![\"GDPR](\"https:\/\/geotapp.com\/blog\/wp-content\/uploads\/2026\/04\/garante-privacy-gps-2026.png\")
<\/figure>\n\n\n\n\n\n\n\n
What you actually need to be compliant<\/h2>\n\n\n\n
Three things need to be in place before any GPS tracking system goes live. A documented lawful basis \u2014 not a general one, but specific to your use case, with a legitimate interests assessment on file if that’s the basis you’re relying on. A current privacy notice that explicitly mentions GPS tracking, states the purpose, retention period, and data access \u2014 and has actually been given to every worker who is tracked. And a retention and deletion policy: a written decision about how long you keep location data and why that period is proportionate.<\/p>\n\n\n\n
If you run a unionised workforce, there’s an additional layer. The ICO expects employers to consult with trade union representatives or staff councils before introducing or significantly changing monitoring practices. This isn’t a legal veto \u2014 it’s a consultation obligation. Skipping it is a procedural failure that tends to appear prominently in complaint investigations.<\/p>\n\n\n\n
A useful benchmark for retention: if you track to verify job attendance and handle client disputes, 12 to 24 months of location records is typically defensible. If you track only for real-time routing optimisation, there may be no justification for keeping historical data at all beyond a few weeks.<\/p>\n\n\n\n
\n\n\n\n
The distinction the ICO makes that most businesses miss<\/h2>\n\n\n\n
The ICO’s own guidance draws a line that matters enormously in practice: monitoring to control is different from recording to verify. The first is surveillance \u2014 it implies continuous observation of behaviour, and it triggers the full weight of the employee monitoring requirements. The second is job verification \u2014 documenting that a worker was at a specific site, at a specific time, for a specific job. The ICO treats these purposes differently, and the gap in compliance burden is significant.<\/p>\n\n\n\n
A system that activates GPS only when a job is opened \u2014 and deactivates it when the job is closed \u2014 producing a sealed record of presence, time and photographic evidence \u2014 is built around verification, not surveillance. The lawful basis is clearer. The privacy notice is simpler. The retention period is more defensible. And if a client disputes whether your team was on site, you have evidence that holds up, not just a spreadsheet someone filled in manually.<\/p>\n\n\n\n
\n\n\n\n
What to do now<\/h2>\n\n\n\n
If you’re currently using a GPS app without a documented lawful basis and an up-to-date privacy notice, you are already non-compliant. Not out of bad faith \u2014 most tracking tools hand you the technology and leave the legal framework entirely to you. Nobody flags the gap until the ICO letter arrives.<\/p>\n\n\n\n
The answer isn’t to stop tracking. It’s to track in a way that is legally grounded: with a declared purpose of job verification, a system that runs GPS only during active jobs, data kept for a defined and proportionate period, and workers properly informed from day one. That’s the model that holds up to scrutiny.<\/p>\n\n\n\n