GDPR, geolocation and drivers in business fleets
The GDPR applies to fleet data when location, assignments, driving behaviour or video make a driver identifiable. A platform can collect or connect technically available data; the organisation must define why it uses the data, on which basis, who sees it, for how long and with which safeguards. Technical capability and lawfulness are separate checks.
What can the technology do, and what must the organisation decide?
The same feature may be technically available and operationally useful while requiring precise legal conditions before use.
1. Technical capability
A device and platform can make location, journeys, stops, assignments, driving signals or event video available when modules, vehicle and configuration allow. This check answers: which data exists?
2. Organisational responsibility
The organisation decides purposes, roles, recipients, thresholds, verification procedures, dispute handling and retention. This check answers: which decision needs the data and who may use it?
3. Legal duties
The GDPR, national employment law and authority decisions may require a legal basis, information, minimisation, proportionality, security and further safeguards. This check answers: under which conditions is the use lawful?
Which fleet data can relate to a person?
Data does not need to include a driver's name to be personal: it is enough for the organisation to be able to link it to an identifiable person.
Data, link and decision
| Data | How it can identify | Decision to document |
|---|---|---|
| Location and history | Vehicle assigned to a driver | Purpose, granularity, access and retention |
| Driving events | Driver linked to vehicle and time | Thresholds, human review and employee use |
| Tachograph | Driver card and recorded activity | Duty, recipients, access and retention |
| Event video | Face, voice, registration, place or shift | Framing, audio, trigger, access and deletion |
| Geofences and stops | Attributable shift, visit or activity | Necessity, proportionality and report use |
Which questions must a geolocation project answer?
Configuration should start from permitted decisions, not from the maximum amount of data that a device can collect.
Purpose and legal basis
- Which operating problem needs the location or event?
- What is the legal basis for that specific purpose?
- Can the same purpose be met with less detailed data?
Information and employment law
- What is explained to drivers in clear terms?
- Which national rules on employee monitoring apply?
- Are agreements, authorisations or further safeguards required?
Access and retention
- Which roles see live location, history, events or video?
- How long does each data category remain?
- How are requests, exports, deletion and audits handled?
Periodic review
- Are the purposes still current?
- Do access rights match actual roles?
- Do alerts and reports produce proportionate, verifiable decisions?
How can operational monitoring avoid becoming indiscriminate surveillance?
Limiting data, authorised people, intervals and uses matters more than collecting everything and deciding later.
Separate safety, operations and discipline
Location used to assign the nearest vehicle, an event used to analyse a risk and data used in a disciplinary process have different purposes and impacts. They should not be treated as one general permission.
Provide human review and context
A telematics event can depend on signal quality, threshold, vehicle, road or manoeuvre. Before attributing responsibility to a person, the source needs context, validation and a consistent procedure.
Configure only what is necessary
Live tracking, history, driver association, driving behaviour and video should not automatically be enabled together. Each level needs its own necessity, recipients and duration.
Primary sources and limits of this page
Last reviewed: 24 August 2026. The page provides informational criteria, not legal advice for an individual project.
General Data Protection Regulation
The official text defines personal data, principles, legal bases, information, security and data-subject rights.
Vehicle geolocation in employment
The Italian Data Protection Authority explained that a vehicle's location can concern the employee even when the system does not immediately display a name, if the employer can identify the assignee.
Detailed driving-behaviour data
In January 2026 the Italian DPA addressed purposes, legal bases, roles and employment safeguards in a case involving detailed journey collection capable of monitoring work activity.
Questions about GDPR, GPS and drivers
Concise answers covering personal data, technical use, driver association, driving behaviour and video.
Is GPS data from a company vehicle personal data?
It can be. If the employer can link a vehicle to a driver, location and journey history can make the person identifiable even when the system initially displays only the registration or asset. The Italian Data Protection Authority has applied this principle to vehicle-location systems in employment.
If a platform can locate a driver, can the company always use that data?
No. Technical availability does not establish the purpose, legal basis or proportionality of processing. Before enabling or using monitoring, the organisation must assess the GDPR, applicable employment law, information, access, retention and concrete operating methods.
How can driver, vehicle, journey and event be connected while respecting privacy?
The technical link should be limited to defined purposes, necessary data, authorised roles and documented retention periods. Zenit can contextualise assignments and events where modules allow it; the lawfulness of the process and use of the data remain the responsibility of the organisation determining purposes and means.
Can telematics data be used to monitor employees' driving behaviour?
Technology can produce compatible driving events, but using them in relation to employees is not automatically lawful. In 2026 the Italian Data Protection Authority challenged detailed journey collection capable of monitoring work when safeguards, purposes, legal bases and roles were unclear. Each project needs a specific legal assessment.
Do dashcams and video telematics require different rules from GPS?
Video and audio can increase the impact on people's rights and require a distinct assessment of purpose, framing, any audio, access, events, retention and information. Linking the video to a GPS event does not resolve those duties by itself.
Define data and responsibilities before configuration.
Zenit can delimit modules, available data, roles and technical access; the organisation must validate purpose, legal basis and policy with qualified support.