An email lands in your inbox. Sender: Information Commissioner’s Office. Subject: formal notice of investigation. Any business owner running a field team who reads those words knows exactly what it means, someone has complained, and the ICO is now looking at how you track your workers. The fine doesn’t arrive on the day you expect it. It arrives when you’ve stopped worrying about it.
👉 Free tool: see what you need to be compliant country by country with the GPS on workers in the EU guide, 39 European countries, verified at the source.
GPS tracking of field employees is entirely legal under UK GDPR. The problem is that most businesses using it have no idea what makes it legal, and the gap between “we use an app” and “we are compliant” is precisely where the ICO finds its cases.
What UK GDPR actually says about tracking your field workers
The ICO’s guidance on employee monitoring is clear on one point: tracking is lawful, but only when you have a documented lawful basis, a declared purpose, and a transparent privacy notice. The two bases most relevant to field service businesses are legitimate interests (Article 6(1)(f) UK GDPR) and the performance of a contract (Article 6(1)(b)). Legitimate interests requires a balancing test, a written assessment that your need to track outweighs the workers’ right to privacy. Most SMEs have never done one, and the ICO knows this.
Set up an ICO-aligned clock-in on one real site, GPS only during active jobs, with a transparent privacy notice and signed worker information.
No credit card, up and running in 2 minutes.
Open your trialThe Data Protection Act 2018 supplements UK GDPR with specific employment provisions. Section 10 and Schedule 2 paragraph 5 allow processing for employment purposes where it’s necessary and where requiring consent would prejudice the employment relationship, which is effectively always. This means consent is rarely the right basis for tracking. If your current privacy notice says “we track with GPS and employees have consented,” you may want to revisit it.
The three mistakes that lead to ICO investigations
The first is always-on tracking. The ICO expects data minimisation, your tracking should operate only during working hours and only to the extent necessary for the declared purpose. An app that logs position every 30 seconds throughout a shift, including breaks and travel between jobs, is hard to justify under the proportionality test. It’s not the frequency that’s automatically unlawful; it’s the inability to explain why that frequency is necessary.
The second is an inadequate privacy notice. The employee monitoring guidance published by the ICO is explicit: workers must be told what is being collected, why, how long it is kept, who has access to it, and what their rights are. A clause buried in an employment contract signed three years ago is not a privacy notice, it’s a liability. The notice needs to be current, specific, and actually given to workers before monitoring begins.
The third, and the one that causes the most expensive investigations, is keeping location data longer than necessary. The ICO’s storage limitation principle under Article 5(1)(e) UK GDPR is not flexible. If you collect GPS data to verify job attendance, you need a retention period that matches that purpose. Keeping years of location history “just in case” is a finding that almost always appears in enforcement action.
What you actually need to be compliant
Three things need to be in place before any GPS tracking system goes live. A documented lawful basis, not a general one, but specific to your use case, with a legitimate interests assessment on file if that’s the basis you’re relying on. A current privacy notice that explicitly mentions GPS tracking, states the purpose, retention period, and data access, and has actually been given to every worker who is tracked. And a retention and deletion policy: a written decision about how long you keep location data and why that period is proportionate.
If you run a unionised workforce, there’s an additional layer. The ICO expects employers to consult with trade union representatives or staff councils before introducing or significantly changing monitoring practices. This isn’t a legal veto, it’s a consultation obligation. Skipping it is a procedural failure that tends to appear prominently in complaint investigations.
