GDPR and GPS vehicle tracking: what a company must do when tracking employees
Tracking the position of company vehicles by GPS is processing of an employee's personal data. GDPR applies, as does national labour law – here is an overview of what you must do and how SaveTrack makes it easier. The national references below are Slovak, since that is where SaveTrack originates; check the equivalents in your own country.
Why GPS vehicle tracking is a GDPR matter
When a company tracks the position of a company vehicle driven by a particular employee, it is processing that person's personal data – position and time together say something about the behaviour of a specific individual. The GDPR (2016/679) applies, along with national data protection law (in Slovakia, Act No 18/2018 Coll.).
In addition, labour law (in Slovakia, Section 13(4) of the Labour Code) requires the employer to inform employees in advance about monitoring and to discuss it with employee representatives. Monitoring therefore cannot be switched on quietly – employees have to know about it.
Which legal basis to use
For GPS tracking of company vehicles, an employee's consent is generally not used (in an employee–employer relationship it is not regarded as freely given). Instead companies most often rely on a legal obligation (keeping a mileage log for tax purposes) and on legitimate interests (protecting assets, operational records, dispatching).
If you rely on legitimate interests, you should have a documented balancing test – demonstrating that tracking during working hours is proportionate and that outside those hours, during private journeys, the position is not tracked or is hidden.
Private journeys: the key rule
If an employee may also use the car privately, the employer must not track their position during private journeys. In practice this is the most common place where companies go wrong.
The answer is a clear separation of journeys into business and private. For a private journey, at most the number of kilometres should be recorded (for tax purposes), while the specific route and addresses stay hidden. SaveTrack does exactly this: every journey has a type of Business, Private or Unclassified, and for a private journey the specific route is masked in the mileage log, reports and exports alike.
The duty to inform – what to give the employee
Before starting monitoring, give drivers a written notice under Article 13 GDPR and amend your internal policy or work rules on the use of company vehicles.
The notice should clearly state: who the controller is and how to contact them, what data is processed (position, route, time, distance, speed), for what purpose and on what legal basis, how long it is retained, to whom it is disclosed and what rights the employee has (access, rectification, erasure, objection, complaint to the supervisory authority).
How SaveTrack helps with GDPR compliance
SaveTrack is designed to make meeting these obligations easier. New journeys are Unclassified by default – the system marks nothing as business automatically; classification stays in the hands of the company or the driver.
Private journeys have their specific route hidden in every output (mileage log, PDF and XLS exports, reports) – only the distance remains. Every manual edit to a journey is moreover recorded in an audit trail (who, when and what changed), which is evidentially useful in both tax and data protection inspections.
Data with us is always stored encrypted – never as readable text in the database; every customer has their own encryption key and the keys are guarded separately from the data. Any breach of the database would therefore yield nothing but unreadable ciphertext. We also have a template monitoring notice for employees, which you simply complete with your own details.
A short checklist before you start
Before switching monitoring on, go through: the legal basis identified (and, for legitimate interests, a balancing test); employees informed in writing with signed acknowledgement; discussion with employee representatives, or an amendment to the work rules; permissions and rules for private journeys set up; an updated record of processing activities (Article 30); a processor agreement concluded with the system provider (Article 28); and a retention period set.
This is a practical aid, not legal advice – if in doubt, consult a lawyer or your data protection officer.
FAQ
Do I need an employee's consent for GPS tracking?
Generally no – consent is not regarded as freely given in an employee–employer relationship. Monitoring usually rests on a legal obligation (the mileage log) and the company's legitimate interests. You must, however, inform employees about the monitoring in writing in advance.
Can I track a driver during private journeys too?
No. If an employee may use the car privately, you must not track their position during private journeys. At most the number of kilometres is recorded, while the specific route stays hidden. SaveTrack masks private routes in its outputs automatically.
What must the notice to employees contain?
Who the controller is and how to contact them, what data is processed and for what purpose, the legal basis, the retention period, to whom the data is disclosed and what rights the employee has, including the right to complain to the supervisory authority. We provide a template notice.
How long may I retain journey data?
Only for as long as is necessary for the purpose, typically in line with archiving and tax retention periods (for accounting documents, for instance). Once the period expires, the data is erased or anonymised. Set the specific period according to your own obligations and consult your accountant.
Is GPS data safe with SaveTrack?
Yes. Data is always stored encrypted – never as readable text in the database. Every customer has their own encryption key and the keys are guarded separately from the data, so any breach of the database would yield nothing but unreadable ciphertext. Security is at bank level and in line with GDPR.
Want GPS tracking that has GDPR in mind?
GPS tracking from €6/month, with the GPS device included on annual payment.
Order with no obligation