Car tracker legality UK: what owners and employers must know - LRD Track

Car tracker legality UK: what owners and employers must know

GPS tracking is legal in the UK. But “legal” depends entirely on who owns the vehicle, what lawful basis you can document, and whether the people being tracked have been told about it. Get those three things right and you are on solid ground. Get them wrong and you are looking at ICO enforcement, employment tribunal claims, or worse.

Here is the quick verdict by situation:

  • ✅ Private owner tracking their own vehicle: generally lawful, because it does not ordinarily process other people’s personal data. Check joint ownership and notify long-term borrowers.
  • ⚠️ Employer tracking employees in company vehicles: lawful only with a documented lawful basis, a clear privacy notice, and proportionate controls. Run a Data Protection Impact Assessment (DPIA) before you switch anything on.
  • 🚫 Covert tracking of someone else’s vehicle, GPS jammers, or harassment-driven surveillance: unlawful. Criminal exposure under the Protection from Harassment Act 1997 and beyond.

Your immediate action:

  • Owner: confirm you hold title or have consent from all co-owners.
  • Employer: start your DPIA and draft a privacy notice before deployment.
  • Employee concerned about tracking: ask your employer for their monitoring policy and submit a Subject Access Request if needed.

Key takeaways

Car tracker legality in the UK turns on three things: ownership or documented lawful basis, a specific privacy notice, and proportionate data retention — get all three right before any device is switched on.

Point Details
Legal verdict Tracking is lawful in many circumstances but depends on ownership, lawful basis, and transparency under UK GDPR.
Private owners Tracking your own vehicle is generally lawful; check joint ownership and notify regular drivers or long-term borrowers.
Employer obligations Document a lawful basis (usually legitimate interests), complete a DPIA, and issue a specific privacy notice before deployment.
Disciplinary use GPS data can be used as evidence only if collection was lawful, the purpose is compatible, and ACAS Code fair procedure is followed.
Prohibited practices GPS jammers and covert tracking of others’ vehicles are illegal and can lead to criminal prosecution or ICO enforcement.

Table of Contents

Is car tracker legality UK a settled question — or does it depend?

It depends. Vehicle tracking in the UK sits at the intersection of several legal frameworks, and no single statute gives a clean yes or no. DavidsonMorris notes that the core principle is privacy-by-design: treat GPS location data as personal data from the outset, and build your compliance around that.

The primary instruments are:

Law / Guidance Primary focus for tracking Who it mainly affects
UK GDPR & Data Protection Act 2018 Lawful basis, transparency, minimisation, retention Data controllers (employers, fleet operators)
Human Rights Act 1998, Article 8 Right to private and family life Employees, passengers, any tracked individual
Protection from Harassment Act 1997 Covert surveillance, stalking, harassment Individuals tracking others without consent
ICO Surveillance in Vehicles Guidance Practical compliance: DPIA, privacy notices, access Organisations deploying vehicle surveillance
Employment Rights Act 1996 & ACAS Code Fair procedure in disciplinary proceedings Employers using GPS data as evidence

GPS location data is personal data the moment it can be linked to an identifiable person. That means every UK GDPR principle applies: lawful basis, purpose limitation, data minimisation, storage limitation, and security.

Under UK GDPR, the lawful bases most relevant to vehicle tracking are:

  • Legitimate interests (Article 6(1)(f)): the most commonly used basis for employer tracking. Requires a documented balancing test showing your interests outweigh the driver’s privacy rights.
  • Performance of a contract (Article 6(1)(b)): applicable where tracking is a genuine requirement of the employment contract or service agreement.
  • Legal obligation (Article 6(1)©): relevant where tachograph rules or other regulations mandate location recording for heavier vehicles.

Consent is rarely the right basis in employment. ExpertMarket’s UK guide is direct on this: the power imbalance between employer and employee means consent is unlikely to be freely given, and therefore unlikely to be valid. Employers should still record employee acknowledgement of the policy, but that acknowledgement is not the lawful basis itself.

ACAS and the Employment Rights Act 1996 become relevant the moment GPS data is used in a disciplinary context. More on that below.

What are the rules for tracking your own car?

Tracking your own personally owned vehicle is generally lawful because it does not ordinarily process other people’s personal data. A Thatcham-approved tracker fitted to your Land Rover Defender for theft recovery is a straightforward case. The legal complexity creeps in at the edges.

Ownership checklist before you install:

  • ✅ Confirm you are the registered keeper and legal owner (or have written consent from the owner).
  • ✅ If the vehicle is jointly owned, obtain consent from all co-owners in writing.
  • ✅ For long-term loans or company cars used personally, notify the borrower or driver that a tracker is fitted.
  • ✅ If passengers’ location data may be incidentally recorded, consider whether a privacy notice or brief notification is appropriate.
  • ✅ Delete or anonymise third-party data (e.g. passenger journey records) when it is no longer needed for your purpose.

Practical scenarios:

Family car: if your partner or adult children drive the vehicle regularly, tell them the tracker is there. A brief conversation is sufficient for personal use, but document it if the vehicle is also used for business.

Stolen-vehicle recovery: this is the clearest lawful use. Insurers increasingly require Thatcham-approved devices, and the purpose (recovery of your own property) is straightforward to justify. Lrd-track’s insurance-approved trackers are built specifically for this scenario.

Insurer-required trackers: where your insurer mandates a black-box or GPS device, the lawful basis is contractual. Notify all regular drivers.

The key caution: tracking a vehicle you do not own, or tracking a person rather than a vehicle, shifts the analysis entirely. That is where the Protection from Harassment Act 1997 and Article 8 of the Human Rights Act 1998 come into play.

How and when can employers lawfully track vehicles?

Employers can track company vehicles. But “can” comes with conditions. The ICO is clear that monitoring must be transparent, proportionate, and backed by a documented lawful basis. Switching on a tracker without telling drivers is not a grey area — it is a breach.

Lawful basis and balancing test

Legitimate interests is the most defensible basis for most fleet operators. To rely on it, you must complete a Legitimate Interests Assessment (LIA) that:

  • Identifies the specific business purpose (route verification, lone-worker safety, fuel management, theft recovery).
  • Confirms the tracking is necessary for that purpose and not achievable by less intrusive means.
  • Demonstrates that your interests do not override the driver’s reasonable expectation of privacy.

When is a DPIA required?

A DPIA is required when tracking is systematic, large-scale, or involves monitoring employees continuously. In practice, any fleet of more than a handful of vehicles with continuous GPS logging almost certainly triggers this threshold. The DPIA must assess necessity, proportionality, and specific mitigations for drivers and passengers.

What your privacy notice must include

Per ICO guidance, drivers must be told:

  • ✅ The purpose of tracking (e.g. route verification, theft recovery, safety).
  • ✅ The lawful basis relied upon.
  • ✅ How long data is retained and why.
  • ✅ Who has access (fleet manager, HR, third-party processor).
  • ✅ The identity of the data controller.
  • ✅ Their rights: access, rectification, objection, and complaint to the ICO.

A vague clause buried in an employment contract does not satisfy this. The notice must be specific, accessible, and given before tracking begins.

Working time versus personal time

This is where many employers trip up. Tracking during working hours is easier to justify. Tracking a driver’s personal movements outside work hours is far harder to defend and, in most cases, disproportionate. Nelsons Law recommends technical mitigations for mixed-use vehicles: a driver-controlled privacy mode, automatic deactivation outside working hours, or job-activation GPS that only logs when a job is open. These measures reduce DPIA risk and provide documented evidence of proportionality.

Can you use GPS tracker data in a disciplinary hearing?

Yes, but with clear conditions. DavidsonMorris confirms that GPS data can serve as evidence in disciplinary proceedings, provided collection was lawful, the purpose is compatible with the original tracking purpose, and the employer follows fair procedure under the ACAS Code of Practice and the Employment Rights Act 1996.

Before relying on GPS evidence, confirm:

  • ✅ The data was collected under a documented lawful basis the employee was told about.
  • ✅ Using it for disciplinary purposes is compatible with the stated tracking purpose (e.g. route verification data used to investigate an unauthorised journey is likely compatible; using it to investigate an unrelated personal matter is not).
  • ✅ The data is accurate. GPS signals can be affected by tunnels, tall buildings, and device faults. Do not treat a single data point as conclusive.
  • ✅ The employee receives the relevant data in advance of any hearing so they can respond to it.

Recommended process:

Treat GPS data as one strand of evidence, not the whole case. Document how the data was extracted, who analysed it, and what it shows. Allow the employee to challenge the data’s accuracy. Apply proportional sanctions. Tribunals apply the “range of reasonable responses” test: even if the data shows misconduct, a dismissal can be unfair if the procedure was flawed. Poor process is the most common reason GPS-based dismissals fail at tribunal.

What data can you collect, and how long can you keep it?

GPS location data is personal data once it identifies a person. That means UK GDPR’s data minimisation and purpose limitation principles apply directly. Collect only what you need for the stated purpose, and delete it when that purpose is served.

Retention benchmarks used in practice:

Purpose Suggested retention period Notes
Job verification / client dispute evidence 24 months Covers most limitation periods for contract disputes
Routine routing telemetry 1–3 months Shorter where no dispute or audit need exists
Theft recovery data Duration of investigation Delete promptly once recovery is complete or claim settled
Regulatory compliance (e.g. tachograph) As required by the specific regulation Check the applicable statutory period

These benchmarks reflect field guidance from GeoTapp and should be documented in your retention policy.

Security checklist:

  • ✅ Encrypt location data at rest and in transit.
  • ✅ Apply role-based access controls: only those with a business need should see live or historical data.
  • ✅ Log access to tracking dashboards and audit regularly.
  • ✅ Carry out due diligence on any third-party processor (your tracking platform provider) and ensure a Data Processing Agreement is in place.
  • ✅ Review anonymisation options: pseudonymised data reduces risk, but true anonymisation of granular location data is difficult to achieve in practice and should not be assumed.

Your step-by-step compliance checklist and policy template

Use this as your starting framework. Adapt it to your specific fleet size and use case.

Compliance checklist (employers)

  1. Define your purpose — document exactly why you are tracking (theft recovery, route verification, lone-worker safety, regulatory compliance).
  2. Select and document your lawful basis — complete a Legitimate Interests Assessment if relying on legitimate interests.
  3. Conduct a DPIA — required for systematic or large-scale tracking; document necessity, proportionality, and mitigations.
  4. Draft and distribute a privacy notice — cover purpose, lawful basis, retention, access, controller identity, and employee rights.
  5. Set a retention policy — define periods by purpose and build automated deletion or review triggers.
  6. Implement technical controls — encryption, role-based access, privacy mode for personal time, job-activation where appropriate.
  7. Train staff — fleet managers, HR, and line managers must understand what data they can access and when.
  8. Review annually — reassess the LIA and DPIA if your tracking scope or technology changes.

Suggested policy headings and content prompts

  • Purpose of vehicle monitoring: state the specific operational reasons; avoid vague language like “management purposes.”
  • Lawful basis: name the basis and summarise the balancing test outcome.
  • Data collected: list data types (location, speed, journey start/end, idle time) and what is not collected.
  • Retention periods: table by purpose, with review triggers.
  • Access and recipients: name roles (not individuals) with access; name any third-party processors.
  • Use in disciplinary proceedings: confirm GPS data may be used as evidence, subject to fair procedure and ACAS Code compliance.
  • Employee rights: access, rectification, objection, and how to complain to the ICO.
  • Privacy mode / personal time: describe the technical mechanism and how drivers activate it.
  • Contact for queries: name the data controller and a contact point for data protection queries.

DPIA prompt questions to document:

  • What personal data is processed, and whose?
  • Is the tracking necessary, or could the purpose be achieved less intrusively?
  • What are the risks to drivers and passengers, and how are they mitigated?
  • Have affected employees been consulted?
  • What technical and organisational safeguards are in place?

For guidance on tracker features that support privacy mode and job-activation settings, Lrd-track’s essential vehicle tracking functions page covers the key controls in plain language.

Most ICO enforcement and tribunal claims trace back to a short list of predictable errors. GeoTapp’s compliance analysis identifies three recurring failures: no documented lawful basis, an inadequate privacy notice, and excessive retention of location data.

  • 🚩 Relying on employee consent as the lawful basis. Fix: switch to legitimate interests and complete a Legitimate Interests Assessment.
  • 🚩 Blanket 24/7 tracking including personal time. Fix: implement privacy mode or automatic deactivation outside working hours.
  • 🚩 Vague contract clauses instead of a proper privacy notice. Fix: issue a standalone monitoring policy with all ICO-required elements.
  • 🚩 Keeping location data indefinitely “just in case.” Fix: set documented retention periods by purpose and enforce them.
  • 🚩 Skipping the DPIA for systematic fleet tracking. Fix: complete the DPIA before deployment, not after a complaint.
  • 🚩 Using GPS data in a disciplinary without disclosing it to the employee first. Fix: provide the data to the employee in advance of any hearing.
  • 🚩 Installing a tracker on a vehicle you do not own. Fix: confirm ownership and written consent before any device is fitted.

Pro Tip: The ICO distinguishes between monitoring for “control” and monitoring for “verification.” A job-activation GPS that logs only when a job is open is far easier to justify than continuous surveillance. If you can design your system around verification rather than control, your DPIA risk drops significantly and your Legitimate Interests Assessment becomes much simpler to defend.

What can happen if you get it wrong?

The consequences range from reputational damage to criminal prosecution, depending on the severity of the breach.

Possible consequences:

  • ICO enforcement: assessment notices, enforcement notices requiring you to stop processing, and fines. Under UK GDPR, the ICO can issue fines of up to £17.5 million or 4% of global annual turnover (whichever is higher) for serious breaches.
  • Employment tribunal claims: employees can bring claims for unlawful deduction, constructive dismissal, or breach of contract where covert or disproportionate tracking contributed to their resignation or dismissal. DavidsonMorris notes that even lawful data collection does not protect an employer whose procedure was unfair.
  • Criminal prosecution: covert tracking of another person’s vehicle can constitute harassment or stalking under the Protection from Harassment Act 1997. GPS jamming carries its own criminal penalties (see below).
  • Civil claims: individuals whose Article 8 rights are breached may pursue compensation through the courts.

If you are under investigation:

  1. Stop the disputed processing immediately.
  2. Preserve all relevant logs and documentation (do not delete).
  3. Contact a specialist employment or data protection solicitor.
  4. If the breach is notifiable, report to the ICO within 72 hours of becoming aware of it.
  5. Communicate with affected individuals as required.

Why GPS jammers and covert tracking are illegal

This is not a grey area. GPS jamming devices are illegal in the UK: possession or use of equipment designed to interfere with satellite signals can lead to prosecution and fines. Jammers do not just block your tracker — they disrupt navigation systems for other road users and emergency services, which is why enforcement is taken seriously.

Covert tracking of another person’s vehicle without their knowledge or consent can amount to harassment or stalking under the Protection from Harassment Act 1997, and breaches Article 8 of the Human Rights Act 1998 (the right to private and family life). The fact that you suspect someone of wrongdoing does not create a legal right to track them covertly.

Practical avoidance:

  • ✅ Always document ownership or written consent before fitting any device.
  • ✅ Never install a tracker on a vehicle you do not own without explicit permission from the owner.
  • ✅ Prefer visible, declared security measures over hidden devices.
  • ✅ If you suspect criminal activity involving another person’s vehicle, contact the police rather than attempting covert surveillance yourself.

When should you consult a solicitor?

Most straightforward cases (a private owner fitting a Thatcham-approved tracker to their own Land Rover, or an employer with a documented policy and DPIA) do not require legal advice. But some situations do.

Triggers for legal advice:

  • Your DPIA identifies high residual risks you cannot mitigate internally.
  • You want to rely on GPS data in a disciplinary or dismissal and the employee is contesting it.
  • Your fleet operates across borders and you need to assess cross-border data transfer obligations.
  • You have received a Subject Access Request or a complaint from a driver about monitoring.
  • You suspect harassment or criminal exposure related to tracking.

Primary official sources to consult:

  • ICO Surveillance in Vehicles guidance: the definitive UK regulator guidance on vehicle monitoring, DPIA requirements, and privacy notices.
  • Data Protection Act 2018: the primary UK statute implementing GDPR principles domestically.
  • Human Rights Act 1998: Article 8 right to private and family life, directly relevant to employee monitoring.
  • Protection from Harassment Act 1997: criminal and civil liability for covert surveillance and stalking.
  • ACAS disciplinary and grievance guidance: the Code of Practice that tribunals use to assess procedural fairness.
  • Employment Rights Act 1996: the statutory framework for unfair dismissal claims.

Before you call a solicitor, prepare:

  • A copy of your current monitoring policy (or draft).
  • Your retention schedule.
  • DPIA notes or a summary of your balancing test.
  • A description of the technical design (what data is collected, how, and by whom).

A specialist’s perspective on compliance gaps in the field

The most common gap I see is not malicious intent — it is timing. Employers fit trackers, then write the policy. That order needs to be reversed. The DPIA and privacy notice must exist before the first device is switched on, not six months later when an employee raises a grievance.

The second gap is the privacy notice itself. A single sentence in an employment contract stating that “the company may monitor company vehicles” does not satisfy the ICO’s requirements. Drivers need to know the purpose, the retention period, who can see their data, and how to object. That specificity is what the ICO will look for if a complaint lands on their desk.

What strikes me about Thatcham-approved systems, particularly those designed for high-value vehicles like Land Rovers, is that the compliance case is actually straightforward when the device is used for its intended purpose: theft recovery and insurance-approved security. The purpose is clear, the necessity is obvious, and the data collected is proportionate. The legal risk rises when employers try to extend that same device into continuous workforce surveillance without updating their lawful basis or privacy notice to reflect the new purpose.

For complex disputes or cross-border data flows, a specialist solicitor is the right call. For installation, monitoring, and device-level privacy controls, Lrd-track’s team can walk you through the technical options.

Protect your Land Rover the right way

If you own a Defender, Discovery, or Range Rover, fitting a Thatcham-approved tracker is one of the most direct steps you can take for lawful, insurance-compliant security. Lrd-track’s trackers are engineered specifically for Land Rover models, with 24/7 monitoring, real-time alerts, driver identification, and remote immobilisation built in.

Lrd-track

Ready to protect your vehicle and stay on the right side of UK tracking law? Find the right tracker for your Land Rover and get professional installation arranged today.

Sources

This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.

Back to blog