GPS tracking and employees: what the law actually requires

1. The short answer

Yes, you may track vehicles your company owns and your employees drive for work. No supervisory authority treats vehicle tracking as forbidden in itself.

What makes it lawful is the conditions around it: a defined purpose, a legal basis, drivers who have been informed beforehand, and a scope that stays proportionate to the purpose. Tracking stops being defensible at the point where it becomes continuous surveillance of a person rather than management of a vehicle.

2. Who is responsible for what

The employer is the data controller. You decide why the vehicles are tracked, who sees the data and how long it is kept, so the legal obligations are yours.

The provider is a data processor. Veturo operates the platform on your instructions under a data processing agreement, and does not use your fleet's data for its own purposes.

This split matters in practice: no vendor can make your tracking lawful for you. A provider can give you the agreement, the template and the retention settings; signing off on the purpose and informing your drivers is your side of the line.

3. You need a legal basis before you start

In most fleets the basis is the employer's legitimate interest: protecting vehicles and cargo, coordinating dispatch, proving a delivery took place, keeping mileage and fuel records, driver safety. Where that is the basis, employees may object on grounds relating to their particular situation, and you should be able to show you weighed their interests against yours before starting.

Consent from employees is a weak basis in an employment relationship, because consent given to an employer is rarely considered freely given. Do not build your tracking on it if you can avoid it.

Sometimes a legal obligation applies instead, for example rules on driving and rest times, or the transport of dangerous goods. Where that is the case, name that obligation rather than falling back on legitimate interest.

4. Drivers must be informed before the first trip

The duty to inform is the requirement most often missed, and the easiest one for an authority to check. Before tracking starts, every affected driver should be told, in writing and in plain language: what is recorded, when it is active, why, on what legal basis, who processes it, how long it is kept, what rights they have, and where they can complain.

Informing is not the same as asking permission. If your basis is legitimate interest, you are not seeking consent; you are discharging an information duty. Keep a record that the notice was given.

Veturo clients get a ready-made template for this notice as part of onboarding. It is a starting point to fill in and check against your own rules, not a document to sign blind.

5. Proportionality: where the line usually falls

Track the vehicle for a stated purpose, not the person for the whole day. The practical tests an authority tends to apply: could you achieve the same purpose with less data? Is the tracking active outside working hours? Who inside the company can see individual movements, and do they need to?

Blanket, permanent tracking with no stated purpose and no limits is where cases go wrong. Tracking tied to working hours, with a defined purpose and limited access, is the version that holds up.

Deciding not to collect something is a legitimate configuration choice. If you do not need continuous speed logging or driver scoring for your purpose, do not switch them on.

6. Private journeys

Private use of a company vehicle is where most complaints originate. There are three workable approaches: prohibit private use of tracked vehicles and say so clearly; allow it but switch tracking off outside working hours; or provide a private mode the driver can activate, in which position is not recorded.

Whichever you choose, write it into the notice drivers receive and apply it consistently. The problem is rarely the tracking itself; it is a driver discovering that a weekend trip was recorded when they believed it was not.

7. How long you may keep the data

Retention must follow the purpose. If the point is dispatch and proof of service, that purpose is exhausted long before several years pass.

Veturo keeps six months of route history on Basic and twelve months on Pro and Fleet, after which it is deleted. If you need a longer period for a specific legal reason, that reason should be documented rather than assumed.

Data is stored with providers inside the EU/EEA. Ask any provider you evaluate where the data physically sits. It is a fair question, and the answer should be specific.

8. Before you switch it on: a checklist

Write down the purpose of tracking in one or two sentences, and be able to defend it.

Choose and record the legal basis; where it is legitimate interest, note how you weighed employees' interests.

Give every affected driver a written notice before the first trip, and keep proof that you did.

Decide how private journeys are handled, and put that in the notice.

Limit who can see individual vehicle movements to the people whose job requires it.

Set a retention period that matches the purpose and let the platform enforce it.

Sign a data processing agreement with your provider.

Be ready to answer an access request from a driver about their own data.

9. What Veturo provides, and what it does not

Provided: a data processing agreement, a template notice for drivers, retention periods that match the plan, storage with providers inside the EU/EEA, and access controls in the platform.

Not provided: legal advice, or a guarantee that your particular setup is compliant. That depends on your purpose, your rules and your local law, and it is the employer who answers for it.

This guide is general information and has not been reviewed by a lawyer. Treat it as a starting point for a conversation with your own counsel, not as a substitute for one.