Can my employer track my company car? Vehicle tracking, UK GDPR and the ICO rules

Yes, a UK employer can track a company car, but only for a specific and legitimate purpose, after telling the driver clearly, and in a way that is necessary and proportionate. Location data is personal data under UK GDPR, and the Information Commissioner's Office (ICO) expects employers to assess the risk first and to avoid monitoring drivers in their private time.

This guide answers the question from both sides. For HR, fleet and IT managers: the legal framework, the six steps before a tracker goes live, the rules for cars used privately, retention, disciplinary use and the penalties. For drivers: what your employer may and may not see, and your rights. It ends with an option many fleets overlook: getting mileage, consumption and charging data without the company ever receiving drivers' locations, which is how Voltaback's telematics works.

In short (sources checked on 3 November 2026):

• Allowed: tracking for a defined business purpose (security, lone worker safety, dispatch, mileage records), with a lawful basis, transparency and a risk assessment.
• Expected: a Data Protection Impact Assessment (DPIA) for systematic monitoring of workers, a written policy and a privacy notice.
• Risky: tracking outside working hours in a car the driver may use privately, covert monitoring, or reusing location data for a purpose drivers were not told about.
• Drivers' rights: to be informed, to access their data within one month, to object, and to complain to the ICO.

Is it legal for an employer to track a company vehicle in the UK?

Yes. No UK law forbids vehicle tracking, and the vehicle belongs to the employer. But the moment a tracker records where an identifiable driver is, it processes personal data, and data protection law applies in full.

The ICO's position, in its guidance on monitoring workers, is that data protection law does not prevent you from monitoring workers, but you must do it in a way that complies with the law. That guidance covers monitoring on and off the premises, during and outside working hours, which takes in vehicle tracking.

The legal framework

Sources: ICO, data protection and monitoring workers, ICO, considerations for different ways of monitoring workers. The ICO has signalled that some of its guidance is being updated to reflect the 2025 Act, so check the current version before you finalise a policy.

Company car, van or employee's own car?

The analysis is the same in principle, but the balance shifts:

• A van or pool car used only for work: tracking during working time is the easiest case to justify.
• A company car the driver may use privately: tracking during work is justifiable; tracking evenings, weekends and holidays rarely is.
• The employee's own car (grey fleet): tracking is far more intrusive and very hard to justify. Collect only what you need, such as business mileage declared by the driver.

Vans, HGVs and the tachograph exception

For goods vehicles in scope of drivers' hours rules, some recording is a legal obligation, not a choice. A tachograph records driving time, speed and distance, and operators must keep and check those records. Data required by law has a lawful basis of its own (legal obligation), but only for that purpose: tachograph data cannot become a general location history of the driver without a separate assessment.

Car-derived vans and smaller vans driven under domestic rules usually have no tachograph. For them, the same legitimate interests analysis applies as for cars, with one difference: a van used only for work, parked at a depot overnight, raises far fewer private-life issues than a company car taken home.

What vehicle tracking can legitimately be used for

The purpose comes first. Each purpose must be written down before the tracker is switched on, and the data used only for it.

The ICO's test is not "is it useful?" but "is it necessary for this purpose, and is there a less intrusive way to achieve it?". Many fleets track locations because the box does it by default, when what they need is mileage, fuel or energy consumption and a maintenance alert.

What is not allowed, or very hard to defend

• Tracking in private time without a strong reason. Where a car can be used privately, the ICO's position is that monitoring during private use will rarely be justified, and employers should consider systems that let the driver switch tracking off outside work.
• Covert tracking. Hidden monitoring is for exceptional cases only, such as a specific suspicion of criminal activity or serious malpractice, with senior sign-off, a time limit and a DPIA.
• Function creep. Data collected for theft recovery cannot quietly become a performance management tool. A new purpose needs a new assessment and new information to drivers.
• Relying on consent. Because of the power imbalance between employer and employee, consent is rarely a valid lawful basis for workplace monitoring. Legitimate interests (with a documented balancing test) or a legal obligation are the usual bases.
• Unlimited access. Live location visible to every manager, with no access log, breaches the security and minimisation principles.

The test to apply: what you want to know, and the least intrusive way to know it

Before installing a tracker: the six steps

1. Define and document the purpose

Write down why you track, which vehicles, which data, at what times. This goes into your record of processing activities (ROPA).

2. Choose and document the lawful basis

For most employers this is legitimate interests. Carry out a legitimate interests assessment (LIA) in three parts: is the interest legitimate, is the tracking necessary to achieve it, and do the drivers' interests and rights override it? The Data (Use and Access) Act 2025 adds a short list of "recognised legitimate interests" (such as crime prevention and safeguarding) that need no balancing test, but routine fleet management is not one of them.

3. Carry out a DPIA

UK GDPR requires a DPIA where processing is likely to result in a high risk to individuals. The ICO considers that monitoring workers systematically is likely to meet that threshold, so a DPIA is expected for vehicle tracking in almost all fleets. It should describe the processing, assess necessity and proportionality, identify the risks to drivers and record the measures that reduce them: privacy switch, restricted access, short retention, aggregated reports.

A vehicle tracking DPIA that holds up usually answers these questions:

• What exactly is collected? Position, frequency of points, speed, harsh events, ignition times, identity of the driver.
• When? Working time only, or around the clock, and how private time is handled.
• Who sees what? Live map, reports, exports; which roles; whether access is logged.
• Why is each data item necessary? One line per purpose from step 1, and the less intrusive alternative considered.
• What could go wrong for the driver? Profiling, unfair discipline, exposure of a home address or medical appointments, data breach at the provider.
• What reduces the risk? Privacy switch, masking near home, aggregation, short retention, contract with the provider, training for managers.
• What is the residual risk, and who signed it off? If it remains high, the ICO must be consulted before processing starts.

4. Consult the workforce

The ICO encourages consulting workers or their representatives before introducing monitoring. Where a union is recognised or a collective agreement covers monitoring, consultation may be required. Consultation is also the best way to surface the fears that cause resistance later.

5. Inform every driver

Each driver must receive clear information before tracking starts:

• what is tracked (location, speed, harsh events, mileage) and when;
• why, and the lawful basis;
• who can see the data and in what form;
• how long it is kept;
• whether and how the data may be used in a disciplinary process;
• how to switch tracking off in private time, if applicable;
• their rights and how to exercise them.

A clause buried in the employment contract is not enough. A short vehicle tracking policy, signed for receipt, plus an updated privacy notice, is the usual approach.

6. Secure the data and control access

Limit access to named roles, log access, choose a provider that is ISO 27001 certified or equivalent, put a data processing agreement in place (Article 28 UK GDPR), and check where the data is hosted and whether it leaves the UK.

IT teams can see how we handle these points on our page for IT and information security managers.

A vehicle tracking policy: what to put in it

The policy is what drivers read, and what a tribunal or the ICO will ask for. Keep it short and specific. A workable structure:

1. Scope: which vehicles (company cars, vans, pool cars) and which drivers.
2. Purposes: the exhaustive list from your ROPA, in plain words. Anything not listed is not done.
3. Data collected: what, how often, and what is not collected.
4. Private time: how the privacy switch or schedule works, and the only exceptions (for example, theft).
5. Access: the roles that can see live data, reports and history, and the logging of access.
6. Use in disciplinary matters: whether data can be used, in which circumstances, and the right to explain it.
7. Retention: the period for each data type, and deletion.
8. Provider: who processes the data on your behalf, and where it is hosted.
9. Rights and contacts: how to make a subject access request, object or complain, and who the data protection contact is.
10. Review: the date of the next review, and how drivers will be told of changes.

Hand it out with the vehicle, ask for a signed receipt, and repeat the key points at each vehicle change. A policy that drivers have never read protects nobody.

Company cars used privately: the private time rule

Most UK company cars are available for private use, which is why they carry a benefit in kind. That is the hardest case for tracking.

The ICO's position is that monitoring a vehicle during private use will rarely be justified, and it points to systems that the driver can disable outside working hours. In practice:

• A privacy switch. A button or app setting that the driver controls stops location recording during private time. Mileage can still be counted as private miles, without locations.
• Working-hours schedules. Tracking active only during defined shifts, with exceptions for theft.
• Location masking. The system records trips but hides start and end points near the driver's home.

Two pitfalls. First, a privacy switch that the employer can override silently is not a privacy switch. Second, private use is not a reason to collect private journey details "for BIK": for an electric company car, the benefit in kind is a fixed percentage of the list price, whatever the private mileage, so private journeys need not be logged at all for tax.

How long can tracking data be kept?

UK GDPR does not set a fixed period: data must be kept no longer than necessary for its purpose. The answer differs by data type, so set a retention schedule per category:

For tax records, GOV.UK asks employers to keep PAYE records for 3 years after the end of the tax year (GOV.UK, PAYE records), and limited companies to keep company records for 6 years from the end of the financial year they relate to (GOV.UK, company and accounting records). Those obligations justify keeping mileage summaries, not every GPS point. Our guide to HMRC mileage log requirements shows what a valid record must contain.

Drivers' access to their data

Drivers have a right of access to the personal data held on them, through a subject access request (SAR). The employer must respond within one month, which can be extended by up to two further months for complex or numerous requests, with an explanation within the first month. Since the Data (Use and Access) Act 2025, the searches made in response must be reasonable and proportionate. Tracking data is often requested in disputes, so a system that can export one driver's data cleanly saves time.

Can tracking data be used in a disciplinary?

Yes, if three conditions are met:

1. The driver was told that tracking data could be used this way. Data collected under a "theft recovery only" notice cannot simply be reused for discipline.
2. The use is fair and proportionate. Under the Employment Rights Act 1996, a dismissal must fall within the range of reasonable responses, and the ACAS Code on disciplinary procedures applies. Tracking data should be put to the employee, who can explain it.
3. The data is reliable. GPS points drift, especially in urban areas. Corroborate before acting.

Data from undisclosed tracking is the weakest evidence: its collection may itself breach UK GDPR, and a tribunal can take that into account in assessing fairness. Failing to follow the ACAS Code can increase compensation by up to 25 %.

Typical legitimate cases: a vehicle used for undeclared private work during paid hours, falsified mileage claims, or dangerous driving after repeated warnings. Typical illegitimate cases: checking where an employee spent their weekend, or monitoring a trade union representative.

What does an employer risk with unlawful tracking?

ICO enforcement. The ICO can issue reprimands, enforcement notices ordering processing to stop, and fines of up to £17.5 million or 4 % of worldwide annual turnover, whichever is higher, for the most serious breaches of UK GDPR.

A real UK example of workplace monitoring. In February 2024, the ICO issued enforcement notices ordering Serco Leisure and associated leisure trusts to stop using facial recognition and fingerprint scanning to monitor the attendance of more than 2,000 employees at 38 sites. The ICO's reasoning applies directly to vehicle tracking: because of the power imbalance, staff could not freely refuse, and less intrusive alternatives existed. Source: The HR Director, on the ICO's Serco Leisure enforcement notices.

Employment claims. Unfair dismissal, constructive dismissal when trust breaks down, and claims based on misuse of private information.

The cost no fine captures. A tracker introduced badly creates distrust, resistance and turnover among drivers, which costs more than the system.

For drivers: what your employer can see, and your rights

• Can my employer track my company car? Yes, for a stated purpose, after telling you, and within data protection law.
• Can they track me at weekends? If the car is available for private use, tracking in private time should be rare and justified. Ask whether there is a privacy switch or a working-hours setting.
• Can I refuse? You cannot usually refuse tracking of a company vehicle that is lawful and proportionate, since it is not based on your consent. You can object to the processing, ask questions, request the DPIA summary and raise concerns through HR or a union.
• Can I unplug or block the tracker? Tampering with company equipment can be a disciplinary matter, and using a GPS jammer is illegal in the UK. Use the privacy features or raise the issue instead.
• Can I see my data? Yes, through a subject access request; the employer has one month to respond.
• Where can I complain? First to the employer, which must have a complaints process under the 2025 Act; then to the ICO.

Box, app or connected car: how vehicles are tracked

Boxes need fitting and removal at each vehicle change, which adds cost and downtime on leased cars. Connected car data needs no hardware and works across the brands the provider supports, and it can be filtered so that the employer only receives what the purpose requires.

What tracking really costs, beyond the subscription

Quotes for vehicle tracking usually show a monthly fee per vehicle. The full cost has more lines:

• Hardware and fitting: the unit, the installer's visit, and the vehicle off the road while it is fitted.
• Removal and refitting: at every lease return or vehicle change, typically every three to four years per car, plus any damage to trim the lessor charges at return.
• Compliance work: the DPIA, legitimate interests assessment, policy, consultation and annual review, usually shared between HR, IT and the data protection lead.
• Subject access requests: each one means extracting, reviewing and sometimes redacting a driver's tracking history within one month.
• Driver relations: time spent on objections, grievances and the occasional resignation of a good driver who will not be tracked.

A connected car approach removes the first two lines entirely, and shrinks the next three when no location reaches the employer.

Tracking mileage, energy and costs without tracking drivers

Most of what a fleet manager needs has nothing to do with where the driver is:

• Mileage for lease contract management and excess mileage; see our guide to fleet mileage tracking.
• Energy or fuel consumption per vehicle and per mile.
• Charging sessions: home or public, kWh and cost, to reimburse home electricity accurately.
• Maintenance alerts: service due, warning lights, tyre pressure, 12V battery; see fleet vehicle maintenance alerts.
• Driving behaviour as a coaching score; see eco-driving for fleets.

Voltaback's telematics without a box reads this data from the car itself, across more than 48 brands, with nothing to install. The company never receives drivers' geolocation: the platform tells you how many miles, how much energy, whether a session was at home or on a public charger, and what needs servicing, not where the car went. That design removes most of the DPIA risk at source, because the highest-risk data is never shared with the employer.

The platform is ISO 27001 certified since 2 December 2025 and UK GDPR compliant, and its charging measurement is audited by an independent third party (1.22 % average relative error). More than 200 companies use it, including major European groups.

The case of home charging reimbursement

Reimbursing a driver's home electricity for a company car is free of tax and National Insurance if the payment relates solely to the company car (HMRC EIM23900). Some employers assume this requires knowing where the car is. It does not: what HMRC's condition needs is the kWh that went into the car and their price. Knowing that a session took place at the driver's home, without the employer seeing the address or the journeys, is enough.

What it changes in practice

Next step: the fleet data you need, without the location you do not

Lawful tracking is possible, but it takes a purpose, a DPIA, a policy and constant restraint. Most fleets can skip that weight by collecting only what they use. Talk to our telematics team to see mileage, consumption, charging and maintenance data from your cars, with no box and no driver locations, or run the telematics savings simulator.