Telematics and fleet tracking

Updated September 2026 · 11 min read

Telematics records where a vehicle goes and how it is driven. Tracking an identifiable driver is processing personal data, so you need a lawful basis, a privacy notice and usually a data protection impact assessment before you switch it on.

What does a telematics system actually record?

More than a dot on a map. A typical hardwired unit reports position and time at short intervals, ignition on and off, journey start and end points, idling, speed against the road's limit, and driving events such as harsh braking, harsh acceleration and cornering. Most systems add odometer mileage, and many read fuel or battery data from the vehicle's own bus. Add a driver-identification fob and every one of those data points is attached to a named person. Add a forward or in-cab camera and you have video too. The practical consequence is worth stating plainly at the outset: a fleet tracking system is a personal data processing system that happens to live in a van. Treating it as a piece of vehicle hardware is how businesses end up with a policy problem they did not anticipate.

What does telematics genuinely change in a small fleet?

Five things, in rough order of how often they justify the cost. Mileage accuracy — an exact annual figure per vehicle is the single best input to a lease mileage allowance, and under-declaring is the expensive mistake described in van lease mileage explained. Disputed attendance — a timestamped record of when a vehicle arrived and left settles an argument with a customer in a minute. Idling and routing, where the fuel or energy saving is real but entirely dependent on someone acting on the report. Stolen vehicle recovery, which is a recovery tool rather than a prevention tool. And maintenance scheduling against real mileage rather than a guess. What we will not do is put a percentage on any of it — the savings quoted in telematics marketing are the supplier's figures, not ours, and the honest answer is that the benefit depends entirely on whether anyone reads the reports.

How does telematics support duty of care?

By turning an assertion into evidence. Under the Health and Safety at Work etc. Act 1974 an employer must ensure, so far as is reasonably practicable, the health and safety of employees at work (section 2) and that others are not put at risk by the way the business operates (section 3). The Management of Health and Safety at Work Regulations 1999, regulation 3 require a suitable and sufficient risk assessment. Applied to driving, the joint HSE and Department for Transport guidance Driving at work: managing work-related road safety (INDG382) frames it as three areas: the driver, the vehicle and the journey. Telematics gives you evidence across all three — who drove, how the vehicle was driven, how long the shift ran, whether the route was realistic. But there is a sting: once you hold the data, "we did not know" stops being available to you. If the system shows a pattern of speeding or excessive hours and nothing is done, the record works against the business, not for it. Collect it only if you intend to act on it.

What are the UK GDPR obligations when you track employees?

The ICO published Employment practices and data protection: monitoring workers on 3 October 2023, and it deals expressly with tracking work vehicles and vehicles provided to workers. Five obligations do most of the work. Identify a lawful basis under Article 6 before you start — legitimate interests is usually the most appropriate for workplace monitoring, but it requires a documented legitimate interests assessment balancing your purpose against workers' rights, and it is not a formality. Be transparent: tell workers what is collected, why, who sees it and how long it is kept, in a privacy notice they actually receive. Be necessary and proportionate — the ICO expects you to consider the least intrusive method that achieves the purpose. Minimise and limit: collect what the stated purpose needs and do not repurpose it later. And set a retention period and stick to it. Workers keep their subject access rights over everything you hold.

When do you need a data protection impact assessment?

Whenever the processing is likely to result in a high risk to people's rights and freedoms, which is the test in Article 35 of the UK GDPR. Systematic monitoring of workers sits squarely in the territory the ICO flags, and the ICO's position in the monitoring guidance is that employers should carry out a DPIA even where one might not be strictly required, because it is a scalable tool for making and recording the decision. Practically, a DPIA for vehicle tracking should record: the purpose, in specific terms rather than "efficiency"; exactly what data is collected and how often; the lawful basis and the legitimate interests assessment; who has access; retention; the risks to drivers, including the risk of the data being used for something it was not collected for; the mitigations, including private-use arrangements; and the outcome of consulting workers. Do it before the units are fitted, not after the first complaint — it is a decision record, and its value comes from being contemporaneous.

What about private use of the vehicle?

This is where most tracking policies go wrong. Workers' expectation of privacy is far higher outside working hours, and the ICO's position is that monitoring during genuinely personal use of a vehicle is seldom justifiable — so if drivers take vans home or use them privately, the design has to reflect that. The usual answer is a privacy mode: a switch or app setting that suspends location reporting outside working hours while leaving the theft-recovery function available, with the boundary set out in writing. Two connected points. Commuting is a grey area — decide it deliberately and say what you decided. And note the tax link: a van made available for unrestricted private use creates a benefit in kind, so your private-use policy is doing two jobs at once (see company car tax and BiK explained). Covert monitoring is a different and much higher bar, and is not something to reach for without specialist advice.

What should a vehicle tracking policy contain?

Keep it to two pages that a driver will actually read. It should state: the purpose, in concrete terms; what is collected, including whether harsh-driving events and speed are recorded; the lawful basis; who can see the data and who cannot; how long it is kept; the private-use arrangement, including any privacy mode and how to use it; how the data will and will not be used in performance management and disciplinary processes, which is the question every driver has and few policies answer; how to raise a concern or make a subject access request; and a review date. Then do the part that is easy to skip: consult the workforce before you install, listen to what comes back, and record it. Tracking introduced with an explanation is usually accepted; tracking discovered by a driver is a grievance, and sometimes a complaint to the ICO.

Do cameras and dashcams follow the same rules?

The same framework, at a higher intensity. Video of a driver is considerably more intrusive than a location ping, and an inward-facing camera more intrusive again, so the necessity and proportionality argument has to be correspondingly stronger and the DPIA more thorough. The ICO's video surveillance guidance has a section specifically on surveillance in vehicles. Three practical rules. Audio recording is far harder to justify than video and is best left off unless you have a specific, documented reason. Third parties are captured too — other road users, customers, members of the public — and they have rights over that footage, including the right to request it after an incident. And tell people: signage in the cab, and a clear line in the policy. If the sole purpose is defending liability after a collision, say so, and set a retention period short enough to match that purpose instead of keeping months of footage because the storage is cheap.

How does tracking interact with insurance and a lease?

Two practical points before you order the units. On insurance, tell your insurer what is fitted: security devices and tracking are usually a declarable feature and can affect both the premium and how a theft claim is handled. We are deliberately not quoting a saving — ask your broker what your insurer does with it. On the lease, a hardwired telematics unit is an installation like any other: it may involve tapping into the vehicle's wiring or drilling, so agree it with us in writing before it is fitted, keep the original parts, and expect to remove it and make good at hand-back (see end-of-lease damage standards). Where the choice exists, an OBD-port or factory-fitted telematics option avoids the question entirely. Tell us at quote stage what you intend to fit — racking, livery, tracking, a tail lift — and it can be settled once, at the start. Get a written quote.

FAQs

Can an employer legally track a work van in the UK?

Yes, provided data protection law is followed. Tracking a vehicle linked to an identifiable driver is processing personal data, so you need a lawful basis under the UK GDPR, a privacy notice telling workers what is collected and why, and processing that is necessary and proportionate to a stated purpose.

Do I need employee consent to fit vehicle trackers?

Usually not consent, but you do need a lawful basis. The ICO indicates legitimate interests is normally the most appropriate basis for workplace monitoring, supported by a documented legitimate interests assessment. Consent is difficult to rely on at work because it must be freely given.

Do I need a DPIA for fleet tracking?

Almost certainly. A data protection impact assessment is required under Article 35 of the UK GDPR where processing is likely to result in a high risk, and systematic monitoring of workers falls in that territory. The ICO recommends completing one even where it may not be strictly required.

Can I track a van outside working hours?

Rarely with justification. The ICO’s guidance indicates that monitoring during genuine personal use of a vehicle is seldom justifiable, because privacy expectations are much higher outside work. Where vans go home, use a privacy mode that suspends location reporting and set the boundary out in writing.

Does telematics reduce insurance premiums?

It can be a factor, but the effect varies by insurer and by risk, so treat any headline figure as marketing rather than fact. Declare what is fitted, because security and tracking devices are usually declarable and can affect both the premium and how a theft claim is handled.

Does telematics help with health and safety duties?

It gives you evidence across the three areas HSE guidance identifies — driver, vehicle and journey. The corollary matters: once you hold data showing speeding or excessive hours, failing to act on it is worse than not having collected it. Only gather what you intend to review.

Can I fit a tracker to a leased van?

Usually yes, but agree it with us in writing before installation. A hardwired unit involves the vehicle’s wiring and sometimes drilling, and you should expect to remove it and make good at the end of the term. An OBD-port or factory-fitted option avoids the question altogether.

Next step

Business van leasing →

How the monthly rental is built, what is included, and who business contract hire is for.

Business van leasing eligibility →

The honest answer on who gets considered, and what we look at when we assess a business.

Or go straight to the range: browse vans and pickups · company cars

Small fleet leasing Courier van leasing High mileage van leasing Van lease mileage explained Grey fleet explained Van security and tool theft End-of-lease damage standards for vans