Vehicle Tracking Laws UK: What You Need to Know

Vehicle tracking is legal for UK businesses, but only when it's carried out transparently, proportionately and with a properly documented lawful basis under UK GDPR and the Data Protection Act 2018. This guide breaks down exactly what fleet operators and business owners need in place before switching on GPS tracking, so you stay compliant while still getting the operational benefits.

The Legal Framework Governing Fleet Tracking

Two pieces of legislation sit at the centre of every vehicle tracking decision in the UK. UK GDPR and the Data Protection Act 2018 govern how personal data, including location data tied to a named driver or identifiable vehicle, can be collected, processed and stored. The Human Rights Act 1998 also plays a role, since continuous location monitoring can engage an employee's right to privacy even while they're on the clock.

Location data becomes personal data the moment it can be linked back to an identifiable individual, which in a fleet context is almost always the case. That means the standard data protection principles apply in full from the moment a tracker starts logging journeys, not just when something goes wrong.

Establishing a Lawful Basis for Tracking

This is the part businesses most commonly get wrong. Consent might feel like the obvious route, but it's widely considered insufficient on its own for employee vehicle tracking, since an employment relationship carries an inherent power imbalance that makes freely given consent difficult to demonstrate.

Most fleet operators instead rely on one of two lawful bases under Article 6 of UK GDPR:

• Legitimate interests, the most commonly used basis for employer tracking, which requires a documented balancing test showing the business's operational interest outweighs the driver's privacy rights
• Performance of a contract, applicable where tracking is a genuine, stated requirement of the employment contract or a specific service agreement

A third basis, legal obligation, applies specifically where tachograph rules or similar regulations mandate location recording for heavier commercial vehicles. Whichever basis you rely on, it needs to be documented, specific to your actual use case, and ready to produce if the Information Commissioner's Office ever asks.

Notifying Drivers Before Tracking Starts

Regardless of which lawful basis applies, transparency is non-negotiable. Employers must notify drivers in writing before any tracking begins, clearly explaining what data is collected, why, how long it's retained, and who can access it. Tracking employees without their knowledge is illegal, even where a legitimate business reason exists for doing so.

This notification typically takes the form of a written privacy notice specifically covering GPS tracking, distinct from a general staff handbook mention. It should be given to every worker who will actually be tracked, not just referenced in general terms during onboarding.

When a Data Protection Impact Assessment Is Required

A DPIA becomes a legal requirement when tracking is systematic, large scale, or involves continuous monitoring of employees. In practice, this covers most genuine fleet tracking deployments rather than being a rare edge case.

The assessment should weigh the necessity and proportionality of the tracking against the privacy impact on drivers, and it forms part of the documented evidence a business needs if its approach to tracking is ever challenged. Skipping this step is one of the more common compliance gaps businesses discover only after an issue has already arisen.

Personal Use and the Need for a Privacy Mode

Where drivers use a company vehicle for personal journeys outside working hours, continuous 24/7 tracking without justification is likely to breach the proportionality requirements built into UK GDPR. This is why a genuine privacy or off-duty mode matters, allowing tracking to pause during personal use rather than running indefinitely regardless of context.

GPSBob's fleet trackers support exactly this kind of proportionate monitoring, with geofencing available through the Professional and Enterprise plans that alerts businesses to vehicle use outside operational hours, rather than defaulting to blanket, always-on surveillance regardless of whether a vehicle is on a job or parked at a driver's home overnight.

Employee-Owned Vehicles Are a Different Matter Entirely

The rules shift considerably when a vehicle belongs to the employee rather than the business, even if it's occasionally used for work purposes. Fitting a tracker to a personally owned car without the owner's written permission is not lawful, regardless of any business justification, and consent here must be freely given without pressure.

If your business relies on staff using their own vehicles for deliveries or site visits, this is worth addressing directly in policy, since it's a genuinely different legal position from tracking company-owned assets.

Retention Periods and Data Minimisation

Holding location data indefinitely isn't defensible under UK GDPR's data minimisation principle. Retention periods should be justified by an actual business purpose, and different types of data typically warrant different retention windows:

• Route history kept for dispute resolution is commonly justified for around 90 days
• Tachograph compliance data must be retained for a minimum of 12 months under EU tachograph regulation
• Real-time tracking data with no ongoing documented purpose should generally be deleted within 30 days

Access to this data should also be restricted to roles with a genuine business need, rather than being visible to anyone within the organisation who happens to have a login.

Getting Fleet Tracking Right From the Start

Compliance isn't a one-off box to tick before switching a system on, it's an ongoing responsibility that needs a documented lawful basis, a current privacy notice, and a clear retention policy sitting behind whatever tracking technology a business chooses to deploy. Getting this foundation right protects the business just as much as it protects driver privacy.

Once that groundwork is in place, choosing the right hardware becomes considerably more straightforward. GPSBob's fleet trackers are built for businesses of every size, from a single van through to a full HGV fleet, with no long-term contracts or monthly fees locking operations in.

Real-time visibility across the entire fleet from one dashboard supports the legitimate business interests that most fleet tracking relies on legally, whether that's route verification, theft prevention, or confirming a delivery's location for a customer, while the Professional and Enterprise plans add the geofencing and reporting tools that help demonstrate tracking is being used proportionately rather than as blanket surveillance.

FAQs

Can tracking data be used as evidence in a disciplinary hearing?

Yes, provided employees were properly informed about the tracking beforehand and the data was collected lawfully, it can support a disciplinary process alongside other evidence.

Does a business need separate consent for each new employee who drives a tracked vehicle?

Not necessarily consent specifically, but each new employee must still receive the written privacy notice explaining the tracking before they begin driving a monitored vehicle.

Are there specific rules for tracking HGVs compared with vans or cars?

Yes, HGVs and certain commercial vehicles fall under additional tachograph regulations that mandate location and driving time recording regardless of the GDPR basis used for general tracking.

What happens if a business is found non-compliant with vehicle tracking laws?

Penalties can reach up to £17.5 million or 4% of global annual turnover under UK GDPR, alongside potential reputational damage and employee grievances.

Can employees request access to their own tracking data?

Yes, under UK GDPR employees have the right to request access to personal data held about them, including historical location and journey records collected through vehicle tracking.