Tracking company vans outside working hours: what UK employers can and cannot do

Yes, you can track company vans outside working hours in the UK, but only where you have a clear business reason, you have told the driver, and the tracking is proportionate to that reason. You cannot monitor a driver’s private movements for no stated purpose, and you cannot do it covertly. In 2026 the practical answer is to track the vehicle for security and out-of-hours use, and to limit or switch off location visibility of private journeys where private use is allowed.

Why this matters

A van parked on a driver’s drive overnight is a company asset, but the driver’s home life sits around it. Location data from that van can reveal where someone lives, who they visit and when they are at home. That makes it personal data under UK GDPR.

The risk runs both ways. Track too little and you cannot respond to theft or unauthorised use. Track too much and you create a data protection problem and a trust problem with your team. This page sets out where the line sits, so you can fit tracking once and defend it later.

This is practical guidance, not legal advice. For a specific dispute, take advice from an employment or data protection solicitor.

Can employers track company vehicles outside working hours in the UK?

Yes, with conditions. Tracking company vehicles outside working hours is lawful when all of the following are true:

• You have a specific, legitimate purpose, such as protecting the vehicle from theft, checking for unauthorised use or meeting a legal duty.
• You have told drivers what is tracked, when, why and who sees the data.
• The tracking is proportionate. If a lighter option meets the same purpose, you use it.
• You have recorded your reasoning, usually in a data protection impact assessment.

The Information Commissioner’s Office (ICO) publishes employment monitoring guidance that sets out this approach. It expects employers to identify a lawful basis under UK GDPR, be transparent with workers and avoid monitoring that goes beyond the stated purpose. The most common lawful basis for vehicle tracking is legitimate interests under Article 6(1)(f), which requires a balancing test between your interests and the driver’s rights.

What the rules look like in practice

What employers can do

These are the uses that employers can usually justify and explain.

• Protect the vehicle from theft. Knowing where a stolen van is, and whether it moved when nobody should have used it, is a clear security purpose.
• Detect unauthorised use. If your policy bans private use, movement outside agreed hours is a legitimate flag.
• Set boundaries around known locations. Geofences around the depot, a driver’s home address or a customer site can alert you to movement without you reading every journey. The guide on how to set useful fleet geofence alerts covers practical set-up.
• Meet legal and insurance duties. Where an insurer or contract requires a monitored security system, tracking supports that requirement.
• Investigate a specific incident. A reported theft, collision or complaint is a reason to review the relevant journey data.

FleetTracker supports live GPS tracking, journey history, geofencing, supported alerts and reporting. Which of those you switch on for out-of-hours periods is a policy decision, and each one needs to match your stated purpose.

What employers cannot do

These are the practices that create legal and employee-relations risk.

• Track covertly. Drivers must know the vehicle is tracked. Hidden tracking of employees is very hard to defend.
• Monitor private life. If a driver uses the van privately by agreement, a record of weekend trips, medical appointments or visits to a place of worship is not something your business needs. The ICO’s guidance on monitoring work vehicles states that where workers are allowed private use of a work vehicle, an employer will rarely be able to justify monitoring during that private use.
• Keep data with no purpose. Holding location history indefinitely, just in case, breaches the principle of storage limitation. Set a retention rule and stick to it.
• Use data for a new purpose without telling anyone. Location data collected for theft protection should not quietly become a disciplinary tool for unrelated matters.
• Track personal vehicles without agreement. Grey fleet tracking needs a separate, explicit arrangement. Do not extend company tracking to a driver’s own car.

There is no single UK statute called a vehicle tracking law. The rules come from UK GDPR, the Data Protection Act 2018, the right to respect for private life under Article 8 of the European Convention on Human Rights and your employment contracts.

Tracking company vans with private use allowed

This is the hardest case, and the one most employers ask about. If you let drivers use the van privately, you have effectively given them the use of the vehicle outside work. Seeing every private trip is difficult to justify.

A workable approach has four parts:

1. Split business and private use in the policy. Define working hours, commuting and private use in writing.
2. Limit what you see. Keep full journey visibility for business use. For private periods, restrict access to the minimum you need, such as a theft alert if the vehicle moves unexpectedly.
3. Control who can see it. Limit portal access to named managers and record why.
4. Review it. Revisit the policy if your purpose changes or if drivers raise concerns.

Before relying on any system to limit private-hours visibility, confirm the exact settings your tracking supplier currently supports. Do not assume a feature exists.

Why the right answer varies

Several factors change what is proportionate for your business:

• Whether private use is permitted. This is the single biggest factor.
• Where the vehicle is kept overnight. A secure depot is different from a driver’s driveway.
• Theft exposure. A van carrying tools or stock has a stronger security case than a lightly loaded one.
• What your insurer requires. Some policies expect a specific security standard.
• What drivers have been told. Clear notice and agreement strengthen your position.
• The data you actually need. Alerts on unexpected movement are less intrusive than a full journey log.

What should be in your vehicle tracking policy?

A short written policy settles most disputes before they start. It should state:

• the purpose of tracking, in plain English;
• what data is collected and when;
• whether private use is allowed and how it is treated;
• who can access the data;
• how long the data is kept;
• how a driver can raise a concern or ask for their data.

Bring drivers into the process early. The guide to introducing GPS vehicle tracking to employees explains how to explain the change without it feeling like surveillance.

Do you need a data protection impact assessment?

In most cases, yes. Systematic monitoring of employees is the kind of processing that the ICO expects employers to assess before they start. A data protection impact assessment records your purpose, the alternatives you considered, the risks to drivers and the steps you took to reduce them.

Keep it short and specific. A one-page assessment that you actually follow is more useful than a long one that nobody reads.

Can you discipline a driver using out-of-hours tracking data?

Yes, if the policy told the driver that the data could be used for that purpose and the use is fair. Disciplinary action based on data you never mentioned to the driver is much harder to defend. Follow your normal disciplinary process and let the driver respond to the data.

Is tracking after hours different from tracking during work?

The law is the same, but the justification is not. During working hours your purpose is operational control. Outside working hours your purpose narrows to security and unauthorised use, so what you collect and look at should narrow too.

How does out-of-hours tracking relate to timesheets and pay?

Location data can show when a vehicle started and stopped, but it is not a substitute for a timesheet agreed with the employee. If you plan to use tracking data in pay decisions, say so in the policy. The guide on vehicle tracking data and employee timesheets covers the points to settle first.

Where monitored security fits in

If your concern is theft rather than driver behaviour, a monitored Thatcham tracker answers it without needing you to review journeys. Thatcham S7 provides monitored security and location, with no Automatic Driver Recognition (ADR), fob or immobilisation. S5 adds fob-based ADR and unauthorised-use alerts. S5 Plus adds immobilisation when the authorised fob is absent. Required monitoring is priced separately from the tracker, so check the current details on the site before you decide. Fit the simplest product that meets the security purpose you have written down.

FAQ

One last thing

The strongest position is the simplest one: ban private use of the van, say so in writing, and track for security and unauthorised use only. If you allow private use, treat the van’s out-of-hours data as something you hold on the driver’s behalf, not something you browse. Employers that take that approach in 2026 rarely have a dispute, because the driver always knew the rules. Our guide to out-of-hours vehicle use alerts shows how alerts can support that without reading every journey.

If you are deciding what to switch on outside working hours, contact Crystal Ball to talk through what FleetTracker records and who can see it before you fit anything.

Related guides

• Vehicle telematics data retention for UK fleets
• Company vehicle dash cam policy