GPS and worker monitoring, country by country
GPS and worker monitoring in Italy
what you need to stay compliant
Updated on August 3, 2026
Competent authority
Garante per la protezione dei dati personali (Italian Data Protection Authority)Verified on June 15, 2026
What you risk
EUR 120,000from a real GPS case
Updated on August 3, 2026
What you need
8For each obligation we tell you whether it applies in this country: Yes means required, It depends means only in certain cases, No means not required.
What you need
For each obligation we tell you whether it applies in this country: Yes means required, It depends means only in certain cases, No means not required.
Trade union agreement (RSA/RSU) or authorisation from the Labour Inspectorate, before installing the system
YesrequiredGPS is a tool that can lead to remote monitoring of workers. Article 4 of the Workers' Statute allows it only after a trade union agreement with the RSA or RSU, or authorisation from the Territorial Labour Inspectorate. Installing it before this step, or using it differently from what was authorised, is the fastest route to a penalty.
Legge 20 maggio 1970, n. 300 (Statuto dei Lavoratori), art. 4
Location recorded only at clock-in and clock-out, with no continuous monitoring
YesrequiredThis is the line between recording attendance and remote monitoring. The Court of Cosenza, judgment no. 972 of 1 July 2026, annulled a EUR 50,000 fine by the Garante precisely because the system recorded date, time, coordinates and site only at the moment of clocking, without allowing continuous tracking of movements: configured that way it falls among the access and attendance recording tools of Article 4, paragraph 2. Note that this is a first-instance ruling, not a Supreme Court decision, and it does not remove the other obligations. At the opposite end, recording the position every sixty seconds with real-time display cost a health authority a fine in May 2026.
Written privacy notice to workers, complete and truthful (Article 13 GDPR)
YesrequiredThe worker must know clearly and truthfully that they are being geolocated, how, when and why (Article 13 GDPR). In the road haulage case the notice existed but was full of inconsistencies and typos: for the Garante that is the same as not having one.
Garante Privacy, Provvedimento del 16 gennaio 2025, n. 10112287
No continuous tracking: location collected only when needed (data minimisation)
YesrequiredFollowing the vehicle 24/7, breaks included, violates the data minimisation principle (Article 5 GDPR). Location is collected when it serves a legitimate purpose, not to always know where the person is. Continuous tracking is one of the reasons for the 50,000 EUR penalty against the road haulage company.
Garante Privacy, Provvedimento del 16 gennaio 2025, n. 10112287
Use of data only for the declared purpose, with no reuse for disciplinary sanctions
YesrequiredLocation data must be used only for the purpose for which it was collected (Article 5 GDPR, purpose limitation). Reusing it for another purpose, for example data collected to document the work and then used to start a disciplinary procedure, is a misuse of purpose. The same applies to the scope of collection: in the Pioneer case the driving-style score was calculated on private and off-duty trips as well, and staff of other group companies could access the data without Article 28 agreements.
Data Protection Impact Assessment (DPIA)
It dependsonly in certain casesFor processing of this kind a DPIA (Article 35 GDPR) is required, expressly listed in the annex to the Garante decision no. 467 of 11 October 2018 for technological systems in the employment relationship, geolocation included. It must be done before switching the system on: in the Ligurian health authority case the missing assessment was among the findings.
Data retention limited to the strictly necessary period
YesrequiredData is kept for the time necessary for the purpose, not "just in case" indefinitely. In the road haulage case, retention for 180 days contributed to the penalty.
Garante Privacy, Provvedimento del 16 gennaio 2025, n. 10112287
Legitimate and declared purpose (organisational, safety, protection of company assets)
YesrequiredOrganisational, safety or company asset protection needs are legitimate purposes. Never "checking what the employee does": that is exactly what Article 4 prohibits.
Legge 20 maggio 1970, n. 300 (Statuto dei Lavoratori), art. 4
The procedure, step by step
Complete the Article 4 procedure first, not later: an agreement with the trade union representatives (RSA or RSU) or authorisation from the Territorial Labour Inspectorate. Without it, you are out from the first minute.
Define a legitimate and declared purpose: organisational, safety or company asset protection needs. Never "checking what the employee does".
Prepare a complete and truthful privacy notice under Article 13 GDPR: no typos, no grey areas.
Apply data minimisation: collect only the data you need, only when you need it. No tracking during breaks, provide the ability to switch it off.
Limit retention: data is kept for the time necessary for the purpose, not indefinitely.
Carry out the impact assessment (DPIA) when the risk is high (Article 35 GDPR).
Keep a single purpose: data collected for one purpose is not reused to sanction. Ever.
If you switch systems: when you change your monitoring system or software, update and re-issue the privacy notice, and check whether the trade-union agreement (Art. 4) or the Labour Inspectorate authorisation needs renewing. The provider (data processor), the data collected and the methods often change: the one signed earlier is not enough.
Who to contact
Garante per la protezione dei dati personali (Italian Data Protection Authority)
Verified on June 15, 2026
The template to download
Download the free GPS privacy notice template for Italy
Employee geolocation privacy notice template, compliant with GDPR Art. 13, including the countryโs legal basis and supervisory authority. Fill in the blank fields and have it checked by your advisor.
Want the next practical guides on GPS and field-team management too? Leave your email (optional).
No spam, unsubscribe in one click.
Garante Privacy, decision no. 755 of 18 December 2025 (Pioneer Hi-Bred Italia Sementi, doc-web 10213711), made public with newsletter no. 542 of 29 January 2026: 5 employees, telematics devices on vehicles with a driving-style score calculated on private trips as well.
https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10213711
Cite this page
You're free to cite it, as long as you credit the source with a link to this page.
GPS and worker monitoring in Italy: what you need to stay compliant - GeoTapp. https://geotapp.com/en-us/resources/gps-workers-eu/italy/Source: <a href="https://geotapp.com/en-us/resources/gps-workers-eu/italy/?utm_source=citazione&utm_medium=referral&utm_campaign=risorse">GPS and worker monitoring in Italy: what you need to stay compliant - GeoTapp</a>ยฉ 2026 GeoTapp. Data compiled and verified by GeoTapp. For full republication of the dataset or commercial use, get in touch.
Sources
- Garante Privacy, Provvedimento del 16 gennaio 2025, n. 10112287
- Garante Privacy, Provvedimento n. 755 del 18 dicembre 2025, n. 10213711 (Pioneer Hi-Bred Italia Sementi)
- Garante Privacy, Provvedimento n. 382 del 28 maggio 2026, n. 10259916 (Azienda di Tutela della Salute per la Liguria)
- Garante Privacy, Provvedimento n. 135 del 13 marzo 2025 (doc-web 10128005), annullato dal Tribunale di Cosenza con sentenza n. 972 del 1ยฐ luglio 2026
- Legge 20 maggio 1970, n. 300 (Statuto dei Lavoratori), art. 4
- Regolamento UE 2016/679 (GDPR), artt. 5, 13, 25, 35, 88
This is an informational resource, not legal advice. Before activating a monitoring system, have your situation checked by a professional.
Want a system that is already compliant?
GeoTapp records the location only at clock-in, not continuously, and generates the notice for workers to sign. Try it for free.