being asked now are different in kind. Was the transfer time between aircraft and hotel within the planning assumption used to calculate rest? Was the vehicle licensed and insured for hire, and was the driver the one the operator vetted? Was the hotel accessible for the crew member who needed step-free access, and secure at 01:25 on a Tuesday? When something went wrong, who was told, when, and what happened next?
None of those questions can be answered from an invoice, only from a record of the journey as it actually happened.
What a defensible data trail contains
A defensible trail is not a longer report. It is a set of facts captured at the moment they occur, by the system best placed to capture them, and stored so they cannot be quietly rewritten later. In practice it covers the following.
- Timestamps for each stage: aircraft on stand, crew clear of the terminal, vehicle departed, vehicle arrived, check-in complete, and the same in reverse the next morning.
- Vehicle and driver identity: registration, operator, licence category, and the named driver who actually performed the job, not the one originally assigned.
- Confirmation records: who confirmed the room, the car and any change, through which channel, and when.
- Change history: every amendment to the plan, who made it, why, and the previous value.
- Incident records: anything that departed from plan, from a late car to a safety concern at the hotel, with the times it was raised and closed.
If the record cannot say who drove the crew, in which vehicle, and when they arrived, it is not a duty of care record, it is a receipt.
The important word is defensible. A spreadsheet kept by a travel desk after the fact can be accurate, but cannot prove it. A record written by the dispatch system when the driver accepted the job, and by the hotel system when the key was issued, carries its own evidence of when and by whom it was created.
Who asks for it, and why
The first to ask are usually the operator's own safety and fatigue management teams. When a crew member reports fatigue, or an event is reviewed, the day has to be reconstructed, and the transfer and hotel legs are often its least documented part.
Insurers come next: a claim arising from a ground transport incident will turn on whether the vehicle and driver were what the operator believed. Crew representatives and unions increasingly raise accommodation and transport in negotiations, and ask for evidence rather than assurances: transfer times, hotel standards, how often the plan slips. Auditors, internal or from the regulator, want to see that the stated process is the one actually followed, and the trail is the shortest route to showing that.
All of them want the record after the fact, often months later, for a specific crew member on a specific night. A trail that lives in the memory of the travel desk, or across a hundred emails, does not meet that test.
Producing the trail without burdening crews
The wrong answer is to ask crews to log everything. Crew members at 01:25 after four sectors should be going to bed, not filling in a form. Any process that depends on tired people entering data will produce gaps exactly where the record matters most.
The right answer is to capture from the systems that already know. The dispatch platform knows when the driver accepted, arrived and completed the job, and which vehicle was used. The hotel's system knows when the room was confirmed and the guest checked in. The crewing system knows the planned times. Integrated around a single journey record, most of the trail writes itself, and the crew member's only interaction is a tap to confirm the pickup or flag a problem.
Where a supplier cannot provide data automatically, the supplier or the travel desk should fill the gap, with the source and time of entry recorded, so a later reader can tell which facts were captured live and which were reported afterwards. That distinction is itself part of a defensible record.
Handling personal data within the trail
A journey record is personal data. It contains names, movements, and sometimes health or accessibility needs. A thorough trail held without a clear basis would replace one risk with another.
Good practice under GDPR principles will be familiar to anyone who has built an operational system. Collect what the purpose needs and no more: a driver needs a name and a pickup time, not a date of birth. Keep the trail as long as a safety review or a claim could reasonably need it, and no longer. Control access by role, so a hotel sees its own bookings and a crew representative sees what the crew member has agreed to share. Log who viewed the record, not only who wrote it.
Done well, the data trail protects the crew member twice: once by evidencing the care taken on the night, and again by being handled with the same care afterwards.
Key takeaways
- The duty of care question has moved from "was a room booked" to "show the evidence of the whole journey": transfer times, vehicles, drivers and changes.
- A defensible trail is captured at the moment of the event by the system closest to it, with a change history that cannot be quietly rewritten.
- Safety teams, insurers, crew representatives and auditors all ask for the same record, usually months later and for one specific night.
- The trail should come from integrated supplier systems, not from tired crews filling in forms.
- Personal data in the trail needs purpose limits, retention limits and role-based access, applied as carefully as the record itself.