GPS and worker monitoring in United Kingdom: what you need to stay compliant

What you need

For each obligation we tell you whether it applies in this country: Yes means required, It depends means only in certain cases, No means not required.

• Consultation of workers or their representatives before introducing monitoring

  It dependsonly in certain cases

  The ICO asks employers to gather and document the views of workers or their representatives (e.g. trade unions) before introducing monitoring, unless there are good reasons not to; it is not binding consent, but it must be documented.

  ICO, guida sul monitoraggio dei lavoratori (UK GDPR)

• Prior authorisation from an authority before installation

  Nonot required

  No prior authorisation from the ICO is required; accountability applies (self-assessment + DPIA). The ICO must be consulted in advance only if the DPIA identifies a high risk that cannot be mitigated.

  ICO, guida sul monitoraggio dei lavoratori (UK GDPR)

• Valid legal basis and information to workers (usually legitimate interests, not consent; no covert surveillance)

  Yesrequired

  Consent is usually not valid because of the imbalance of power; the usual basis is legitimate interests with a documented assessment (LIA). Workers must be informed clearly; covert surveillance is allowed only in exceptional cases.

  ICO, guida sul monitoraggio dei lavoratori (UK GDPR)

• No unjustified continuous tracking; deactivation outside working hours for private use

  Yesrequired

  According to the ICO, continuous recording while the vehicle is used for private purposes outside working hours is likely to be excessive; the driver must be able to switch off the recording in those cases.

  ICO, sorveglianza nei veicoli

• Data protection impact assessment (DPIA) for tracking workers' geolocation

  Yesrequired

  The ICO's list expressly includes tracking a person's geolocation or behaviour; for GPS on employees a DPIA is required.

  ICO, quando serve una DPIA

The procedure, step by step

1. 1

   Gather and document the views of workers or their representatives.

2. 2

   Identify a valid legal basis (usually legitimate interests) and carry out the documented assessment (LIA).

3. 3

   Carry out the data protection impact assessment (DPIA) before activating the tracking.

4. 4

   Inform workers in a clear and accessible way (no covert surveillance except in exceptional cases).

5. 5

   Configure the system: no continuous recording outside working hours, deactivation for private use.

6. 6

   If you switch systems: when you change your monitoring system or software, update and re-issue the privacy notice, and check whether the national agreement or authorisation for remote monitoring needs renewing. The provider (data processor), the data collected and the methods often change: the one provided earlier is not enough.

Who to contact

What you risk

Sources

• ICO, guida sul monitoraggio dei lavoratori (UK GDPR)
• ICO, sorveglianza nei veicoli
• ICO, quando serve una DPIA
• ICO, provvedimento sul monitoraggio GPS (Home Office, 2024)
• ICO, presentare una segnalazione
• Regolamento UE 2016/679 (GDPR) come UK GDPR