Short version. Location data about an identifiable driver is personal data. Employee consent is almost never a valid basis — use legitimate interest with a written balancing test, inform drivers before you start, do not track outside working hours, and set retention per data type. Self-hosting removes the processor and the international transfer; it does not remove the obligations.
If a vehicle is driven by an identifiable person, tracking it is processing that person’s personal data. That is not a technicality and regulators have been enforcing it. This is what the guidance actually says, and where self-hosting changes the answer.
This is not legal advice. It is a working summary with the sources attached, written by people who build the software rather than people who practise law. Take it to your DPO or your counsel.
The premise everyone gets wrong
“We are tracking the vehicle, not the driver” is the sentence that precedes most of the trouble. It does not survive contact with the guidance: location data qualifies as personal data any time it relates to an identifiable individual, and an employer using vehicle tracking is collecting the personal data of the employees using that vehicle, including behavioural data about them.
If you can get from a position to a person — by a rota, a vehicle assignment, a fuel card, or by asking — it is personal data. In practice, in a fleet, you always can.
The legal basis, and why consent is a trap
You need a lawful basis under Article 6. The plausible ones are:
- Legal obligation, Art. 6(1)(c). Narrow but solid where it applies: a tachograph on a lorry is the standard example.
- Legitimate interest, Art. 6(1)(f). The usual basis. Locating a vehicle for dispatch, recovering it if stolen, verifying a delivery, defending a claim. It requires a balancing test you have written down, not one you would perform if asked.
- Contract, Art. 6(1)(b). Occasionally, where the tracking is inherent to the service being performed.
And the one to avoid: consent. Employee consent is only an adequate basis in exceptional circumstances, because consent must be freely given and an employee cannot freely refuse their employer. A consent form in the onboarding pack is worse than useless: it is an invalid basis that also signals you knew a basis was needed.
Do the legitimate interest assessment instead. Purpose, necessity, and why the driver’s rights do not override it. Three paragraphs, dated, kept on file.
The rules with teeth
Four constraints come up repeatedly in guidance and enforcement.
No general staff monitoring. Vehicle tracking should not be used for the general monitoring of staff. Fleet efficiency is a purpose; watching people is not.
Nothing outside working hours. GPS tracking may not be used outside working hours, and 24/7 tracking is a disproportionate interference with private life. If the vehicle goes home with the driver, you need a privacy mode, or a shift window, or both — and a policy that says which.
Transparency is not optional. Employees must be informed that the device exists, how it operates and for what purposes. Told, in writing, before it starts.
It is enforced. Regulators across the EU have issued administrative fines where organisations failed to establish a clear legal basis or lacked transparency with employees. This is a live area, not a theoretical one.
What to write in the notice
The driver notice is the single highest-value document here, and it is short. It should say:
- That there is a tracking device, in which vehicles, and what it records — position, speed, ignition, and any behavioural data such as harsh braking.
- Why, in specific terms. “Dispatch, vehicle recovery, delivery verification and fuel-loss investigation” is a purpose. “Business efficiency” is not.
- The legal basis, named, and where to read the balancing test.
- When it is active. Working hours, or a privacy mode and how to use it.
- How long it is kept. A number, per data type.
- Who sees it. Which roles internally, which processors externally.
- Their rights, and the address that answers.
- Who to complain to if they are not satisfied — you first, then the supervisory authority.
One page. Signed for receipt, not for consent — you are evidencing that you informed them, not pretending they agreed.
Retention: pick a number and be able to defend it
There is no statutory figure. The principle is storage limitation: keep it as long as the stated purpose needs and no longer. A defensible pattern separates raw from derived:
| Data | Typical retention | Why |
|---|---|---|
| Raw positions | Days to weeks | Needed to redraw a track; almost never read after |
| Trips and distances | Years | Business records, tax, customer billing |
| Behavioural events | Months | Coaching cycles, not permanent records |
| Fuel events | Years | Cost accounting, loss investigation |
Routly’s own schema follows exactly that split: positions land in ClickHouse with a TTL that drops old partitions automatically, while trips and events are derived at ingest and live in Postgres where they are business records. That is a design decision with a compliance consequence — the raw data expires without anyone remembering to delete it.
Where self-hosting changes the answer
Not everything, but four specific things.
You are the controller and there is no processor. With hosted software the vendor processes your drivers’ data, which means a processor agreement under Art. 28, due diligence on them, and their sub-processors becoming your problem. Self-hosted, the data never reaches the software’s publisher. There is nothing to sign and nobody to audit.
No international transfer. A US-hosted platform means Chapter V, Standard Contractual Clauses and a transfer impact assessment. Data on a server in your own country is a question that does not arise.
Retention is yours to set. Not the retention the vendor’s plan offers, and not a support ticket to change.
Access requests are answerable. When a driver exercises Art. 15, you can answer it with a query rather than a request to a vendor’s support desk and a wait.
What self-hosting does not do is make you compliant. The legal basis, the notice, the balancing test and the out-of-hours rule are yours either way — arguably more clearly yours, since there is no longer anyone to share the blame with.
Frequently asked
Do we need a DPIA?
Often yes. Systematic monitoring of employees is on most authorities’ lists of processing requiring one. If you are tracking behaviour as well as position, assume yes and do it.
Can we track a vehicle the employee takes home?
Only within a defined working window, or with a privacy mode the driver controls. Continuous tracking is treated as disproportionate.
Is driver scoring allowed?
Behavioural data is more sensitive than position and needs its own justification. Scoring used for coaching is easier to defend than scoring used for discipline, and if a score drives an automated decision with legal or similarly significant effects, Art. 22 applies and a human has to be in the loop.
What about subcontractors rather than employees?
The power imbalance is smaller, so consent is marginally more plausible, but legitimate interest is still usually the cleaner basis. The transparency obligation is identical.
Does this apply outside the EU?
GDPR applies to processing about people in the EU regardless of where you are. The UK has its own near-identical regime. Elsewhere, treat this as a floor rather than a ceiling.
Who is the controller if we resell the platform?
Your customer, for their drivers. You are their processor and need an Art. 28 agreement with them — which is one of the things the commercial licence covers.
The short version
Have a legal basis that is not consent, write the balancing test down, tell the drivers in writing before you start, do not track outside working hours, set retention per data type, and be able to answer an access request. Self-hosting removes the processor, the transfer and the retention negotiation from that list. It does not remove the list.
Sources worth reading in full: the Irish DPC’s employer vehicle tracking guidance is the clearest single document, and this summary of EU enforcement shows what happens when it is ignored.
