Vehicle tracking is lawful in the UK when controllers meet UK GDPR and Data Protection Act 2018 duties. Fleet managers and employers should identify a lawful basis, consider whether a Data Protection Impact Assessment is needed and talk to staff before fitting devices. We outline the framework below, with reference to ICO and ACAS guidance, so you can roll out tracking correctly from day one.
TL;DR:
- For legitimate interests, document the purpose, why tracking is necessary rather than a less intrusive option, and how employee privacy expectations are balanced.
- Before systematic location monitoring begins, complete a DPIA covering necessity, alternatives, safeguards, and remaining risks; consult the ICO if high risks remain.
- Tell staff in writing before installation, consult them on a policy, and offer private mode or automatic deactivation outside work hours for personal use.
- Publish a retention period tied to the stated purpose, restrict access, and verify an approved transfer mechanism before a provider processes data outside the UK.
- Before relying on tracker records in a disciplinary case, confirm the disclosed purpose covers it, check accuracy and vehicle sharing, and let employees challenge evidence.
Table of Contents
- Legal framework: UK GDPR, the Data Protection Act 2018 and related duties
- Lawful bases and legitimate interests: applying the ICO three-part test
- DPIAs and high-risk processing: when you must carry one out
- Notice, consent and employee rights: who you must tell and when
- What to collect, minimisation and keeping data secure
- Using tracker data in disciplinary cases: fairness and evidence
- Policy checklist and operational steps for a compliant rollout
- Practical implementation: private mode, processor checks and a working pro tip
- Pairing insurer-approved hardware with privacy-compliant deployment
- Thatcham-approved trackers and nationwide fitting for UK fleets
- FAQ
- Sources
Legal framework: UK GDPR, the Data Protection Act 2018 and related duties
Vehicle and telematics data counts as personal data whenever it can identify a driver, so UK GDPR and the Data Protection Act 2018 apply to almost every fleet tracking system in use today. Location data, timestamps and driving behaviour logs all fall within scope, and the organisation that decides why and how tracking happens is the data controller with full accountability for that processing.
Several core principles shape what a compliant system looks like. Processing must have a lawful basis, be limited to a specified purpose, collect no more data than needed, and be kept no longer than necessary. Controllers must also apply appropriate security measures and be able to demonstrate compliance on request, not just claim it.
These principles are not abstract. A council fleet privacy notice, for example, sets out that tracking data is used for vehicle performance monitoring and as evidence in claims, while limiting how geospatial data is linked to identifiable drivers except where the law requires it. That kind of scoped, published purpose is what the Data Protection Act 2018 expects from any organisation running a tracking programme.
Other privacy considerations may also be relevant where monitoring is continuous or covers personal time, particularly for vehicles that double as personal transport. Where cameras are fitted alongside trackers, consider whether their use is proportionate and well governed.
None of this makes tracking difficult, but it does mean skipping the paperwork is the real risk. A lawful basis, a documented purpose and a retention schedule are the foundation everything else in this guide builds on.
Lawful bases and legitimate interests: applying the ICO three-part test
Most fleet tracking relies on legitimate interests as its lawful basis, and the ICO’s guidance on legitimate interests sets out a three-part test that controllers must work through and record.
The first step is the purpose test: identifying a genuine business reason, such as route efficiency, vehicle security, or duty-of-care for lone workers. The second is the necessity test: checking whether tracking is a proportionate way to achieve that purpose, or whether a less intrusive method would do the job just as well. The third is the balancing test, which weighs the organisation’s interest against the employee’s or vehicle user’s privacy rights and reasonable expectations.
Working through this test properly means producing a legitimate interests assessment, usually shortened to LIA. A sound LIA records the stated purpose, the necessity reasoning, the balancing outcome, and any safeguards put in place to reduce intrusion. The ICO’s guidance on the legitimate interests basis recommends considering whether people would reasonably expect the processing and whether they would object if asked, then recording that reasoning in the privacy information given to staff.
Legitimate interests will not always be the right fit. Where tracking data could reveal sensitive information, such as a medical appointment or religious observance, additional safeguards may be needed. For employee-owned vehicles tracked at the employer’s request, consider carefully which lawful basis is appropriate, particularly if tracking could continue outside working hours.
Documenting this reasoning before installation, rather than after a complaint, is what separates a defensible tracking programme from a vulnerable one.
DPIAs and high-risk processing: when you must carry one out
Systematic location monitoring is treated as high-risk processing, and the ICO’s monitoring workers guidance confirms that a Data Protection Impact Assessment is legally required before this kind of tracking goes live. If a fleet system logs continuous location data on individual drivers, assess whether a DPIA is needed before tracking begins.
A proper DPIA needs to show several things clearly. It must set out why tracking is necessary and whether it is proportionate to that need, what mitigations reduce the impact on drivers, what residual risk remains once those mitigations are applied, and what alternatives were considered and ruled out. A DPIA that simply describes the technology without working through these questions will not satisfy the requirement.
Where the assessment shows that high risk remains even after mitigation, seek guidance from the Information Commissioner’s Office before proceeding. This step is rarely needed when sensible mitigations are built in from the start, such as limiting retention, restricting access and offering a private mode, but it exists as a backstop for genuinely intrusive deployments.
For commercial fleets, a DPIA can be a useful place to decide technical safeguards, define who can access location data, and set the retention period stated in the published policy. Treating it as a design exercise rather than a compliance checkbox tends to produce a better system overall.
Notice, consent and employee rights: who you must tell and when
Transparency is not optional. Before tracking starts, the people affected need to know what is being collected, why, how long it is kept and who can access it. This applies whether the vehicle belongs to the business or to the employee.
The distinction between employer-owned and employee-owned vehicles matters for the lawful basis you choose. For company vehicles, employers can usually rely on legitimate interests provided the LIA is sound, but staff should still be consulted and informed in writing before installation. For employee-owned vehicles tracked at work’s request, carefully consider the lawful basis and whether any consent would be a genuine choice rather than a condition buried in a contract.
ACAS guidance on consulting employees recommends that employers agree a written tracking policy with staff input before fitting any device, which reduces disputes later and demonstrates good faith if a complaint ever reaches a tribunal or the ICO.
Practical steps that satisfy both the legal duty and the ACAS expectation include:
- Publish a written tracking policy before installation, not after.
- Fit visible vehicle signage or stickers confirming tracking is in use.
- Post the policy and privacy notice on the staff intranet or equivalent.
- Hold a consultation meeting with staff or their representatives and keep minutes.
- Document the chosen lawful basis for tracking any employee-owned vehicle.
Our guide to vehicle tracking GDPR compliance covers how to build these notices into a working policy document.
What to collect, minimisation and keeping data secure
Good tracking systems collect only what the stated purpose requires. If the purpose is route efficiency or theft recovery, there is rarely a need to capture continuous location data outside working hours, and avoiding that capture where possible is part of meeting the minimisation principle under UK GDPR.
Technical safeguards matter as much as the policy wording. Pseudonymising driver identifiers where full identification is not needed for the stated purpose, encrypting data in transit and at rest, and restricting access through role-based permissions all reduce the chance of a breach causing real harm. Hosting data on UK-based servers where practicable also simplifies the organisation’s accountability obligations and avoids extra cross-border transfer assessments.
Where a tracking provider or its infrastructure stores or processes data outside the UK, the controller needs to check that an adequate transfer mechanism is in place, such as the UK’s own adequacy regulations or appropriate standard contractual clauses, before data leaves the country. This is worth confirming with any processor at the outset rather than discovering it during an audit.
Retention periods need to be set deliberately, not left open-ended. A defensible approach ties the retention period to the stated purpose, for example keeping raw location logs for a matter of weeks for operational use, while aggregated or anonymised data used for reporting can be kept longer because it no longer identifies individuals. Whatever period is chosen should be published in the privacy notice and actually followed: data that sits on a server well past its stated retention window undermines the whole compliance case if challenged.
Our piece on making UK car trackers insurer approved and ICO compliant walks through these minimisation and security steps in more operational detail, alongside the certification side of the process.
Using tracker data in disciplinary cases: fairness and evidence
Tracker data can be used in disciplinary proceedings, but only where it was collected lawfully and for a purpose that was disclosed to the employee in advance. Using data gathered for route planning to justify a dismissal over an unrelated matter, for instance, sits uneasily with the purpose limitation principle and could weaken an employer’s position at tribunal.
Accuracy matters as much as lawfulness. GPS data can be affected by signal issues, device faults or shared-vehicle use, so employers should give the employee a genuine opportunity to respond to what the data appears to show before treating it as conclusive. The ACAS code of practice on disciplinary and grievance procedures, together with general fairness requirements under employment law, expects that evidence used against an employee is put to them clearly and that they can challenge it.
Chain of custody also matters in practice: keeping a clear record of how the data was extracted, who accessed it and when helps if the evidence is disputed later. Surprise reliance on older tracking logs, introduced without warning at a disciplinary hearing, may look procedurally unfair even when the underlying data is accurate.
Automated systems that flag anomalies, such as unexpected stops or route deviations, are useful triage tools, but decisions with real consequences for someone’s employment should involve a human reviewing the context before any sanction follows. Relying solely on an automated flag, without that human check, raises both fairness and accuracy concerns that are better avoided altogether.
Policy checklist and operational steps for a compliant rollout
Bringing all of this together into a working policy is more straightforward when the steps are set out in order. The following checklist reflects what we see fleet managers and HR teams need to cover.
- Define the specific purpose for tracking, such as security, routing or duty-of-care, and record it clearly.
- Choose and document the lawful basis, including a completed legitimate interests assessment where relevant.
- Assess whether a DPIA is needed for systematic location monitoring before devices are fitted.
- Set and publish a retention schedule tied to the stated purpose.
- Define who can access tracking data and under what role-based permissions.
- Publish a subject access request procedure so drivers know how to see their own data.
- Consult staff and keep a written record of that consultation, following ACAS practice.
- Fit visible vehicle signage confirming that tracking is in use.
- Offer a private mode or automatic off-hours deactivation for personal use of company vehicles.
- Vet installers and any tracking software processor for security standards and data-handling terms.
- Set a review schedule to revisit the policy and any DPIA.
- Train relevant staff on incident handling, data access requests and record-keeping obligations.
Our breakdown of 11 policy sections for company vehicle tracking expands each of these into wording that HR teams can adapt directly. Where dashcams are part of the fitting, the ICO’s dashcam guidance is worth checking separately: audio should be off by default, and the use needs to be justified and disclosed in the same way as location tracking.
Practical implementation: private mode, processor checks and a working pro tip
The ICO’s guidance on monitoring methods notes that privacy expectations are higher once a worker is at home or off duty, which is exactly where continuous tracking causes the most friction. Building in an automatic off-hours mode, or letting drivers switch to a private setting when a vehicle is used personally, directly addresses the balancing step in the legitimate interests test and gives the DPIA a concrete mitigation to point to.
On the processor side, it is worth selecting tracking hardware and software that supports pseudonymisation, UK-based hosting and clear audit logs of who accessed what data and when. Recording these technical controls in the DPIA itself, rather than leaving them in a supplier contract nobody reads again, makes the assessment easier to defend if it is ever questioned.
Pro tip: Set private-time journeys to log-only mode with no live monitoring, and configure human review triggers only for genuine incidents such as tamper alerts or theft, so day-to-day driving is not subject to continuous intrusive oversight.
Fleet electronics also need to keep working for any of this to matter: the Autotronics guidance on fleet electronics downtime covers how component failures can create data gaps that complicate both operational reporting and DPIA evidence.
Pairing insurer-approved hardware with privacy-compliant deployment
We sell insurer-approved trackers, which means our role sits at the practical end of this picture: making sure the hardware fitted to a vehicle carries the certification insurers actually recognise. Correct Thatcham certification gives fleets information to reference when describing technical safeguards in a DPIA.
None of this replaces the legal groundwork set out above. A certified device fitted correctly still needs a lawful basis, a DPIA where monitoring is systematic, and a staff consultation process behind it. We would encourage any fleet manager working through a rollout to adapt the checklist in this guide and to consult the ICO’s own pages, or a qualified data protection adviser, where a case raises anything genuinely unusual, such as mixed personal and business use or cross-border fleets.
Thatcham-approved trackers and nationwide fitting for UK fleets
We supply Thatcham-approved trackers with immediate digital certification that UK insurers accept, fitted through a nationwide network of accredited engineers rather than a patchwork of local installers. That combination matters for the compliance picture in this guide: a documented, professional installation is part of the evidence a DPIA or an insurer may ask to see, and a rejected or invalid certificate undoes the rest of your paperwork.
Before you buy, it is worth checking which certification level your insurer requires and whether your vehicle type calls for additional protection:
- Thatcham S7 at £169 one-off suits standard insurer-approved tracking requirements.
- Thatcham S5 at £349 one-off adds driver identification for higher-risk vehicles.
- Thatcham S5 Plus at £449 one-off extends protection further for premium or high-value vehicles.
- The Casper Ghost-Like Immobiliser at £399.00 one-off and Casper Pro at £499.00 one-off add invisible immobilisation alongside tracking.
Our guide to choosing the right Thatcham tracker sets out which level fits which vehicle and insurer requirement, and fitting can be arranged.
This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.
FAQ
Is it illegal to put a tracker on someone’s vehicle in the UK?
Fitting a tracker without a lawful basis or proper notice may raise legal concerns. For covert personal surveillance, seek advice on the specific circumstances. For employer-owned company vehicles, assess whether legitimate interests is an appropriate basis and consult staff. Covertly tracking someone else’s property or person raises distinct concerns, so seek legal advice before proceeding.
Do employers have to tell employees about vehicle trackers?
Yes. The ICO’s guidance on monitoring workers expects transparency before monitoring starts, including what data is collected and why. ACAS further recommends consulting staff and agreeing a written policy before any device is fitted.
Can an employee refuse a tracker fitted to a company van?
An employee cannot usually block legitimate installation on a company-owned vehicle where the employer has a documented lawful basis and has consulted staff, though objections should be heard and recorded as part of that consultation. For an employee’s own vehicle, carefully assess the lawful basis and do not assume that an employee’s objection can be overridden.
How is tracking someone without consent treated under UK law?
Tracking a person without any lawful basis or disclosure, particularly outside an employment context, risks breaching data protection law and can raise separate legal concerns depending on the circumstances and intent. Location data that identifies a person may raise data protection concerns. Anyone unsure whether a specific situation is covered should seek advice from the ICO or a qualified solicitor rather than relying on general guidance.