Employee GPS tracking policy: What Employers Can & Can’t Do

The use of GPS and telematics systems is increasing rapidly across the construction industry.

In the UK alone, construction firms recorded nearly 13 million hours of tool and equipment monitoring in 2021—a 278% increase compared to the year before.

This growth is happening for a reason.

Thanks to telematics, construction businesses can know where high-value tools, plant, and vehicles are at any given time, which UK professionals single out as the number one benefit of these tracking systems.

Besides providing asset visibility, GPS tracking systems also help businesses verify mileage and travel time, improve route planning, and keep accurate records of time spent on site, helping them maintain regulatory compliance.

But as useful as these tools are, they can’t just be switched on without care.

After all, location data is considered personal data when it’s linked to a worker’s identity, and it usually is. That brings legal, ethical, and trust issues into play.

For this reason, GPS tracking must follow strict legal and compliance standards.

This guide will help you shape an employee GPS tracking policy that works in practice by showing you what’s allowed and what’s not.

Key takeaways

• Employee GPS tracking is legal in the UK and EU if it follows compliance rules
  Employers can monitor location data as long as they comply with laws such as the UK GDPR, the EU GDPR, and the Human Rights Act. This means having a lawful reason for tracking, being transparent with workers, and ensuring monitoring is necessary and proportionate.

• GPS tracking must serve a genuine business purpose
  Location monitoring should only be used to support real operational needs such as coordinating teams, protecting assets, verifying attendance, managing mileage, or keeping lone workers safe. Tracking should never be open-ended or done ‘just in case’.

• Employers must limit how GPS data is collected, used, and stored
  Continuous tracking, using location data for unrelated purposes, storing data indefinitely, or giving unrestricted access can all breach data protection rules. Employers must define a justifiable purpose, restrict access to authorised staff, and delete data once it is no longer needed.

• Transparency with employees is essential
  Workers must be informed about GPS monitoring, what data is collected, and how it will be used. These rules should be transparently set out in employment contracts, staff handbooks, or a dedicated employee GPS tracking policy.

• Using the right system makes compliance much easier
  Tools designed with privacy and security in mind help businesses follow the rules while still gaining operational visibility. Platforms like Onetrace support compliant GPS tracking by recording location only when operatives clock in or out, protecting personal data with strong safeguards and providing accurate audit trails for timesheets and site attendance.

Employee GPS tracking: The legal framework explained

Employee GPS tracking—and workplace monitoring in general—isn’t prohibited by law in the UK or the European Union. In many cases, it’s entirely lawful, as long as it’s well-regulated.

Which laws apply will depend on what you’re tracking, how you’re using the data, and where your business operates.

The table below sets out the key rules that most construction employers need to understand when introducing GPS tracking.

Pro tip:

Compliance is far easier when your systems are designed to support it from the start.

If your software lacks proper access controls, data retention settings, or security safeguards, your employee GPS tracking policy alone won’t protect you.

That’s why you should choose a construction site management platform like Onetrace, which is built with security and data protection at its core.

This software:

• Maintains strong administrative, physical, and technical safeguards for personal data

• Operates in line with GDPR requirements and holds ISO 27001:2022 certification

• Applies strict access controls to protect records from unauthorised access

• Ensures data is retained only as long as necessary and deleted when no longer required

The right system won’t replace your legal duties, but it will make meeting them far more straightforward.

How employers can use GPS tracking lawfully

Employers can only use GPS tracking where it serves a genuine operational need that can be clearly explained and, if required, justified.

In construction, this can include:

• Site coordination: Improve dispatch and routing for field teams so they reach the site on time and reduce unnecessary travel.

• Asset management: Protect company vehicles, plant, and high-value tools by reducing theft risk and supporting recovery if equipment is stolen.

• Attendance and job completion verification: Confirm that a worker attended a site at the scheduled time and completed the required visit.

• Mileage and expenses management: Ensure travel claims are accurate, and clearly distinguish between business and private journeys.

• Lone workers protection: Help locate workers operating alone in the event of an emergency.

Simply put, GPS employee tracking should never be open-ended or used ‘just in case’.

To avoid these scenarios, employers should assess the risks properly and document their reasoning before rolling out GPS monitoring.

This can be achieved through a Data Protection Impact Assessment (DPIA), which is carried out when tracking involves continuous or systematic location monitoring.

An impact assessment helps you test whether the monitoring is necessary, justified, and proportionate. It forces you to:

• Define the purpose

• Consider less intrusive alternatives

• Identify safeguards to reduce privacy risks

A DPIA doesn’t need to be a complex or overly formal exercise.

However, keeping a written record is important, as it shows that you have thought through the decision, applied the rules consistently, and can justify your approach if it’s ever challenged by a regulator or employee.

When GPS tracking becomes unlawful: What employers can’t do

There are several ways GPS tracking can cross legal lines, both in how monitoring is carried out and in how location data is used.

Here are eight practices employers should avoid when monitoring workers with GPS.

1. Employers can’t track workers at all times

Employees still have a reasonable expectation of privacy at work, which means GPS monitoring must be limited and proportionate.

In practice, this means employers should avoid tracking workers continuously throughout the day.

Tracking becomes problematic in situations such as:

• Outside working hours: Employers shouldn’t monitor an employee’s movements once their shift has finished.

• Private use of company vehicles: Employers shouldn’t track company vehicles when employees are allowed to use them for personal trips.

• Breaks during the day: Employers shouldn’t record location data during lunch or rest breaks without a justified reason.

• Off-duty periods: Employers shouldn’t monitor a worker’s location when they aren’t assigned to a job or on call.

Pro tip:

One of the simplest ways to avoid over-monitoring is to use systems that are built to limit tracking automatically. Time-tracking software that records location only when it’s needed helps reduce privacy risks and keeps monitoring proportionate.

Onetrace includes safeguards designed for this purpose, capturing a GPS snapshot only when operatives clock in or clock out through the mobile app. 

This way, the app doesn’t continuously monitor employee location throughout the day.

2. Employers can’t repurpose GPS tracking data

Location data must only be used for its originally intended purpose.

For example, data collected to route workers or confirm site attendance shouldn’t later be used for performance monitoring, disciplinary action, or other purposes unless there is a well-defined legal basis and employees have been informed.

3. Employers can’t keep GPS data longer than necessary

Under data protection rules, monitoring data can only be kept for as long as it’s needed for the purpose it was collected.

Once that goal has been met, the data should be deleted or securely archived in accordance with a well-defined retention policy.

The exact retention period depends on the purpose of the data and any legal obligations that apply. For example, information used for payroll or expense verification may need to be kept longer, while routine tracking data should normally be deleted after a defined period.

4. Employers can’t give unrestricted access to location data

Access to location data must be tightly controlled. Only people who genuinely need the information for their role should be able to view or use it.

In addition, employees who have access to GPS records should be properly trained and bound by confidentiality obligations, while the location data itself should be stored securely and protected from unauthorised access.

5. Employers can’t track workers without informing them

Employees must know when GPS tracking is taking place and how the data will be used, so location monitoring can’t be introduced quietly or hidden in hard-to-find policies.

This information should appear in employment contracts, staff policies, or other written documentation, such as a dedicated employee GPS tracking policy.

This policy should make the rules clear from the outset.

It should:

• Explain the purpose of the tracking in simple terms

• Set out what data is collected (e.g., location, mileage, or stop times)

• Confirm when tracking takes place (e.g., during working hours or when using company vehicles)

• State who can access the data and how long it’s kept

• The extent of monitoring should also be reflected in contracts or your staff handbook.

While transparency is a core requirement for lawful GPS tracking under UK and EU laws, covert monitoring remains possible.

However, it’s only justified in very limited circumstances, such as when you reasonably suspect criminal activity and informing the employee would prejudice an investigation.

Even then, it must be targeted, temporary, and stopped as soon as the investigation ends.

Put your employee GPS tracking policy into practice with Onetrace

Ignoring the rules around employee monitoring can lead to serious consequences.

Regulators can issue fines, order audits, or impose enforcement measures if tracking is carried out unlawfully.

Just as importantly, mishandled monitoring can damage trust with your workforce and even lead to claims such as constructive dismissal or discrimination.

That’s why the systems you use should do two things well: support accurate operations and handle employee data securely.

To tick the first box, Onetrace allows construction businesses to:

• Record accurate timesheets with GPS stamps when operatives clock in and clock out on site

• Pinpoint exact locations using what3words, making it easier to direct teams, deliveries, or emergency services to the right spot on complex sites

• Keep traceable audit trails of time and attendance across projects, teams, and individuals

• Export reliable data for payroll and reporting, helping reduce disputes about hours worked

As for the second, Onetrace is designed with security and data protection at its core. 

The platform applies robust safeguards to protect personal data, control access to sensitive information, and support responsible data handling across your projects.

It also informs operatives that their location will be used and limits tracking to specific job-related actions rather than performing continuous monitoring.

Take a closer look at Onetrace’s features and safeguards with a personalised demo to learn how it supports a compliant employee GPS tracking policy in practice.