GPS tracking and employee privacy: what employers need to know

Vehicle tracking helps you dispatch work, recover stolen vehicles, plan maintenance and answer customers. It also builds a detailed record of where your employees have been. Under the General Data Protection Regulation (GDPR), that record is personal data, and the rules for collecting it are stricter than many companies expect. This guide goes through the questions an employer should answer before and after installing GPS trackers in vehicles that employees drive.

Why a vehicle's position is personal data

The GDPR covers any information about a person who can be identified, and it names location data as one of the ways in which a person can be identified (Article 4(1)). A position on its own may describe only a vehicle. As soon as you know who was driving, through a driver assignment, a tachograph card or a duty roster, it describes that driver.

The Article 29 Working Party, the group of European data protection authorities that the European Data Protection Board (EDPB) later replaced, said the same in its opinion on data processing at work: an employer using vehicle telematics collects data about both the vehicle and the employee using it. Depending on the device, that can include driving behaviour as well as location.

Start with a clear purpose and a lawful basis

Write down why you track before you install anything. Common purposes are dispatching and planning work, protecting vehicles and goods against theft, keeping drivers safe, meeting legal duties and recording business mileage. Purpose limitation (Article 5(1)(b)) means you cannot later reuse the data for something unrelated, such as judging individual performance, without checking that the new purpose is compatible with the original one.

Then choose the lawful basis in Article 6 that fits each purpose:

• Legitimate interests (Article 6(1)(f)) is the usual basis for fleet tracking in private companies. It needs a balancing test: your interest must not be outweighed by the employee's rights, and the tracking must be necessary for the purpose.
• Legal obligation (Article 6(1)(c)) covers records the law requires, such as tachograph records for professional drivers. It does not cover every other use of the same tracker.
• Public task (Article 6(1)(e)) is the basis for public authorities, which cannot rely on legitimate interests when they carry out their tasks.
• Consent (Article 6(1)(a)) rarely works at work. The EDPB considers it unlikely that employees can freely refuse their employer, so consent is generally not the right basis for tracking them.

Tell drivers before tracking starts

Under Article 13, employees must be told, clearly and before the tracking starts, who is tracking them, why, on which lawful basis, who will see the data, how long it is kept and which rights they have. The Working Party also recommends a visible notice in every tracked vehicle, within sight of the driver, and the UK Information Commissioner's Office (ICO) expects employers to inform both workers and passengers about vehicle monitoring.

• A written vehicle tracking policy, given to every driver
• A short notice in each tracked vehicle
• An update to the policy whenever you add a purpose or a new kind of reading, such as fuel levels or harsh braking
• The involvement of staff representatives or a works council before the system goes live, where national law requires it

Collect only what you need

Data minimisation (Article 5(1)(c)) applies to every reading a tracker sends. Modern trackers can report speed, harsh braking, fuel level, engine data and much more. Decide which of these serve the purposes you wrote down, and leave the rest unused. The Working Party put the principle plainly:

“Vehicle tracking devices are not staff tracking devices. Their function is to track or monitor the location of the vehicles in which they are installed. Employers should not regard them as devices to track or monitor the behaviour or the whereabouts of drivers or other staff, for example by sending alerts in relation to speed of vehicle.”
Article 29 Working Party, Opinion 2/2017 on data processing at work, quoting its Opinion 13/2011

Monitoring how someone drives is harder to justify than knowing where a vehicle is. The ICO says employers must carry out a data protection impact assessment before monitoring driver behaviour or driving style, and France's data protection authority, the CNIL, says geolocation must not be used to check that drivers respect speed limits. If you want alerts about speed or harsh driving, assess them on their own and explain them to drivers.

Company cars used privately

Private use is where vehicle tracking most often goes wrong. If employees may drive a company car after work, at weekends or on holiday, tracking them during that time is very hard to justify. The Working Party considered it unlikely that there is a lawful basis for monitoring vehicle locations outside agreed working hours. Where private use is allowed, it said, the employee should in principle be able to switch location tracking off temporarily when the circumstances justify it, for example for a visit to a doctor.

National authorities go in the same direction:

• In France, the CNIL says employees must be able to switch off the collection or transmission of their location outside working time, which includes breaks and the journey between home and work.
• In the United Kingdom, the ICO says employers will rarely be able to justify monitoring during private use, and gives the example of a tracking system that the driver can switch off outside working hours.

If you need some protection outside working hours, for example against theft, the Working Party suggests a proportionate design: the location is not recorded outside working hours unless the vehicle leaves a wide, predefined area, and only then is it shown. The CNIL is stricter: in France, location must not be collected outside working time, even to prevent theft.

Whatever you choose, keep business and private kilometres apart, and agree in writing how private use is declared.

Limit who sees what

The GDPR asks for appropriate security and confidentiality (Articles 5(1)(f) and 32), so location data should be visible only to the people who need it. A dispatcher needs today's positions; an accountant usually needs none. Give each role the narrowest access that works, keep a record of who has access, and review it when people change jobs.

Take the same care with live location links for customers. Share a vehicle's position only for as long as the delivery or visit needs, and stop the link afterwards. The CNIL adds that the driver's name should not be passed on to clients unless it is essential.

Keep location history only as long as you need it

Storage limitation (Article 5(1)(e)) requires a defined retention period for each purpose. The GDPR sets no fixed number, but national guidance gives an idea of the scale. The CNIL, for example, says geolocation data should in principle be kept for no more than two months, for up to one year when it is used to optimise rounds or to prove work done where no other proof is possible, and for up to five years when it is used to record working time.

Write your retention periods into the tracking policy and into your record of processing activities (Article 30), and delete or anonymise history you no longer need.

Check whether you need a DPIA

A data protection impact assessment (DPIA) is required when processing is likely to result in a high risk to people's rights (Article 35). The Working Party's DPIA guidelines list criteria that point to a high risk, among them systematic monitoring and data about vulnerable people, a group that explicitly includes employees. They also treat location data as highly personal. In most cases, processing that meets two criteria needs a DPIA, and systematic tracking of employees' vehicles usually meets at least two.

A DPIA describes the purpose, why the tracking is necessary and proportionate, the risks to drivers and the measures that reduce them, such as a private mode, access limits and short retention. If you have a data protection officer, ask for their advice from the start.

Answer drivers' requests

Drivers keep their GDPR rights over tracking data. They can ask for a copy of the data about them (Article 15), have wrong data corrected (Article 16) and, where you rely on legitimate interests, object to the processing (Article 21). Decide in advance who answers such requests and how you will export one driver's trips and positions for a given period.

National rules in addition to the GDPR

Article 88 lets each country set more specific rules for data processing at work, and labour law often adds requirements of its own. Some examples:

• Germany: under § 87(1) no. 6 of the Works Constitution Act (BetrVG), the works council has a right of co-determination over technical systems designed to monitor the behaviour or performance of employees, which usually includes vehicle tracking.
• France: staff representatives must be informed or consulted before a geolocation system is installed, and the CNIL guidance described above applies.
• Italy: Article 4 of the Workers' Statute (Law 300/1970) allows equipment that can also monitor workers remotely only for organisational and production needs, safety at work or the protection of company assets. It normally needs an agreement with the workplace union representatives or an authorisation from the National Labour Inspectorate, and workers must be told how the equipment is used and how checks are made.
• United Kingdom: the UK GDPR applies, and the ICO's guidance on monitoring workers covers vehicle tracking in detail.
• North Macedonia: the Law on Personal Data Protection (Official Gazette No. 42/2020, amended by No. 294/2021 and No. 101/2025) is aligned with the GDPR and is supervised by the Personal Data Protection Agency.

If your drivers are employed in several countries, check the rules in each of them.

A checklist before you switch tracking on

1. Write down each purpose and its lawful basis.
2. Decide which readings you will use, and leave out the rest.
3. Set the rules for private use and for pausing tracking.
4. Choose who can see positions, history and driver details.
5. Set a retention period for each purpose.
6. Carry out a DPIA, or record why you do not need one.
7. Involve staff representatives where the law requires it.
8. Inform every driver, and put a notice in each vehicle.
9. Add the tracking to your record of processing activities.
10. Ask your provider where the data is stored, and sign a data processing agreement with it.
11. Review the set-up once a year, and whenever you add a purpose.

How Office Hero supports these steps

Fleet Hero, the fleet management app of Office Hero, cannot make your tracking lawful on its own, but it gives you the controls the guidance describes:

• Privacy pause: while a pause is on, the vehicle's positions are discarded as they arrive and never stored. The private distance is still counted, from the odometer or from speed and time, and the live map and share links show the vehicle as paused.
• Scheduled private periods: book a private period in advance, up to 31 days long and up to a year ahead, and recording stops and restarts on its own.
• Audited pauses: every pause is recorded, and people without the pause permission do not see the feature at all.
• Roles and record rules: limit each person to the vehicles, drivers and geozones they need. Drivers see only their own vehicles by default.
• Alerts only where you choose: Fleet Hero raises alerts only from rules that someone in your company has created, or when someone raises one by hand.
• Expiring share links: a live location link lasts 15 minutes, 1 hour, 24 hours or 7 days, can be stopped at any time, and shows the vehicle, not the driver's name.

Starting a pause needs a permission that you give to staff, and Office Hero Connect, where drivers sign in, has no pause button. Decide in your policy who pauses tracking for drivers and how drivers ask for it.

An estimated road route across a closed private period can be drawn on request by people with a separate permission. Company admins hold it, and so do people with the built-in Fleet Manager role, because it comes with their full access to Fleet Hero. The estimate is always labelled as such and kept out of trips, reports and exports. Because it shows the likely route of a private journey, say in your policy when it may be used, and give fleet managers who should not have it a custom role without it.

Fleet Hero has no setting yet that deletes location history automatically after a period you choose. Discuss your retention period with us before tracking starts.