Tracking employees via GPS is legal — but only if you strictly adhere to the rules set out by the GDPR in 2026. Those who fail to comply face fines starting at €10,000. This guide explains what you can and cannot do, and how to choose a GDPR-compliant employee GPS system without taking any risks.
Who this article is for: owners, operations managers and administrative managers of field service companies.
Objective: to reduce disputes, recover billable hours and improve operational control without complicating field work.
Set up GPS tracking with privacy notice, DPIA and union agreement ready on day one, instead of drafting them after an inspection.
Is GPS tracking of employees legal? Yes — but only if you know exactly what you’re doing.
Every week, a field service business owner asks me: “Can I use GPS to track where my technicians are without getting into trouble with the GDPR?”
The answer is yes. But there are specific conditions that many companies fail to meet — often out of ignorance, not malice.
The legal framework: what the GDPR actually says about workplace GPS
The GDPR (EU Reg. 2016/679) does not prohibit GPS tracking of employees. It regulates it. The applicable legal basis in the workplace is the employer’s legitimate interest (Art. 6(1)(f)), subject to a documented balancing of interests.
Three conditions must be met:
- Legitimate and proportionate purpose: tracking serves to document work, not to monitor private life
- Adequate information: the employee knows that they are being tracked, how, for how long and why
- Limitation of processing: GPS is active only during working hours
If even one of these conditions is missing, the company is liable to penalties.
The 5 most common GDPR violations in field service
| Breach | Typical scenario | Potential penalty |
|---|---|---|
| 24/7 tracking | GPS app always active, even outside working hours | Up to €20 million or 4% of turnover |
| Failure to provide information | “Everyone knows” without a documented signature | €10M or 2% of turnover |
| Unlimited retention | GPS data retained for years without a policy | €10M or 2% of turnover |
| Unauthorised access | Anyone in the company can view the GPS data | Variable |
| Transfer outside the EU | Data on US servers without safeguards | Significant |
The Italian Data Protection Authority has stepped up checks in the field service sector since 2024. It is no longer a theoretical risk.
How GeoTapp manages GDPR compliance automatically
GeoTapp was designed with GDPR compliance as a non-negotiable requirement:
1. Tracking only during working hours
GPS is activated when the technician starts a shift and deactivated when they finish it. Outside of declared working hours, no location data is collected.
2. Privacy notice integrated into onboarding
Upon first login, every worker reads and digitally signs the privacy policy regarding the processing of GPS data. The signature is recorded with a timestamp and retained.
3. Configurable
retention
The administrator sets the data retention period (e.g. 24 months). Upon expiry, data is automatically deleted.
4. Access to personal data
Each worker can view their own GPS data via the app. Portability and transparency guaranteed.
5. EU servers
All data is stored on European infrastructure (GDPR Articles 44–49 compliant).
“The Data Protection Authority contacted us for an inspection following a complaint from a former employee. We showed them GeoTapp’s GDPR dashboard in 20 minutes: signed consent form, data limited to working hours, retention policy, access logs. The inspection concluded without any issues.”
— HR Manager, industrial cleaning company, 48 employees
What you need to do BEFORE activating GPS tracking for employees
Pre-activation checklist:
- [ ] Data Protection Impact Assessment (DPIA): mandatory if tracking involves more than 10 people on a systematic basis
- [ ] Specific GPS privacy notice: a generic one is not enough; a dedicated document is required
- [ ] Trade union notification (if applicable): in some sectors, a trade union agreement is required for monitoring systems
- [ ] Data processing register: update the data controller’s register with the new GPS processing
- [ ] Appointment of DPO (if necessary): if processing special categories of data on a large scale
GeoTapp provides document templates for all these requirements in the Compliance section of the admin panel.
The case of collective agreements: what Italian labour law adds
In addition to the GDPR, GPS tracking of employees is regulated by Article 4 of the Workers’ Statute (Law 300/1970, amended by Legislative Decree 151/2015).
