GPS tracking of company cars in Luxembourg: Labour Code L.261-1, CNPD and the staff delegation

Yes, an employer can track employees' vehicles in Luxembourg, but the law treats it as monitoring under Article L.261-1 of the Labour Code. It requires a specific purpose, prior individual and collective information, and compliance with the GDPR and the CNPD's rules: no tracking outside working hours, and data kept for two months as a rule.

This article is for fleet managers, HR directors and data protection officers. It sets out the exact procedure in Luxembourg with its timeline, what is prohibited, the case of company cars used privately and of cross-border drivers, retention periods, penalties and case law, the technical options and their real cost. It also shows how to track mileage, costs and charging without locating anyone: that is Voltaback's approach, which never passes drivers' location to the employer.

Can an employer track a company car?

Yes, under conditions. Since the GDPR, prior authorisation from the CNPD (Commission nationale pour la protection des données, Luxembourg's data protection authority) is no longer required. But tracking vehicles made available to employees remains processing for monitoring purposes under Article L.261-1 of the Labour Code, as amended by the law of 1 August 2018.

Three sets of rules apply at once:

• The GDPR: legal basis, purpose limitation, data minimisation, transparency, security, record of processing.
• Article L.261-1 of the Labour Code: prior collective information, the option to refer to the CNPD, and in some cases co-decision with the staff delegation.
• The CNPD guidelines on geolocation of employees' vehicles, updated on 22 February 2023, which turn these principles into concrete rules.

Source: CNPD, monitoring through vehicle geolocation.

Which legal basis?

In practice, the employer's legitimate interest (GDPR Article 6(1)(f)), provided employees' rights do not override it. Where a law requires tracking, for instance in some transport activities, the legal obligation can be the basis. Employee consent, however, is not a valid basis: the CNPD considers it cannot be freely given in an employment relationship.

The balancing test in three steps

If you rely on legitimate interest, you must document the balancing test. A three-step approach works well:

1. Interest: which specific, lawful interest does the company pursue? "Dispatching 30 on-call technicians" is specific; "better control" is not.
2. Necessity: can the goal be reached without tracking, or with less data? Less frequent position updates, tracking only during jobs, aggregated reports.
3. Balance: what does tracking mean for drivers, and which safeguards offset it? Privacy mode, short retention, restricted access, no disciplinary use.

This documentation is also the basis for informing the staff delegation and for a data protection impact assessment, if one is needed.

What can vehicle tracking be used for?

The CNPD lists the following purposes, without claiming the list is exhaustive:

• organising work better, such as sending the nearest vehicle to a job or managing the fleet;
• tracking sensitive goods (dangerous goods, food);
• proving a service was performed so it can be billed to the client;
• protecting company property (theft of the vehicle or equipment);
• protecting employees exposed to a particular risk (cash in transit, dangerous goods);
• recording working time, only when no other means is possible, for example for a field salesperson who never comes into the office;
• complying with a legal obligation, notably in road haulage.

The key rule: the purpose is set before installation and cannot change afterwards. A tracker installed against theft cannot be used to check working hours.

What is prohibited?

The CNPD guidelines draw clear lines:

• No permanent monitoring: continuous tracking amounts to electronic shadowing and is disproportionate.
• No tracking outside working hours: holidays, sick leave, lunch breaks, commuting, medical appointments and weekends are off limits.
• No monitoring of performance or behaviour beyond the stated purpose, such as time between two clients or the route chosen, for disciplinary use.
• No speeding data, unless a legal obligation applies to the employer.
• No broad access: only people who need it for their role see exact positions, with individual accounts and an access log.

What you want to know, and the least intrusive way to get it

The CNPD stresses that tracking is only acceptable when no less intrusive alternative exists. The table below helps you run that test.

Anti-theft and driving style: two purposes that often go too far

Anti-theft is an accepted purpose, but it does not justify continuous tracking. A proportionate system releases the position only after a theft report or a movement outside defined hours, with access limited to a named function. The same data cannot later be used for questions of working time or punctuality.

Driving style and safety can be assessed without a map. Harsh braking, rapid acceleration, consumption and idling are vehicle values, not positions. Used as coaching for the driver and in aggregated form for the fleet, they remain a light intrusion. How to build such a programme is described in our article on eco-driving for company fleets. Storing speed data to punish offences, by contrast, is only accepted by the CNPD where the law requires it.

What must the employer do before installing a tracker?

1. Define the purpose and record it

Describe precisely why you track, what data you collect and who has access. The processing goes into the record required by GDPR Article 30. Configure the tool to collect only what is needed, even if it can do more.

2. Check whether a DPIA is needed

The CNPD considers a data protection impact assessment (DPIA) necessary when tracking is used for regular and systematic monitoring of employees, such as recording working time. For simple route optimisation it is not necessarily mandatory, but the balancing of interests must be documented. The provider, a processor under the GDPR, must help you carry it out.

3. Inform the staff delegation

Article L.261-1 requires prior collective information to the staff delegation (délégation du personnel). It must include:

• a detailed description of the purpose;
• a detailed description of how the system works;
• where relevant, the retention period or the criteria for it;
• a formal commitment not to use the data for any other purpose.

Within 15 days of this information, the staff delegation, or failing that the employees concerned, can ask the CNPD for a prior opinion. The CNPD rules within a month, and the request has suspensive effect: processing cannot start in the meantime.

4. Co-decision in some cases

When tracking is used for employee health and safety, for controlling production or services where it is the only way to set exact pay, or for flexitime, Articles L.211-8 and L.414-9 apply. In companies with at least 150 employees, introducing automated staff monitoring systems is subject to co-decision with the staff delegation. Source: Pixie, extended powers of the staff delegation.

The timeline at a glance

Plan for at least six to eight weeks between the decision and the first position, longer where co-decision applies.

5. Inform each employee

Every driver receives individual information in line with GDPR Articles 12 and 13: a document for current staff, an annex to the employment contract for new hires. The CNPD also recommends a clearly visible notice in each vehicle.

6. Put a contract in place with the provider

If location data is stored by a provider, a data processing agreement (GDPR Article 28) is mandatory. The CNPD recommends storage within the European Economic Area.

Source for this section: CNPD, guidelines on geolocation of employees' vehicles.

What the driver information must contain

Individual information is not a sentence in the employment contract but a separate, understandable document. Under GDPR Article 13 and the CNPD guidelines, it includes:

Keep proof that each driver received the document, and update it whenever the system changes. The notice in the vehicle (pictogram or sticker) does not replace this document; it complements it.

7. After go-live: security and access

Obligations do not end with installation. The CNPD expects:

• individual accounts for every user of the tracking platform, no shared logins;
• roles and rights: dispatch sees real-time positions, accounting only aggregated kilometres;
• access logs, reviewed regularly;
• encryption in transit and at rest;
• automatic deletion at the end of the retention period, rather than manual clean-ups that get forgotten;
• a regular review of whether the purpose still exists and the settings still fit.

These points are not theoretical, as a CNPD decision of 8 April 2021 shows. A maintenance and installation company tracked 92 service vehicles, announced 12 months of retention and kept data for more than two years. The CNPD found breaches of storage limitation, the information duty and data security, imposed a €2,800 fine and ordered corrective measures within two months. A mere statement by the staff delegation that employees had been informed was not accepted as proof. Source: Ius Laboris, CNPD decision on vehicle tracking.

Company cars used privately: the privacy switch

The CNPD distinguishes two cases. A vehicle used strictly for work may be tracked permanently. But if the employee may use the car privately, the employer cannot track it outside working hours.

The employee must therefore be able to switch tracking off themselves outside working time. The CNPD is explicit: the employee must be in control, otherwise they never know whether the system is really off and are under psychological pressure.

What a privacy mode must do technically

A switch alone is not enough. To meet the CNPD's expectations, it should:

• record no position during private time, not even hidden or buffered;
• show the driver visibly whether tracking is on or off;
• give the employer at most the information that a private trip took place, without place or route;
• work verifiably: ask the provider for a technical description showing that no position data is created in private mode.

If the driver forgets the switch, the employer may not use the private data recorded by mistake and should delete it. A car policy that says so explicitly protects both sides.

Can an employee refuse tracking?

According to the prevailing view, an employee can refuse a tracking clause in the employment contract, unless tracking is objectively essential for the job, as in cash transport. The refusal alone is then neither misconduct nor grounds for dismissal. In a dispute, the employer must prove necessity and proportionality. Source: Pixie, refusing a geolocation clause.

The situation differs when tracking was lawfully introduced and the driver disconnects or jams the device on their own initiative. Jammers are in principle prohibited in the EU, and tampering with company equipment can have employment consequences. An employee who considers tracking unlawful should turn to the staff delegation or file a complaint with the CNPD.

Cross-border drivers

Nearly half of Luxembourg's employees live in Belgium, Germany or France. Commuting is one of the periods the employer may not track. A badly configured tracker therefore reveals the address and habits of an employee in another country, making the intrusion worse. For company cars with private use, a tool that never transmits location at all is the cleaner option.

Using tracking to count telework days? Not a good idea

With cross-border workers, one temptation is obvious: counting days outside Luxembourg from vehicle data. For tax purposes, residents of Belgium, Germany and France have a tolerance of 34 days a year; for social security, the limits are 25 % and under 50 % telework. Monitoring these thresholds is a legitimate concern for payroll.

Tracking the company car is the wrong tool, though. It would inevitably capture private trips and the home address, and "tax thresholds" appears in no CNPD list of purposes. The usual, proportionate methods are an employee declaration, a telework calendar or time recording. A company car parked at home says nothing about whether the driver worked that day anyway.

Special cases: pool cars, field staff, staff representatives

• Pool cars with no private use may be tracked while in use; assigning them to a driver still makes the data personal.
• Field sales and service technicians are the classic dispatch case; tracking ends with working time and excludes breaks.
• Staff delegation members may not be monitored through tracking while exercising their mandate. Analysing a delegate's trips to colleagues or to the union interferes with employee representation.
• Subcontractors and temporary workers are employed by another company; information and responsibilities must be settled by contract.
• Managing directors and shareholders do not necessarily fall under the Labour Code, but the GDPR still applies to them.

Which law applies when the car crosses the border?

A Luxembourg employer tracking its vehicles remains bound by Article L.261-1 and the CNPD guidelines, even if the car covers most of its route in Germany, Belgium or France. The GDPR applies identically in all four countries, and the neighbouring data protection authorities apply similar standards: no tracking in free time, purpose limitation, short retention. What matters for your organisation is this: a system configured compliantly in Luxembourg stays compliant across the border, and one that records home addresses is compliant nowhere.

How long can tracking data be kept?

The two months are a CNPD benchmark, not a statutory deadline: longer retention is possible, but it must be justified for the purpose in question and stated in the information to the staff delegation and drivers. Set the period per purpose, not for the whole system. Dispatch positions can often be deleted after a few days; proof for a client usually needs only job times, not the route. And anonymised indicators, such as kilometres per month and per vehicle, cover most analyses permanently.

What does the employer risk?

Breaching Article L.261-1 is a criminal offence (Article L.261-2 of the Labour Code): imprisonment from eight days to one year and/or a fine of €251 to €125,000. The court can also order the processing to stop, subject to a penalty payment. On top of this come GDPR administrative fines of up to €20 million or 4 % of worldwide turnover.

Employees can always lodge a complaint with the CNPD, and such a complaint cannot justify dismissal. There is also a risk that appears in no table of fines: monitoring perceived as covert damages drivers' trust, especially with company cars that are also used privately.

Can tracking data be used to discipline an employee?

Only within the stated purpose. Using an anti-theft tracker to reproach someone for lateness or a route is a misuse of purpose. Before the labour courts, the weight of evidence from a non-compliant system is assessed case by case, and Luxembourg case law tends to reject evidence from non-compliant monitoring. A dismissal based on it may then be ruled unfair.

A well-known judgment shows how the courts weigh things up. On 26 October 2017 (no. 44278), the Court of Appeal (Cour d'appel) ruled on the summary dismissal of an estate agent who had repeatedly used his strictly business car privately. The employer could not prove it had informed the employee beforehand. The court treated this as a mere irregularity and admitted the data, because given his flexible hours and the contractually business-only use, the employee had to expect checks. It also stated that a car with permitted private use may not be tracked outside working hours, whereas a business-only car may. Source: Paperjam, geolocation as lawful evidence.

Do not rely on this leniency. The ruling concerned a single case before the GDPR applied, and information requirements have become stricter since. With documented information and respected purpose limitation, the question never arises.

Box, app or connected car: what are the options?

What does tracking a company car cost?

Box-based solutions combine a monthly subscription per vehicle, the hardware and often fitting, plus the work each time a car is replaced. Box-free solutions have no hardware and no fitting. Visible prices, however, are only part of the bill.

Ask providers for the cost over the full lease term, including fitting and removal at each car change, and add the internal hours spent on documentation and access management. In a fleet with 3 to 4-year leases, every box is moved at least once.

Connected car data and the EU Data Act

Modern cars send their data to the manufacturer anyway. Since 12 September 2025, the EU Data Act applies: users of connected products have a right to access the data they generate and can have it shared with third parties. For fleets, this opens a route to mileage, state of charge and alerts without any additional device. The obligations under the GDPR and Article L.261-1 remain unchanged: what matters is which data the employer actually receives.

Tracking by the leasing company or manufacturer: who is responsible?

Many leased cars have a factory tracking function, and some leasing companies use it to protect their vehicles against theft. As long as only the leasing company uses the data for its own purposes, it is the controller. As soon as the employer can view drivers' positions through a customer portal, it becomes a controller itself and must meet all the obligations above.

For every lease or telematics contract, check three points: which data does the company see in the portal? Can positions be switched off for the company? And who informs drivers about the leasing company's processing? A tracking function nobody consciously introduced is the most common route to unintended monitoring.

Tracking mileage, costs and charging without tracking your employees

Most of a fleet manager's needs require no location at all: mileage, consumption, kWh charged at home, at work or on public networks, maintenance alerts, eco-driving. That is the logic of Voltaback's box-free telematics.

Electric cars: charging data can reveal places too

Electric company cars create a new data source: charging sessions. A charging card statement shows which public charger was used and when, and a wallbox platform shows when the driver is at home. When you organise home charging reimbursement, ask the same question as for tracking: which data do I really need?

Reimbursement needs three items: the kWh charged at home, the price of the electricity contract and the amount. Voltaback classifies each charging session in the car as home, company site or public, and passes only the result to the employer, never the coordinates. Cross-border workers are thus reimbursed at the price of their country of residence, without the company learning their address from position data.

Common mistakes with vehicle tracking

• Keeping the provider's default settings: a position every minute, around the clock, unlimited retention. Settings must fit the purpose, not the feature list.
• Informing the staff delegation after installation: information must come first, otherwise the 15-day period is meaningless and the monitoring is unlawful.
• Forgetting the privacy mode although private use is allowed.
• Using data for new purposes, such as anti-theft data for a warning letter.
• Shared platform logins, with no log of who viewed which position and when.
• No deletion routine, so that movement profiles still exist years later, as in the 2021 CNPD decision.

What a fleet achieves without tracking

Six of seven typical goals need not a single coordinate. Read more on automatic odometer readings in our article on fleet mileage tracking, and on breakdown prevention in fleet maintenance alerts.

Logbook and benefit in kind without employer tracking

A common argument for GPS is the company car benefit in kind. In Luxembourg it is usually calculated as a flat rate: 0.5 % or 0.6 % of the catalogue price per month for an electric car, 2 % for a combustion car registered from 2025. The flat rate needs no trip data at all.

If you choose the logbook method instead, private kilometres must be documented, commuting included. Employer tracking is not needed for that: the driver keeps the logbook, odometer readings at the start and end of each month come from the car, and the employer checks plausibility. The rules are explained in our article on the company car logbook.

What this means for your company

Voltaback is 100 % software, connected to more than 48 brands, ISO 27001 certified since 2 December 2025 and GDPR compliant. The company never receives drivers' geolocation. Telematics data (mileage, consumption, driving style) is still personal data: inform the staff delegation and drivers about how it is processed, and have the wording checked by your legal adviser. Your IT team will find the security details on our page for IT managers.

Checklist before starting a tracking project

1. Write down your needs and check for each one whether a position is really necessary.
2. Document purpose, legal basis and balancing test; update the record of processing.
3. Check whether a DPIA is needed.
4. Set the configuration: update frequency, working-time window, privacy mode, retention period, access roles.
5. Sign a data processing agreement with the provider and check storage in the EEA.
6. Inform the staff delegation in writing beforehand, wait 15 days, and if requested, the CNPD opinion.
7. Where co-decision applies (from 150 employees in the cases listed), obtain agreement.
8. Inform each driver individually and place a notice in the vehicle.
9. After go-live: log access, automate deletion, review every year and notify any changes again.

Manage your fleet without tracking your drivers

Voltaback reports the mileage, consumption, driving style, maintenance alerts and kWh charged of every company car, with no box and without ever sending location to the employer. Your drivers, resident or cross-border, keep their privacy; you keep the data you need.

Talk to our telematics team to see what tracking-free telematics changes for your fleet.