This guide covers what GDPR actually requires of fleet operators, which data categories trigger compliance obligations, how to establish a valid legal basis for tracking, and what to look for when evaluating fleet management technology.
TL;DR
- GDPR applies to any fleet operation processing personal data of EU-based drivers, including US companies with EU operations
- GPS location history, driver behavior scores, dashcam footage, and license details are all regulated personal data
- Document a lawful basis before collecting driver data — consent alone rarely holds up in employment contexts
- Compliance requires ongoing maintenance: privacy notices, retention schedules, vendor DPAs, and security controls
- Enforcement is real: Italy's Garante fined a road haulier €50,000 in 2025 for excessive GPS retention and break-time tracking
What GDPR Means for Fleet Management
GDPR has been in force since May 2018. Article 4(1) of the regulation defines personal data as any information relating to an identified or identifiable person — and expressly includes location data in that definition. That means the moment a fleet system logs a GPS coordinate linked to a named driver, it's processing personal data and GDPR obligations kick in.
The Extraterritorial Reach Most Operators Miss
GDPR doesn't stop at EU borders. Article 3 extends its reach to any organization — regardless of where it's headquartered — that monitors the behavior of EU residents. A US-based logistics company with European depots, EU drivers, or even EU-based customers receiving deliveries should assume GDPR obligations apply.
The 7 GDPR Principles, Applied to Fleet Data
| Principle | Fleet-Specific Meaning |
|---|---|
| Lawfulness & transparency | Drivers must be told what's tracked before collection starts |
| Purpose limitation | Data collected for route planning can't be repurposed for disciplinary action without separate justification |
| Data minimization | If aggregate fuel data serves the purpose, don't collect individual journey logs |
| Accuracy | Driver license records must be kept current and corrected on request |
| Storage limitation | Journey history can't be retained indefinitely — set and enforce deletion schedules |
| Integrity & confidentiality | Fleet data must be encrypted and access-controlled |
| Accountability | The operator must be able to prove compliance, not just claim it |
The Fine Structure — and Real Enforcement
GDPR operates on two penalty tiers:
- Standard violations (Articles 83(4)): up to €10 million or 2% of global turnover
- Serious violations (Article 83(5)): up to €20 million or 4% of global turnover — this tier covers failures to establish a lawful basis, transparency breaches, and data subject rights violations
Enforcement is active. Italy's Garante fined road haulier Autotrasporti Cuccu Riccardo S.r.l. €50,000 in January 2025 after GPS tracking on 50 tractor-trailers stayed active during driver breaks and retained location data for 180 days. The violations spanned Articles 5, 13, and 88 — meaning gaps in transparency, retention policy, and proportionality each contributed independently to the penalty.
What Personal Data Fleet Systems Collect
EDPB Guidelines 01/2020 on connected vehicles confirm that speed, distance, location, and driving behavior data all qualify as personal data when linked to a natural person. For most fleets, that covers the majority of what the telematics system collects.
The Main Data Categories
Directly identifying data:
- Driver name and employee ID
- License number and endorsement categories
- Medical or health certificates (HGV/commercial driver compliance)
- Training certifications and career history
Indirectly identifying data (still covered by GDPR):
- GPS coordinates and journey logs — a route history tied to a vehicle assigned to one driver identifies that driver
- Driver behavior scores: harsh braking, speeding events, acceleration profiles
- Tachograph records linked to a personal driver card
- Vehicle ID where the vehicle is exclusively assigned to one person
Dashcam Footage: A Separate Compliance Track
Dashcam footage requires its own governance. Treat it as a distinct compliance track, not a minor add-on to the main telematics policy. The ICO's vehicle surveillance guidance notes that in-vehicle recording is highly intrusive, particularly when audio is captured or when recording continues during personal use outside working hours.
Under EDPB video guidelines, footage is personal data. It can become special-category data if processed to infer health conditions, biometric identification, or other Article 9 attributes. That raises the bar for justification, disclosure, and storage limits.
Personal vs. Business Use
If drivers use fleet vehicles for personal journeys, GPS data collected during those trips carries stronger privacy weight. CNIL's employee geolocation guidance is explicit: drivers must be able to deactivate location transmission outside working time. The practical implementation is a privacy mode or privacy button that pauses tracking — a technical control, not just a written commitment.
What falls outside GDPR scope: Genuinely anonymized, aggregated data — such as total fleet fuel consumption with no individual attribution — is not personal data. Where anonymization is possible, do it. It removes GDPR obligations entirely for that data set.
Legal Bases for Processing Fleet Driver Data
GDPR requires a valid lawful basis before any personal data is processed. Choosing one without documenting the reasoning isn't enough — regulators expect to see the analysis, not just the conclusion.
The Three Bases Fleet Operators Use Most
| Lawful Basis | GDPR Article | Typical Fleet Use Case | Key Caution |
|---|---|---|---|
| Consent | 6(1)(a) | Optional features only | Employment imbalance makes consent unreliable (Recital 43) |
| Legitimate interests | 6(1)(f) | Route safety, asset protection, incident investigation | Requires a documented three-part test |
| Legal obligation | 6(1)(c) | Tachograph collection for HGV operators | Must cite the specific legal obligation |
Why Consent Usually Fails in Employment Contexts
GDPR Recital 43 warns that consent is unlikely to be freely given where there's a clear power imbalance between employer and employee — which covers most fleet operations. Bundling GPS tracking consent into an employment contract doesn't satisfy this requirement.
Consent applies to genuinely optional features. For routine business-route monitoring, legitimate interests or legal obligation is the correct basis.
Legitimate Interests: The Three-Part Test
EDPB Guidelines 1/2024 on legitimate interests require operators to document three interconnected tests:
- Purpose test — Is the interest lawful, specific, and real?
- Necessity test — Is the processing actually necessary to achieve it?
- Balancing test — Do the operator's interests override the driver's reasonable privacy expectations?
In practice, where legitimate interests applies — and where it doesn't — matters as much as passing the test itself:
| Legitimate Interest Applies | Legitimate Interest Does Not Apply |
|---|---|
| Vehicle security monitoring | Continuous monitoring during breaks |
| Health and safety on business routes | Tracking outside working hours without disclosure |
| Incident investigation | Using location data beyond the stated purpose |
GDPR Compliance Obligations for Fleet Managers
Fleet managers carry two core obligations under GDPR: giving drivers clear notice of how their data is used, and holding every vendor in the processing chain accountable through enforceable agreements.
Driver Privacy Notices
GDPR Articles 13 and 14 require privacy information to be provided before or at the point of data collection. A valid fleet privacy notice must cover:
- What data is collected and why
- The lawful basis relied on (and the legitimate interest, if applicable)
- Who has access to the data, including third-party vendors
- How long data is retained, by category
- Drivers' rights: access, erasure, correction, portability
- How to lodge a complaint with a supervisory authority
This notice must be in plain language — not buried in an HR handbook appendix.
Third-Party Vendor Accountability
Fleet operators are responsible for every supplier in their data processing chain. Under GDPR Article 28, a signed Data Processing Agreement (DPA) is mandatory with every vendor that processes personal data on the operator's behalf.
When evaluating telematics providers, routing APIs, or dispatch platforms, check for:
- Confirm whether data is stored and processed within the EU/EEA or transferred outside it
- Verify the vendor commits to 72-hour breach notification timelines (Article 33) in the DPA
- Require a full list of subprocessors and their geographic locations
- Check that cross-border transfers are covered by Standard Contractual Clauses (SCCs) or the EU-US Data Privacy Framework
Data Security and Retention Requirements
Security Controls Under Article 32
GDPR Article 32 requires security appropriate to the risk. For fleet data, that typically means:
- Encryption at rest and in transit
- Role-based access controls — only authorized personnel see driver-identifiable data
- Multi-factor authentication for platform access
- Audit logs recording who accessed which data and when
- Regular penetration testing and risk assessments
ISO/IEC 27001 certification is worth checking when evaluating vendors — CNIL's 2024 security guidance treats it as supporting evidence of reliability, but it doesn't replace the Article 32 controls themselves.
Retention Schedules by Data Category
GDPR requires data to be kept no longer than necessary. CNIL provides the clearest fleet-specific benchmarks:
| Data Type | Recommended Retention |
|---|---|
| Employee GPS / journey logs | 2 months; up to 1 year for service intervention records |
| Working time monitoring data | Up to 5 years |
| Dashcam / video footage | Erase within days; past 72 hours requires documented justification |
| Driver behavior scores | No official DPA benchmark — define by purpose and document |
| Safety-critical incident records | Extended retention may apply — document the necessity |
Operators should define written retention schedules for each data category and enforce them through technical controls — automated deletion policies, not manual processes.
Where data is stored matters as much as how long it's kept. If fleet data is processed by a US-headquartered software vendor, cross-border transfer safeguards must be in place.
Cross-Border Data Transfers
Options include:
- EU-US Data Privacy Framework: the Commission adopted an adequacy decision on 10 July 2023 for participating US organizations
- Standard Contractual Clauses (SCCs): the Commission's modernized SCCs, adopted in 2021, cover multiple transfer scenarios
- On-premise deployment: keeps data within a controlled environment and removes the transfer question entirely
Choosing a GDPR-Compliant Fleet Management System
The Compliance Checklist
When evaluating fleet management platforms, look for:
- ISO/IEC 27001 or SOC 2 Type II certification — independently audited, not self-declared
- Signed Data Processing Agreement available before contracts are signed
- Configurable data retention by data category, not just a global setting
- Role-based access controls limiting driver data to authorized personnel
- Driver privacy mode — ability to pause tracking during personal vehicle use
- Audit logs showing who accessed what data and when
- Subprocessor transparency — a complete list with locations included in the DPA
- Cross-border transfer documentation — SCCs, DPF coverage, or on-premise deployment
Why Deployment Model Matters
Cloud-hosted fleet platforms may route data through servers in multiple jurisdictions, which complicates GDPR cross-border transfer documentation. On-premise deployment addresses this directly — all routing and mapping services run behind the operator's own firewall, with no external data transmission.
NextBillion.ai's fleet management integration tools support on-premise deployment on any Kubernetes cluster (AWS EKS, GCP GKE, Azure AKS, or bare-metal) with no external data transmission. The platform holds SOC 2 Type II and ISO/IEC 27001:2022 certifications, provides a signed DPA incorporating SCCs for cross-border transfers, and includes role-based access controls and audit logging as standard features.
For fleet operators with strict data residency requirements — government contractors, healthcare transport, financial sector fleets — this architecture removes much of the transfer-compliance complexity.
Deployment model alone doesn't satisfy GDPR, though. Article 28, Article 32, and Chapter V controls still apply regardless of where the system runs. Treat on-premise deployment as strong evidence in a transfer assessment — not a replacement for the underlying documentation.
Integration Partners Need the Same Standards
The deployment architecture is only one piece. A GDPR-compliant platform is only as good as its integration ecosystem. Telematics hardware providers, routing APIs, and dispatch tools connected to your fleet management system all touch driver data. Request DPAs from each integration partner and verify their security certifications before deployment.
Frequently Asked Questions
Is a US company subject to GDPR?
Yes. GDPR Article 3 applies to any US company that monitors the behavior of EU residents or offers goods and services to them — including fleet operators with European drivers, EU depots, or EU customers. Headquarters location is irrelevant to the regulation's reach.
What is equivalent to GDPR in the USA?
There is no single federal equivalent. The US operates a patchwork of state laws, most notably the California Consumer Privacy Act (CCPA), alongside sector-specific regulations. US-based fleet operators with EU drivers must comply with GDPR directly — CCPA doesn't substitute for it.
What does GDPR compliant mean?
GDPR compliance means an organization has a documented lawful basis for processing, appropriate security measures in place, and upholds individuals' rights — including access, erasure, and portability. Organizations must also be able to demonstrate all of this to regulators at any time. Compliance is an ongoing obligation, not a one-time certification.
Can employees refuse GPS tracking under GDPR?
Drivers cannot refuse tracking during business use where a legitimate interest or legal obligation basis applies, but they are entitled to transparent disclosure of what is tracked and why. For personal use of company vehicles, operators must provide a way to disable tracking — such as a privacy button.
How long should fleet GPS tracking data be retained under GDPR?
GDPR sets no fixed period — operators must define schedules based on purpose. CNIL recommends two months for routine journey logs, extendable to one year for service intervention records. Safety-incident data may justify longer retention, provided the necessity is documented.
What are the penalties for GDPR non-compliance in fleet management?
GDPR uses a two-tier structure: less serious violations attract fines up to €10 million or 2% of global annual turnover; the most serious breaches — including processing without a lawful basis or failing to provide transparency — can result in fines up to €20 million or 4% of global turnover, whichever is higher.
