Tracking company vehicles under the GDPR: what employers may do, country by country

Yes, an employer can track company vehicles in Europe, but only for a defined, legitimate purpose, after informing drivers and their representatives, and without following them in their private time. Location data is personal data under the GDPR, and each country adds its own labour law layer: works council co-determination in Germany, consent of the works council in the Netherlands, a union agreement or labour inspectorate authorisation in Italy, express prior information in Spain.

This guide gives HR, IT, legal and fleet managers a clear grid of what is allowed and what is not, the rules of seven countries side by side, retention periods, the use of tracking data in disciplinary cases and real enforcement decisions. Drivers will find their rights. The last section asks the question many fleets should ask first: do you need the location at all? Voltaback, for instance, manages mileage, costs and charging for its client fleets without the company ever receiving the drivers' location.

Is it legal to track employees' vehicles?

GPS tracking is not banned anywhere in Europe. It is regulated, because a vehicle's position tells you where a person is, and often where they live, who they visit and when they rest. The tests come from the GDPR and are the same in every EU country:

1. Purpose: a specific, explicit and written reason, such as theft recovery, dispatch of field technicians or proof of business mileage (Article 5(1)(b) GDPR).
2. Lawful basis: for a private employer, usually legitimate interests (Article 6(1)(f)), backed by a documented balancing test; for a public body, a task in the public interest.
3. Necessity: no less intrusive way to reach the same goal. If the odometer answers the question, the position is not necessary.
4. Transparency: drivers are told before the system starts, in writing, what is collected, why, who sees it and for how long (Articles 13 and 14).
5. Proportionality and minimisation: only the data needed, only during working time, kept only as long as necessary.
6. Impact assessment: systematic monitoring of employees is a typical case requiring a data protection impact assessment (DPIA) before go-live (Article 35).

Consent is rarely the right basis. In an employment relationship, the employee is not free to refuse, so consent is not "freely given". A signature under the tracking policy proves the driver was informed, not that they agreed.

The employer is the data controller. The tracking provider is a processor and needs a data processing agreement under Article 28 GDPR, covering security, sub-processors and deletion.

The European guidance on vehicles

The Article 29 Working Party, whose guidance the European Data Protection Board has kept, addressed vehicle tracking directly in its Opinion 2/2017 on data processing at work. Its key points: tracking a vehicle is tracking its driver; the employer must state the purpose and inform drivers clearly; and where private use of the vehicle is allowed, the employee should be able to switch location tracking off temporarily. Source: Article 29 Working Party, Opinion 2/2017 (WP249).

National regulators apply the same logic. The EDPB has also relayed a Slovenian case where continuous, retrospective tracking of company vehicles was found disproportionate, even though protecting property can be a legitimate interest. Source: EDPB, national news 2022.

Country by country: the labour law layer

The GDPR sets the floor. Article 88 lets each Member State add rules for employment, and labour law decides who must be involved before a tracker goes live.

Germany

• Legal basis: Article 6 GDPR, or a works agreement (Betriebsvereinbarung) under Article 88. Section 26(1) BDSG is widely considered no longer a valid stand-alone basis since the CJEU judgment of 30 March 2023 on a similar Hessian clause. Source: CJEU, C-34/21.
• Works council: under § 87(1) no. 6 BetrVG, the works council has a co-determination right over any technical device objectively suitable to monitor behaviour or performance, whatever the employer's intention. A tracker, a telematics box or an app reading vehicle data all qualify. Without agreement, the works council can stop the system. Source: § 87 BetrVG.
• Case law: German courts treat permanent tracking that builds movement profiles as disproportionate; the administrative court of Lüneburg ruled so on 19 March 2019 (4 A 12/19), noting that occasional location lookups would have been enough to recover stolen vans. Source: Dr. Datenschutz.

Netherlands

• Works council consent: article 27(1)(l) of the Works Councils Act (WOR) gives the ondernemingsraad a right of consent over systems that observe or monitor the presence, behaviour or performance of staff. A decision taken without consent is void once the works council invokes it in writing within a month. Source: Wet op de ondernemingsraden, article 27.
• Regulator: the Autoriteit Persoonsgegevens (AP) stresses that an employer may not monitor staff structurally when it is not necessary for a clear purpose, and has published a privacy booklet for works councils with a worked example of GPS trackers in company cars. Source: Autoriteit Persoonsgegevens.
• Tax link: a driver who declares no private use (fewer than 500 private km a year) must be able to prove it, and the employer must be able to show that a ban on private use is enforced. Tracking can produce that proof, but the private trips then become visible, which the policy must address.

Belgium

• No specific statute: no law or interprofessional agreement targets vehicle tracking. CBA no. 81 covers electronic communications and CBA no. 68 cameras; neither applies to GPS.
• Social consultation: the works council must be informed and consulted on new technologies (CBA no. 9 and no. 39), and the work rules updated if the data can lead to sanctions.
• Regulator: the Data Protection Authority (APD / GBA) accepts a limited list of purposes written down before the system starts, and recommends that drivers can switch tracking off. Source: GBA, geolocation.

Luxembourg

• Legal basis and information: the CNPD's guidelines on the geolocation of employees' vehicles set out purposes, private use and retention; the Labour Code requires prior information of the staff delegation and of the employees concerned.
• Co-decision: in companies with at least 150 employees, introducing automated staff monitoring systems is subject to co-decision with the staff delegation.
• Private use: a car with permitted private use may not be tracked outside working hours. Source: CNPD, vehicle geolocation guidelines.

Italy

• Article 4 of the Workers' Statute (law 300/1970, as amended in 2015): tools that allow remote monitoring of workers may be installed only for organisational, production, safety or asset protection needs, and only after an agreement with the union representatives or an authorisation from the National Labour Inspectorate.
• GPS is not a "work tool": the Inspectorate considers that a GPS device is not, in principle, necessary to perform the work, so the agreement or authorisation is required; it confirmed this view in note 1511 of 16 February 2026. Individual consent does not replace the procedure, and a breach is a criminal offence. Sources: Normattiva, law 300/1970, INL note 1511/2026.

Spain

• Article 90 of the data protection law (LOPDGDD) allows employers to use geolocation within their power of control (article 20.3 of the Workers' Statute), provided they inform workers and their representatives beforehand, expressly, clearly and unequivocally, about the device and the workers' rights.
• Works committee: article 64.5(f) of the Workers' Statute gives it the right to issue a prior report on new control systems; collective agreements may add guarantees (article 91 LOPDGDD). Sources: LOPDGDD (BOE), AEPD, data protection in employment.

United Kingdom

Outside the EU, the UK applies UK GDPR and the Data Protection Act 2018. The ICO's guidance on monitoring workers (October 2023) follows the same logic: legitimate interests rather than consent, transparency, a DPIA for systematic tracking, and a privacy mode where private use is allowed. Source: ICO, monitoring workers. Our UK site covers the British rules in detail.

Comparison table

A group with fleets in several countries needs one policy with country annexes: the same purposes and the same tool, but a different consultation procedure in each country. Start with the strictest, typically Germany or Italy, and the others follow more easily.

Lawful purposes and forbidden uses

The rule of thumb: if you cannot explain in one sentence why you need the position at a given moment, you probably do not need it.

The less intrusive alternative test

Regulators expect you to go through this table in the DPIA. Most fleet questions end up in the right-hand column.

Company cars with private use

Most company cars may also be used privately. That changes everything: the employer must not follow the driver in the evening, at weekends or on holiday.

• Privacy switch: a button or app mode that the driver controls, as recommended by the European guidance and the Belgian, Luxembourg and UK regulators.
• Time windows: automatic cut-off outside working hours. It works poorly for flexible hours, which is why a driver-controlled switch is preferred.
• Recording, not just display: if the provider records continuously but only shows the employer office hours, the recording itself may be disproportionate. The Belgian GBA reprimanded an employer for exactly this in 2025.
• Commuting: home-to-work trips are usually private time; recording them reveals the driver's home address and habits.

Some tax rules need a split between business and private kilometres: a trip log in the Netherlands to prove fewer than 500 private km, a logbook in Germany to escape the 1 % (0.25 % for electric cars) flat rate. These can be kept without the employer receiving positions; our guide to the business mileage log shows how.

Retention periods

No EU country fixes a single retention period for vehicle location data. The rule is the GDPR principle of storage limitation: keep the data as long as the purpose requires, then delete or anonymise it. Regulators look for a period per purpose, written in the policy.

Luxembourg's CNPD gives indicative periods in its guidelines (two months by default for most purposes). Missing or excessive retention is the breach regulators find most often.

Before go-live: six steps

1. Write the purposes, one by one, and check each against the less intrusive alternative.
2. Run the DPIA: description of the processing, necessity and proportionality, risks for drivers, measures (privacy switch, access rights, retention, security). Involve the data protection officer early.
3. Involve the employee representatives according to the country: agreement in Germany, consent in the Netherlands, union agreement in Italy, information and consultation in Belgium and Spain.
4. Sign the processing agreement with the provider, and check its security certifications.
5. Inform every driver in writing before activation: purposes, data, recipients, retention, rights, how to use the privacy switch.
6. Review after six months: are the data used only for the stated purposes, and are they deleted on time?

Using tracking data in disciplinary cases

Tracking data can be used as evidence only if drivers were told in advance that it could be used that way, and the system complies with data protection and consultation rules.

• Germany: evidence from monitoring that breaches co-determination or data protection law can be excluded by labour courts.
• Italy: article 4(3) of the Workers' Statute allows disciplinary use only if workers received adequate information on how the tools work and how checks are done, in line with the data protection code.
• Luxembourg: the Court of Appeal admitted GPS data in a 2017 dismissal case (26 October 2017, no. 44278) despite a missing prior notice, because the car was business-only; it stated that a car with permitted private use may not be tracked outside working hours. Source: Paperjam.
• Belgium: labour courts are split; some have excluded GPS data collected without proper information, others have admitted it.
• Spain: courts check that the prior information required by article 90 was given; without it, evidence is at risk.

A compliant system, documented before go-live, is the only reliable protection.

Fines and enforcement

Breaches can be fined up to 20 million euros or 4 % of worldwide turnover under the GDPR. In practice, vehicle tracking cases end in reprimands and fines in the thousands or tens of thousands of euros, plus orders to change the system.

Sources: Garante privacy, doc. web 10112287, WEKA, Bremen fine, Ius Laboris, CNPD decision, GBA, decision 61/2025.

The fines are modest compared with the other costs: a system that must be switched off, evidence that cannot be used, a works council conflict, and drivers who lose trust in the fleet team.

What a tracking policy must contain

Whatever the country, regulators and works councils expect a written policy before activation. A compliant policy covers:

• Purposes, listed one by one, with the reason why each needs the position and the less intrusive means that were considered;
• Vehicles and drivers concerned: pool cars, service vans, company cars with private use, each with its own rule;
• Active periods: working hours only, with the privacy switch and how to use it;
• Data collected: position, time, ignition, speed or not, with the frequency of collection; a list that ends with "etc." was criticised by the Belgian regulator;
• Recipients: who may see which data, with named roles (planner, fleet manager, HR only in a specific incident);
• Retention: one period per purpose, and automatic deletion;
• Disciplinary use: whether the data can be used, in which cases, and how the driver is heard;
• Rights: access, rectification, objection, and how to exercise them;
• Provider: name, processing agreement, hosting location, security certifications;
• Review: when the policy and the system are reassessed.

The policy is attached to the work rules or the works agreement where the country requires it, and given to every new driver with the vehicle.

Drivers' rights

Drivers keep their GDPR rights over tracking data:

• Access: a driver can ask for a copy of the data held about them, including trip histories; the employer must answer within one month, extendable in complex cases.
• Rectification and erasure: wrong or unlawfully kept data must be corrected or deleted.
• Objection: where the basis is legitimate interests, a driver can object on grounds relating to their particular situation; the employer must then show compelling legitimate grounds.
• Complaint: a driver can complain to the national regulator (the AP in the Netherlands, the GBA in Belgium, the CNPD in Luxembourg, the Garante in Italy, the AEPD in Spain, a German state authority).

Disabling or jamming a tracker without authorisation is a different matter: it can be misconduct under the work rules. The right answer to an unlawful system is a complaint or the works council, not sabotage.

Special cases

• Pool cars: several drivers use the same car, so the employer must know who drove when; a booking system linked to trips is less intrusive than tracking each driver.
• Heavy goods vehicles: vehicles above 3.5 t used for the carriage of goods already carry an EU smart tachograph that records positions under the road transport rules; that data has its own legal basis and must not be reused for other purposes without a separate assessment.
• Staff representatives: tracking a representative's car can reveal union activity; restrict access and be ready to justify every consultation of their data.
• Temporary workers and contractors: the user company that tracks the vehicle remains a controller and must inform them, even if the agency is the employer.
• Directors and executives: their cars often carry more private use; the same rules apply, and a stricter privacy setting is often wise.
• Home charging: charging sessions at home reveal the driver's address and presence; a charging solution should pass kWh and amounts to the employer, not timestamps and locations.

Common mistakes

1. Asking drivers to sign a "consent to GPS" form instead of following the national procedure.
2. Installing first and consulting afterwards: in Germany and the Netherlands, the system can be stopped or declared void.
3. Recording continuously and filtering only the display: the recording itself is the processing.
4. No retention rule, or a rule nobody applies.
5. Using theft-protection data to check working hours, without saying so in the policy.
6. Tracking for mileage, when the odometer gives the same answer without positions.
7. Forgetting the provider's own retention and access, which count as yours.

The real cost of tracking

The subscription is the visible part. A tracking project also costs:

• Hardware and fitting: a box per vehicle, fitted by a technician, removed and refitted at every vehicle change; on a fleet renewed every three to four years, that is a recurring job.
• Legal and HR time: the DPIA, the policy, the works council negotiation or the union agreement, the information of every driver; in Germany or Italy this can take months.
• Operations: answering access requests, applying deletion, handling privacy switch disputes, auditing who looked at what.
• Risk: a system found unlawful must be stopped, the data deleted, and the evidence built on it may be lost.
• Trust: drivers who feel watched are less willing to report incidents or accept other fleet changes.

Set these against what the company actually needs to know. If the answer is kilometres, energy, costs and maintenance, a system without positions avoids most of these costs from the start.

Questions to ask a telematics provider

1. Can the system work without collecting positions at all, and is that a setting or a separate product?
2. If positions are collected, is the privacy switch in the driver's hands, and does it stop recording or only hide data?
3. Where is the data hosted, who at the provider can access it, and which certifications cover it (for example ISO 27001)?
4. What are the default retention periods, and can they be set per purpose?
5. Does the provider supply a DPIA template and a processing agreement under Article 28 GDPR?
6. How are access requests from drivers handled, and how fast?
7. Does it use connected car data under the Data Act, or does it require a box?

For drivers: what to check

If your company car is, or is about to be, tracked, check five things:

1. Did you receive written information before the system started, listing purposes, data, recipients and retention?
2. Was the works council, staff delegation or union informed, consulted or asked to agree, as your country requires?
3. Is there a privacy switch or an automatic cut-off for evenings, weekends and holidays if private use is allowed?
4. Does the policy say whether the data can be used in a disciplinary procedure?
5. Who can you ask for a copy of your data, and who is the data protection officer?

If the answers are missing, ask HR or the data protection officer in writing first. Most problems are fixed at that stage. If not, your employee representatives and the national regulator are the next steps.

Tracking methods compared

The EU Data Act (Regulation (EU) 2023/2854), applicable since September 2025, gives users access to the data their connected products generate, including cars, and lets them share it with a service of their choice. That makes the car itself a legitimate, user-controlled data source. Source: EUR-Lex, Data Act.

Many fleet needs, such as mileage tracking, eco-driving and maintenance alerts, do not need the vehicle's position at all.

Cross-border drivers and international groups

A driver employed in Luxembourg and living in Belgium, or employed by a Dutch subsidiary and driving in Germany, raises the question of which rules apply. As a rule of thumb, the GDPR applies through the employer's establishment, and the labour law layer follows the employment contract and the place of work. A group should therefore apply the consultation procedure of each employing entity, and choose a tool that respects the strictest national rule everywhere. A system that does not collect positions at all removes most of the cross-border complexity.

Mileage, costs and charging without location

Most fleet managers do not want to know where their drivers are. They want mileage, consumption, costs and charging. Those can be collected without passing a single position to the employer.

That is how Voltaback works. The platform reads data from the connected car, for more than 48 brands, with no box to install:

• Telematics without a box: mileage, energy or fuel consumption, eco-driving, alerts and maintenance, including petrol and diesel cars.
• Home charging: each session measured and reimbursed at real cost.
• Privacy by design: the company never receives the drivers' geolocation. Voltaback is ISO 27001 certified since 2 December 2025 and GDPR compliant.

For works councils, union representatives and data protection officers, this removes the hardest part of the discussion: there is no location data to justify, retain or protect, and the DPIA becomes much simpler. See how fleet telematics works, and what it means for IT and security teams.

Manage your fleet without watching your drivers

Tracking is lawful when it is necessary, transparent and limited. For mileage, costs and charging, it is often not necessary at all.

Talk to our telematics team to see fleet data without location, or book a demo of home charging reimbursement.