Car Tracker Laws in the UK: What You Need to Know

Managing a fleet in 2025 means shouldering many responsibilities. You’re keeping vehicles on the road, making sure drivers are safe, and finding ways to deliver services more efficiently. A good vehicle tracking system can make all of that easier, but they also bring one very big responsibility: making sure you’re on the right side of the law.

In the UK, where data protection laws are stringent, that’s not something you can take lightly. The rules aren’t designed to stop you using a car tracker, they exist to ensure data is handled fairly, transparently, and with respect for employees’ privacy. That’s why having a well-defined policy in place is a legal safeguard as well as a best practice.

In this guide, we’ll outline the essential steps to creating a compliant, transparent, and effective vehicle-tracking policy that protects your business and builds confidence among your drivers.

Why Your Tracking Policy Matters More in 2025

A car tracker isn’t just a gadget, it’s a personal-data collection tool. Under the UK’s General Data Protection Regulation (GDPR), location, driver behaviour, journey history are all classed as personal data. That means you need a lawful basis to collect it, you need to be transparent with employees, and you need to store and delete it responsibly.

This year’s Data (Use and Access) Act 2025 (DUAA 2025) has made a few changes worth noting:

• It added a list of “recognised legitimate interests” that don’t need a full balancing test (although employee tracking will usually still require one).
• It adjusted Subject Access Requests so you can “stop the clock” if you need further information to fulfil a request.
• It clarified that employers only need to perform “reasonable and proportionate searches” when responding to a SAR.

Together, these updates mean fleet managers have slightly more flexibility, but also fresh reasons to review and document their tracking policy in 2025, as understanding and applying these requirements is essential to lawful operation.

Step 1: Begin with a Data Protection Impact Assessment

Before installing or activating any car tracker system, conduct a Data Protection Impact Assessment (DPIA). This structured process identifies what data you’ll collect, why you need it, and what privacy risks may arise, along with the safeguards you’ll put in place to mitigate them.

The ICO recommends a DPIA for any form of worker monitoring, and vehicle tracking falls squarely into that category. Think of it as your blueprint: it sets the foundation for every decision that follows.

Once complete, store the DPIA with your policy documents as evidence of accountability.

Step 2: Define and Document Your Legitimate Interests

For most fleet operators, the lawful basis for using a car tracker is legitimate interests. That might be:

• Optimising routes to cut fuel costs
• Monitoring driving behaviour to improve safety
• Protecting assets from theft
• Meeting industry-specific compliance requirements

Your policy should explicitly state which of these legitimate interests you are pursuing and why. Simply stating “we want to track our vehicles” is not enough, you must connect the data collection to a specific, documented business need.

To back this up, be sure to complete and retain a Legitimate Interests Assessment (LIA). This provides a clear record of your reasoning and demonstrates compliance if ever questioned.

Step 3: Be Transparent and Communicate Clearly

Transparency is the cornerstone of compliance. Covert monitoring is only permitted in rare, short-term situations (for example, where criminal activity is suspected), and even then strict safeguards apply. In practice, this means you must always be upfront with your employees about the car tracking system.

Your policy must detail the following:

• What data is collected (e.g., location, speed, engine idling, harsh braking).
• Why you’re collecting it, linking back to your legitimate interests.
• Who has access to the data and for what purpose (e.g., managers, compliance teams).
• How long data will be retained, and why.
• Employee rights, including how to submit SARs and how DUAA 2025 affects them (“stop-the-clock” provisions and proportionate searches).

To reinforce this, provide the policy in writing to all employees and ask for a signed acknowledgement. That way, everyone is clear on the rules and responsibilities.

Step 4: Implement a Clear Privacy Protocol for Personal Use

Drivers have a legal right to a private life under The Human Rights Act, so your policy should clearly define when the car tracker is active and when it is not.

Tracking should be disabled during personal time unless a documented business need exists. Your policy should explain how this is enforced, and it should also cover exceptions, including who can authorise them, how they are logged, and how they are reviewed.

Shared or pool vehicles require extra attention to ensure journeys are correctly attributed to individual drivers. Regular audits of logs and settings should be included to make sure rules are applied consistently.

Crystal Ball’s Driver ID cards simplify much of this process. Drivers tap in at the start of a shift, automatically linking journeys to the correct person, separating business and private mileage, and supporting timesheet automation. When combined with privacy modes or scheduled tracking, Driver ID makes it easier to enforce boundaries, protect privacy, and keep records accurate.

Step 5: Establish Retention Periods and Security Controls

Under UK GDPR, the two core principles that apply to telematics data are data minimisation and storage limitation. In practice, this means you should only retain footage and associated journey data for as long as it is genuinely needed, and no longer.

For most fleets, routine journey data can be retained for a short period, typically between 30 and 90 days, to support day-to-day operations such as driver performance monitoring and route optimisation. Safety-related or incident data (for example, evidence used in an insurance dispute) can be held for a longer period, often up to six years to align with the general limitation period for contractual claims, or three years where the data relates to a personal injury claim.

Once these retention periods expire, data should be securely erased in a way that makes recovery impossible. Your policy should also detail robust security measures, including role-based access controls to limit who can view car tracker records, audit logs to track access, and strong encryption to prevent unauthorised use. This demonstrates proactive protection of sensitive information throughout its lifecycle.

Step 6: Formalise Agreements With Your Provider

If your tracking provider processes data on your behalf (which most do), UK GDPR requires a compliant Article 28 data-processing agreement. This contract should set out exactly:

• What the provider can and cannot do with your data
• The security measures they must maintain
• The rules for using any sub-processors
• How they will help you handle SARs
• What happens to data when your contract ends

If the provider stores or processes data outside the UK, make sure an approved transfer mechanism such as the UK International Data Transfer Addendum (IDTA) is in place. Crystal Ball customers benefit from supplier agreements that already cover these points, ensuring compliance from day one.

Step 7: Plan for Rights Requests and Mixed-use Scenarios

Your policy should also explain how you’ll handle employee rights requests. For SARs, set out how you’ll verify identity, clarify scope, use DUAA 2025’s “stop-the-clock” if you need more details, and search only “reasonable and proportionate” records. Apply the same clarity to objections or erasure requests by specifying when these rights can be exercised and how you’ll respond.

If your fleet includes grey-fleet or mixed-use vehicles, the same privacy and transparency rules still apply. Make it clear when tracking will start and stop, and how personal mileage will be excluded or anonymised. This ensures that even when vehicles are shared or privately owned, the balance between business needs and driver privacy is maintained.

Final Thoughts

Creating a compliant car tracker policy is about more than just following the rules, it’s about building trust with your team and protecting your business. By justifying your legitimate interests, being transparent, respecting personal time, setting clear retention limits, and formalising agreements with your provider, you’ll meet both legal requirements and operational needs.

With our car tracking system designed to simplify compliance at every step, we make it easier for you to run your fleet with confidence, knowing your policy is watertight, transparent, and future-proof.