GPS tracker GDPR compliance UK, your obligations explained clearly

GPS tracking records location data that constitutes personal data under UK GDPR when it can be linked to an identifiable individual. Whether you are a parent tracking a family member’s vehicle, an employer tracking company vehicles, or a business tracking assets, different compliance obligations apply depending on your situation. LockCar explains the UK GDPR framework for GPS tracker use clearly and practically.

When GPS tracker data is personal data

GPS location data becomes personal data under UK GDPR when it can be linked to an identifiable individual. A GPS tracker fitted to a company vehicle that is assigned to a specific employee generates location data that is personal data because it can be linked to that employee. A tracker on a shared vehicle may or may not generate personal data depending on whether individual users can be identified from the data.

Personal GPS tracker data on privately owned vehicles, where the vehicle owner is tracking their own vehicle, is generally outside the GDPR framework because it concerns data about the data subject themselves rather than third parties.

Employer obligations for fleet GPS tracking

Employers who track company vehicles under UK GDPR must have a documented lawful basis, typically legitimate interests for vehicle security and operational management. They must provide employees with clear notice of the tracking including what data is collected, how it is used, who has access, and how long it is retained. A Data Protection Impact Assessment may be required for large-scale fleet monitoring programmes.

The ICO has published specific guidance on employee monitoring, including GPS tracking. The key principles are transparency, data minimisation, purpose limitation, and proportionality. Tracking that is more extensive than necessary for the stated purpose, such as tracking vehicles outside working hours without a specific security justification, may not be proportionate.

Data retention and access controls

UK GDPR requires that personal data is not kept for longer than necessary for the purpose for which it was collected. For fleet GPS data collected for operational management purposes, a retention period of twelve months is generally appropriate. LockCar’s LFM platform has configurable data retention settings. Access to tracking data should be restricted to those with a legitimate need, and all access should be logged.

LockCar recommended products

Top recommendation

LockCar LFM Fleet Platform

GDPR-compliant fleet tracking, configurable retention

The LFM platform processes GPS data in accordance with UK GDPR. Configurable data retention, access controls, and audit logging. Contact LockCar for data processing documentation.

LockCar One Plus, £259

4G GPS, live camera, relay immobiliser

Combined 4G GPS tracker, forward camera, and hardwired relay immobiliser. Movement alerts, live view, remote immobilisation from the LockCar app.