Data protection basics
Under UK GDPR and the Data Protection Act 2018, and the EU GDPR in Spain and other member states, you need a lawful basis for processing location data. For most businesses this is legitimate interests, supported by a documented legitimate interests assessment.
Transparency
- Tell employees in writing what is tracked, when, why and who can see the data
- Include tracking in your privacy notice and staff handbook
- Avoid covert tracking except in very limited, documented circumstances
Proportionality and private use
If staff may use vehicles privately, provide a privacy mode or limit tracking to working hours. Collect only the data you need and set retention periods.
Data protection impact assessment
Regulators generally expect a DPIA for systematic monitoring of employees. It helps you identify risks and the safeguards you will use.
Spanish-speaking markets
In Spain, workplace digital monitoring is also covered by Organic Law 3/2018 (LOPDGDD), which requires employees to be informed in advance. Rules in Latin American countries vary, so check local requirements.