Yes, insurers can make a Thatcham-approved tracker a condition of cover on a company car, and increasingly do for keyless, high-value or high-theft-risk models. Meeting that condition means fitting a Thatcham-certified S7, S5 or S5+ device through an accredited engineer, keeping the monitoring subscription active, and holding a valid Certificate of Installation. Miss any one of those elements and an insurer can lawfully decline a theft claim.
TL;DR:
- Insurers require a Thatcham S7, S5, or S5+ device, installed by an accredited engineer, with an active monitoring subscription and a valid Certificate of Installation.
- Devices fitting the criteria must have own power sources, tamper alerts, and comply with Thatcham standards; manufacturer tags or DIY installations do not meet these requirements.
- Lapsed monitoring subscriptions or missing installation certificates can invalidate a theft claim, even if hardware is Thatcham certified.
- Employers using trackers for company cars must adhere to GDPR, providing transparency and obtaining employee consent before fitting devices.
- Our standard wired packages cost £169 for S7, £349 for S5 and £449 for S5 Plus, including professional fitting, plus £10.99/month monitoring. First-year totals are £300.88, £480.88 and £580.88 respectively, excluding optional extras and counting the first monitoring month once. Prices checked on 30 September 2026; fitting is subject to compatibility, coverage and appointment confirmation. See our current cost comparison.
Table of Contents
- What “Thatcham approved” actually means: S7, S5 and S5+ explained
- Why insurers demand certified trackers and what happens if you don’t have one
- The three things that must all be in place: device, installer, certificate
- How to confirm exactly what your insurer needs
- What it costs and what it might save on your premium
- Common pitfalls that quietly void your cover
- UK regulations governing company car tracking, GDPR and employee privacy
- What employers must tell staff before fitting a tracker
- What you can and can’t do with the tracking data you collect
- How long you can keep tracking data and how to handle it
- What happens if an employer or insurer gets this wrong
- Why the compliance gap is bigger than most fleets realise
- Get a compliant tracker fitted without the guesswork
- Sources
- FAQ
What “Thatcham approved” actually means: S7, S5 and S5+ explained
Thatcham Research tests and certifies vehicle security systems against fixed technical standards, and the certification covers the whole system, not just the box fitted under the dashboard. That means the device, the fitting procedure and the monitoring centre all have to meet Thatcham’s product definitions.
Thatcham S7 is the entry standard most insurers specify for everyday cars and vans. To qualify, an S7 device must include:
- GPS location tracking with 24/7 monitoring through a Secure Operating Centre compliant with BS 8591
- A roaming SIM so tracking continues if one network drops out
- Battery back-up, so the tracker keeps working if the vehicle’s power is cut
- Tamper alerts and a direct liaison route to the police
- Fitting by a Thatcham-accredited engineer, never a self-install kit
Our S7 provides monitored location tracking and recovery support. S5 adds Automatic Driver Recognition using a driver tag; recognition alone does not prevent starting. Our standard S5 Plus adds tag-operated No Tag, No Start immobilisation. S5 Plus is a package description, not a separate Thatcham certification category. Confirm the exact device and installation requirements with your insurer.
Pro Tip: If your logbook or renewal letter still says “Cat 5” or “Cat 6”, don’t assume it’s outdated. Thatcham retired those labels in favour of S5 and S7, and most insurers now map the old categories directly across, but it’s worth confirming rather than guessing.
Why insurers demand certified trackers and what happens if you don’t have one
Insurers lean on Thatcham certification because it gives them a consistent, independently tested benchmark for theft risk and recovery capability across every vehicle they underwrite. A device that’s merely “GPS-enabled” tells an underwriter almost nothing; an S7 or S5 rating tells them exactly what it can do and how fast police can be alerted.
That reliance isn’t theoretical. A Financial Ombudsman Service decision shows precisely how this plays out at claims time.
An insurer had written a policy endorsement requiring an anti-theft tracking device to be “in operation at all times.” When the vehicle was stolen, the insurer refused the claim because the fitted device lacked independent power and continuous transmission of its own, and the Ombudsman upheld that refusal.
The case turned on a distinction that catches many owners out:
- Manufacturer-fitted connectivity features (like an infotainment system’s location service) are not the same as a dedicated anti-theft tracker
- A qualifying device needs its own battery, its own tamper resistance, and continuous operation independent of the car’s systems
Thatcham certification alone doesn’t force an insurer’s hand either. Insurers still set their own endorsements and acceptance thresholds; certification simply removes the ambiguity about what the device can do.
The three things that must all be in place: device, installer, certificate
A Thatcham S7 or S5 unit bought in a box and fitted at home satisfies none of the insurer’s conditions, however good the hardware is. Certification covers the complete chain: device, fitting method and monitoring link. Break that chain and, according to Thatcham Trackers’ own guidance, the certification is effectively void from the insurer’s point of view.
Three things need to be true simultaneously for cover to hold up:
- Fit the exact device and category accepted by your insurer. S5 adds Automatic Driver Recognition; if start prevention is required, confirm the compatible immobilisation feature separately.
- A Thatcham-accredited engineer carried out the installation, and issued a Certificate of Installation confirming the fitting date, device serial number and category.
- The monitoring subscription stays active. A tracker with a lapsed subscription is, from an insurer’s perspective, no different to having no tracker at all.
Pro Tip: Keep a digital copy of your installation certificate somewhere separate from the vehicle, such as your fleet management system or email. If the car is stolen, the certificate is often the first document a claims handler asks for, and you won’t have access to the glovebox.
How to confirm exactly what your insurer needs
Don’t assume your policy wording matches a generic guide, because tracker conditions vary between insurers and even between policy tiers. A short phone call before you buy anything saves a much longer argument later.
Ask your insurer directly:
- Which Thatcham category does the policy specify: S7, S5 or S5+?
- Do they maintain an approved device list, and can they confirm it in writing?
- Does the policy require a Certificate of Installation as evidence, and where should it be sent or stored?
- What wording appears in the schedule or endorsement about “continuous operation” or monitoring?
Once you have answers, check the device and installer against Thatcham’s own accreditation records rather than taking a seller’s word for it, and file the written confirmation alongside your policy documents.
What it costs and what it might save on your premium
Our standard wired packages cost £169 for S7, £349 for S5 and £449 for S5 Plus, including professional fitting, plus £10.99/month monitoring. First-year totals are £300.88, £480.88 and £580.88 respectively, excluding optional extras and counting the first monitoring month once. Prices checked on 30 September 2026; fitting is subject to compatibility, coverage and appointment confirmation. See our current cost comparison.
Premium savings are real but inconsistent. Industry guidance suggests reductions ranging roughly from 5% to 20%, depending heavily on the insurer, the vehicle and its risk profile.
For some vehicles, the cost question doesn’t really apply, because motorhomes and high-value or keyless cars increasingly can’t get cover without a certified tracker in the first place. Whatever your vehicle, get two quotes from your insurer, one with the tracker declared and one without, before you commit to a specific device.
Common pitfalls that quietly void your cover
Most claim disputes trace back to a handful of avoidable mistakes rather than faulty hardware.
- Fitting a non-certified DIY tracker because it looked similar to an approved one
- Assuming an old “Cat 5” or “Cat 6” label still satisfies a modern policy without checking
- Letting the monitoring subscription lapse after the first renewal, often unnoticed for months
- Losing or never receiving the Certificate of Installation
- Using a non-accredited installer, or fitting the unit somewhere that breaks its link to the Secure Operating Centre
Pro Tip: Set a calendar reminder a month before your monitoring subscription renews. Lapsed cover linked to lapsed subscriptions is, by most accounts, a far more common cause of denied claims than the tracker hardware itself, based on industry guidance.
UK regulations governing company car tracking, GDPR and employee privacy
Fitting a tracker to a company car isn’t purely an insurance matter. Once a vehicle is used by an identifiable employee, UK GDPR and the Data Protection Act 2018 apply, because location data tied to a named driver counts as personal data. Employers processing that data need a lawful basis, most commonly “legitimate interests,” and must be able to justify why tracking is proportionate to the business need, whether that’s insurance compliance, fleet safety or asset recovery.
The Information Commissioner’s Office expects employers to run a data protection impact assessment where tracking is likely to affect employee privacy significantly, particularly if the vehicle is also used outside working hours. Covert monitoring, fitting a tracker without informing the driver, sits in a much riskier legal position and is generally only defensible in narrow circumstances such as a specific fraud or theft investigation, not as routine practice.
None of this conflicts with the insurance requirement to fit a Thatcham-approved device. The two obligations run in parallel: the tracker itself satisfies the insurer’s theft-recovery condition, while how the resulting data is collected, stored and used has to satisfy data protection law separately. Thatcham Trackers’ guidance on GDPR compliance for fleets sets out the practical distinction fleet managers most often miss between fitting the device and governing its data.
What employers must tell staff before fitting a tracker
Transparency is the foundation of lawful tracking. Before any device goes into a company car, employees should know it’s there, why it’s fitted, and broadly what data it collects. Silence or a buried clause in an employment contract rarely counts as adequate notice under GDPR’s fairness principle.
Good practice, drawn from established fleet compliance guidance, usually includes:
- A written company vehicle tracking policy, distributed and acknowledged separately from the general employment contract
- A clear statement of purpose (insurance compliance, safety, theft recovery, fuel efficiency)
- An explanation of what data is collected, who can access it, and for how long
- A named contact for questions or data access requests
A policy document doesn’t need to be lengthy to do its job. Thatcham Trackers’ guidance on company vehicle tracking policy sets out the sections most fleets need, from consent and purpose through to data-sharing rules.
Consultation matters as much as notification. Where a recognised trade union or employee representative body exists, best practice is to discuss the introduction of tracking with them before rollout, not after. Employees who feel ambushed by a new monitoring system are far more likely to raise grievances, and a documented consultation process is one of the strongest defences an employer has if a dispute ever reaches an employment tribunal.
What you can and can’t do with the tracking data you collect
Location and journey data collected from a company car tracker has a purpose the moment it’s gathered, and that purpose limits how it can be used afterwards. Data collected to satisfy an insurer’s theft-recovery condition, or to manage fuel and route efficiency, cannot simply be repurposed for unrelated disciplinary action without a fresh, clearly communicated justification.
Generally permitted uses include verifying vehicle location for insurance and recovery purposes, monitoring fuel efficiency and route planning, confirming working hours for pay or expenses where employees have been told this is a purpose, and investigating a specific, documented incident such as suspected theft or serious misconduct.
Generally prohibited or high-risk uses include covert monitoring of personal time when a vehicle is available for private use, using tracking data to build a case against an employee for something entirely unrelated to the stated purpose, sharing granular location data with third parties beyond the insurer or monitoring centre without consent, and retaining data indefinitely with no defined purpose or deletion schedule.
The test that data protection law applies isn’t whether tracking is useful. It’s whether the specific use was disclosed at the point data was collected, and whether it remains proportionate to that original purpose.
How long you can keep tracking data and how to handle it
UK GDPR’s storage limitation principle requires personal data to be kept no longer than necessary for the purpose it was collected for, and vehicle tracking data is no exception. There’s no single statutory retention period fixed for tracking data specifically, which means employers have to set and justify their own retention schedule rather than defaulting to “keep everything indefinitely.”
In practice, most fleet policies distinguish between routine journey data, often retained for a matter of weeks or a few months for operational review, and data preserved specifically because it relates to an active insurance claim, investigation or legal proceeding, which can be held for as long as that matter remains open. Once the purpose has passed, the data should be securely deleted or anonymised, not left sitting on a server indefinitely on the assumption it might be useful someday.
Handling matters as much as retention length. Access to raw tracking data should be limited to people who need it for a defined role, whether that’s a fleet manager reviewing routes or an insurer investigating a claim, and stored securely with the same standard of protection as any other personal data an employer holds. Documenting the retention schedule in the written tracking policy, rather than leaving it undefined, is one of the simplest steps that separates a defensible fleet from one exposed to an ICO enforcement notice.
What happens if an employer or insurer gets this wrong
Two separate legal risks sit either side of company car tracking, and getting either wrong carries real consequences. On the insurance side, the Financial Ombudsman precedent already shows an insurer can lawfully decline a theft claim where a specified tracker condition wasn’t met, leaving the vehicle owner or fleet uninsured for a loss that might have run to tens of thousands of pounds. That risk sits with the vehicle owner or fleet, not the insurer.
On the data protection side, the risk runs the other way, toward the employer. The Information Commissioner’s Office can issue enforcement notices, and in serious cases fines, against employers who monitor staff unlawfully, particularly through covert tracking or by using data for a purpose employees were never told about. Beyond regulatory action, employees who discover undisclosed tracking have grounds to raise grievances or, in cases involving dismissal linked to tracking data, bring claims before an employment tribunal.
The two risks compound each other in practice. A fleet manager who fits the right Thatcham device but never tells staff, or who tells staff but never documents consent, has solved the insurance problem while creating a data protection one. Getting both right isn’t complicated, but it does require treating them as two distinct compliance tasks rather than one box to tick.
Why the compliance gap is bigger than most fleets realise
The mistake we see most often isn’t a bad tracker. It’s the assumption that buying a Thatcham-certified device is the finish line, when it’s really the starting point. Thatcham Research sets the benchmark, but certification only holds together while the installer, the monitoring link and the paperwork stay intact.
That’s the standard we build every fitting around. A professional installation and a Certificate of Installation aren’t paperwork for its own sake; they’re the evidence that stands between a policyholder and a declined claim.
— Thatcham Trackers
Get a compliant tracker fitted without the guesswork
Working out which category your insurer wants, then finding an accredited engineer to fit it correctly, is where most owners lose time and where most claim disputes start. Thatcham Trackers sells Thatcham S7 and Thatcham S5 devices with nationwide accredited fitting built in, so the certificate your insurer asks for arrives as part of the order, not as a separate hunt afterwards.
For keyless or high-value vehicles that need Automatic Driver Recognition or full immobilisation, the Thatcham S5 Plus and Casper immobiliser range cover the higher-risk end of the market. Fleets planning wider vehicle infrastructure changes alongside compliance may also find guidance on commercial EV charger installation useful when budgeting for the year ahead.
Before you order, call your insurer and confirm in writing which S-category they require for your specific vehicle and policy. Once you have that answer, choosing the right device and booking accredited fitting takes a few minutes on the Thatcham Trackers site.
Sources
- Decision Reference DRN-6144201 (Financial Ombudsman Service)
- Vehicle security product definitions and guidelines (Thatcham Research)
FAQ
Do I legally have to fit a Thatcham tracker to my company car?
There’s no general law forcing every company car to have one, but your insurance policy can make it a condition of cover. If your schedule specifies an S7, S5 or S5+ device and you don’t fit one, an insurer can decline a theft claim on that basis alone.
What’s the difference between Thatcham S7 and S5?
Our S7 provides monitored location tracking and recovery support. S5 adds Automatic Driver Recognition using a driver tag; recognition alone does not prevent starting. Our standard S5 Plus adds tag-operated No Tag, No Start immobilisation. S5 Plus is a package description, not a separate Thatcham certification category. Confirm the exact device and installation requirements with your insurer.
How much does a Thatcham-approved tracker cost?
Our standard wired packages cost £169 for S7, £349 for S5 and £449 for S5 Plus, including professional fitting, plus £10.99/month monitoring. First-year totals are £300.88, £480.88 and £580.88 respectively, excluding optional extras and counting the first monitoring month once. Prices checked on 30 September 2026; fitting is subject to compatibility, coverage and appointment confirmation. See our current cost comparison.
Can my employer track my company car without telling me?
Generally no. UK GDPR requires employers to have a lawful basis and to inform employees that tracking is taking place, what data it collects and why. Covert tracking is only defensible in narrow circumstances, such as investigating a specific suspected theft or fraud, not as routine monitoring.
What happens if my tracker’s monitoring subscription lapses?
A tracker with a lapsed subscription is treated the same as having no tracker at all for insurance purposes, since the Secure Operating Centre link is what makes the device certified. This is one of the most common reasons cover disputes arise, more often than any fault with the hardware itself.