The core rule: proportionality
GPS tracking of employees is legal under GDPR — but only when it's proportionate to a legitimate business purpose. Coordinating deliveries, confirming service visits, ensuring worker safety: all valid. Tracking someone's every move 'just in case': not valid.
Four things you must do
- Define the purpose: route optimisation, safety, service confirmation — and write it down
- Limit tracking to working hours only: workers must be able to switch GPS off in personal time
- Inform your team clearly: what's collected, why, who can see it, how long it's kept
- Document it: include GPS use in your work regulations and run a DPIA if tracking is large-scale or structural
What you must not do
- Track 24/7 — tracking outside working hours violates GDPR proportionality
- Use GPS data for automatic sanctions (e.g. speeding alerts that trigger discipline) without prior disclosure
- Store location data longer than necessary — the CNIL recommends a maximum of two months
- Skip informing workers — undisclosed tracking can invalidate evidence in any later dispute
Sector-specific notes
For field service and logistics, GPS is expected and easily justified. For cleaning and maintenance, route planning by supervisors is fine — constant tracking per worker is harder to justify. For construction, GPS for vehicle and machinery protection is standard; it should not duplicate any presence-registration system already in use.
How Done-it handles it
Done-it activates GPS only at check-in, check-out and during active travel for work. There is no 24/7 tracking, no monitoring during breaks or personal time. Data is hosted in the EU with encryption and a dedicated Data Protection Officer — ready for any privacy audit.
