Yes, vehicle tracking is legal in the UK, but only if it is used transparently, proportionately, and in line with UK GDPR and data protection law. Employers must have a lawful basis for tracking, clearly informing drivers what data is collected and why, and ensure that data is protected and retained responsibly.

What Governs Vehicle Tracking in the UK?

Vehicle tracking sits at the intersection of privacy law and business operations. Within a modern vehicle tracking environment, several pieces of legislation apply.

UK GDPR and the Data Protection Act 2018

Under UK law, vehicle tracking data is considered personal data when it can be linked to an identifiable driver.

That means it must be:

Processed lawfully, fairly, and transparently
Collected for a specific, legitimate purpose
Limited to what is necessary
Stored securely
Kept only as long as required

If a tracking system shows which driver was operating a vehicle at a given time, that data falls under data protection law.

The Human Rights Act (Article 8)

Article 8 protects an individual’s right to privacy. Tracking is lawful when it is proportionate and justified, but excessive or covert monitoring may breach privacy rights. Tracking outside working hours, for example, can cross the line from business monitoring into surveillance.

Lawful Grounds for Vehicle Tracking

Under UK GDPR, you must have a lawful basis for processing personal data. You cannot track vehicles simply because you want to. The most common lawful bases in fleet environments are:

Legitimate Interest

This is the most widely used ground. It applies when tracking is necessary for legitimate business purposes, such as:

Route optimisation
Asset protection and theft recovery
Driver safety
Preventing compliance breaches
Fuel efficiency and cost control

Businesses should complete a Legitimate Interests Assessment (LIA) to ensure the tracking is balanced against employee privacy. This assessment is a critical step for any business implementing fleet vehicle tracking to ensure that operational benefits do not outweigh individual rights.

Contractual Necessity

Tracking may be lawful where it is necessary to fulfil contractual obligations, for example, ensuring delivery service standards are met.

Legal Obligation

In some sectors, monitoring supports compliance with:

Duty of care obligations
Hours-of-service regulations
Environmental zone compliance (e.g. LEZ/ULEZ)

Do You Have to Tell Drivers They Are Being Tracked?

Yes, transparency is mandatory. Drivers must be clearly informed:

That tracking is in place
What data is collected (location, speed, driving behaviour, etc.)
Why it is collected
Who can access it
How long it will be retained

Covert tracking is generally unlawful unless there is a serious, time-limited investigation into criminal behaviour, and even then, it must be legally justified. Failing to communicate clearly is one of the most common compliance mistakes.

Employee Rights and Access to Data

Because tracking data is personal data, employees have rights under UK GDPR, including:

The right to access their data (Subject Access Requests)
The right to request correction of inaccurate data
The right to object to processing based on legitimate interests

Businesses must be able to respond to data requests within statutory timeframes and demonstrate how tracking decisions are justified.

Tracking Outside Working Hours

Tracking becomes more sensitive when vehicles are used for personal journeys. If a vehicle is authorised for private use, monitoring outside working hours may become disproportionate and unlawful.

Good practice includes:

Defining working hours clearly in policy
Allowing tracking to be disabled outside business time
Separating business and private mileage records
Avoiding unnecessary collection of personal journey data

Tracking employees during evenings or weekends without clear justification increases compliance risk.

What Data Can You Legally Collect?

UK GDPR requires data minimisation, meaning that you should only collect what is genuinely necessary.

Typical lawful data in fleet tracking includes:

GPS location and journey history
Speed and route adherence
Mileage and fuel usage
Driver behaviour indicators (harsh braking, acceleration, idling)
Vehicle diagnostics and maintenance alerts

Where telematics includes driver behaviour monitoring, the purpose must be clearly defined (such as improving safety or reducing accident risk) rather than excessive scrutiny.

Collecting excessive or irrelevant data can expose a business to complaints or regulatory scrutiny.

For organisations introducing telematics for the first time, understanding what fleet vehicle tracking involves helps ensure systems are configured proportionately from the outset.

Retention and Security Best Practices

Tracking data should only be kept for as long as necessary to fulfil its purpose – keeping data just in case is not compliant. Many fleets retain:

Routine operational data for a limited period (e.g. 30-90 days)
Incident-related data for longer, where legally justified

As legal compliance depends not only on policy, but on secure system design, to meet GDPR standards, tracking systems should include:

Encrypted data transmission
Role-based access controls
Secure cloud storage
Clear data processing agreements with providers

What Good Compliance Looks Like in Practice

A compliant vehicle tracking setup typically includes:

A documented Vehicle Tracking Policy
A completed Data Protection Impact Assessment (DPIA)
A Legitimate Interests Assessment
Clear driver communication and training
Defined retention periods
Controlled access to data
Regular internal review

This structure protects both the organisation and its employees.

How This Relates to Crystal Ball

At Crystal Ball, we support GDPR-aligned vehicle tracking through our FleetTracker and SmartCam systems. Rather than promoting unrestricted monitoring, the platform is designed to support responsible implementation through:

Transparent reporting and audit trails
Role-based permissions
Secure cloud-based storage
Driver ID tools that distinguish business from personal journeys
Configurable alerts that help prevent compliance breaches

A prime example of this is Gerrard Cars, a London-based chauffeur service that uses our TfL-approved solutions to maintain high safety standards and protect high-value assets. By using FleetTracker for weekly behaviour reporting and SmartCam to defend against fraudulent claims, Gerrard Cars achieved a 15% reduction in insurance premiums while ensuring their operations remain fully compliant with strict data security and passenger privacy regulations.

For those specifically using video telematics, our GDPR and privacy guidance for fleet dashcams guide provides further detail on handling recorded personal data.

FAQs

Do employees have to give consent for vehicle tracking?

In most fleet scenarios, employers do not rely on consent because it is difficult to demonstrate that consent is freely given in an employment relationship. Instead, businesses typically rely on legitimate interest or contractual necessity.

Does vehicle tracking count as employee monitoring under UK law?

Yes. If tracking data can be linked to an identifiable driver, it is considered employee monitoring and falls under UK GDPR. This means employers must carry out a Data Protection Impact Assessment (DPIA) where monitoring may pose a high risk to individual privacy.

Can employees request access to their tracking data?

Yes. Because tracking data is personal data, employees can submit a Subject Access Request (SAR) to see what information is held about them. Employers must respond within statutory time limits and provide the data in a clear and accessible format.

Are there penalties for non-compliant vehicle tracking?

Yes. Non-compliance can result in investigations by the Information Commissioner’s Office (ICO), enforcement notices, financial penalties, and reputational damage. Clear policies, secure systems, and documented lawful grounds significantly reduce this risk.

For more information on the topics covered in this guide, feel free to explore the following resources. These pages offer deeper insights and practical details to help you build on what you’ve learned here.

Vehicle Tracking hub
Fleet Vehicle Tracking pillar
What Is Fleet Vehicle Tracking?
GDPR and Privacy Guidance for Fleet Dashcams
Do I Need to Tell Drivers They Are Being Tracked?
Vehicle Tracking for Fleets

Explore Compliant GPS Tracking

Modern vehicle tracking provides the real-time data needed to drive operational control and fleet safety while maintaining strict regulatory standards. Discover how to balance high-performance fleet management with your data protection obligations or see how our tools simplify the compliance process.

Read our full fleet tracking compliance guide, or see how Crystal Ball supports GDPR-compliant tracking.

Is Vehicle Tracking Legal in the UK?