ICO Crackdown 2026: Is Your GPS Tracking of Workers Legal?

It starts with a letter. Formal, measured, unmistakably serious. The Information Commissioner’s Office has received a complaint from one of your employees regarding the GPS tracking system you use to monitor field workers. They’re requesting your Data Protection Impact Assessment, your lawful basis documentation, your privacy notice to employees, and evidence that tracking is limited to working hours only. You have twenty-eight days to respond. ICO GPS tracking workers cases are rising.

👉 Free tool: see what you need to be compliant country by country with the GPS on workers in the EU guide, 39 European countries, verified at the source.

If you’re like most field service business owners, you installed the tracking app two years ago because a mate recommended it. You told the lads it was for “job scheduling” and left it at that. No DPIA. No written policy. No idea whether the app tracks them on their lunch break or their drive home. You’re not malicious, you’re busy. But the ICO doesn’t distinguish between malice and negligence. The fine is the same.

2026 is the year the ICO shifted from guidance to enforcement on workplace monitoring. Their updated Employment Practices guidance, published in late 2025, makes clear that GPS tracking of employees is a high-risk processing activity that requires a DPIA, a lawful basis, transparency with workers, and strict data minimisation. Complaints about employer tracking have risen 40% year-on-year, and the ICO is acting on them. The question isn’t whether they’ll investigate businesses like yours. It’s when.

ICO GPS tracking workers: expectations

Four things. A Data Protection Impact Assessment that analyses the necessity and proportionality of GPS tracking for your specific business. A lawful basis, typically legitimate interest, but it must pass the three-part test (purpose, necessity, balancing). A clear privacy notice given to every tracked worker before tracking begins, explaining what data you collect, why, for how long, and who sees it. And technical measures to ensure data minimisation, no tracking outside working hours, no location history retention beyond what’s necessary, no access by unauthorised staff.

Most field service businesses fail on at least two of these. The good news: fixing it isn’t hard. It’s a matter of choosing the right system and documenting your decisions. A purpose-built tool like GeoTapp TimeTracker handles the technical side by design – GPS capture only at clock events, automatic data expiry, role-based access controls. You focus on the policy documents; the system handles the rest.

---

The cost of doing nothing

The ICO can fine up to £17.5 million or 4% of annual turnover, whichever is higher. But the realistic risk for a field service SME isn’t a headline fine. It’s a reprimand, an enforcement notice requiring you to stop all GPS tracking until compliant, and the reputational damage of being listed on the ICO’s public enforcement register. That’s the real cost: losing the ability to track your workforce for weeks while you scramble to implement what you should have had from day one.

Don’t wait for the letter. Get compliant now. GeoTapp Verifier produces tamper-proof work reports that demonstrate both your service delivery and your data handling practices, the kind of evidence that turns an ICO investigation into a non-event.

Beyond fines, there’s the operational disruption. An ICO enforcement notice can require you to stop all GPS tracking until you’ve demonstrated compliance. For a field service business that relies on GPS for scheduling, routing and billing verification, that’s not a minor inconvenience, it’s a fundamental threat to your operations. The time to act is before the complaint, not after. A compliant system costs a fraction of what non-compliance costs in legal fees, management time and lost capability.

The ICO has published clear guidance on what constitutes lawful workplace monitoring. The businesses that follow it aren’t just avoiding risk, they’re building trust with their workforce. Engineers who know they’re tracked fairly and transparently are more engaged, more productive and less likely to raise grievances. Compliance isn’t just a legal obligation, it’s good management.