GRS Fleet Telematics

Fleet Tracking Regulations Explained: A Guide for Construction Contractors in France

GDPR/CNIL guide for construction firms on vehicle geolocation: purposes, retention limits, consent and out-of-hours deactivation.

5 min read

Jurisdiction Scope

French employment and data-protection law; CNIL guidance applies nationally in France

Overview of Fleet Tracking Laws

Applicable Business Type

Construction contractors and construction businesses operating employee or company vehicles

Country or Region

France

A France-focused compliance guide for construction contractors using vehicle geolocation or fleet-tracking systems, covering GDPR/CNIL limits, employee information, representative consultation, retention, permitted purposes and privacy safeguards.

Legal Requirements Summary

French construction contractors may deploy fleet geolocation only for legitimate, clearly defined and proportionate operational purposes. The employer must establish an appropriate GDPR legal basis, consult relevant employee representatives, inform drivers before installation, document the processing and restrict access and retention. Continuous or disproportionate monitoring is unlawful; tracking should be disabled outside working hours for vehicles available for private use. Employee consent is generally not the appropriate basis, and retention is normally limited to two months, subject to narrowly defined one-year and five-year exceptions.

Main Regulatory Topics

  • Data privacy and GDPR legal basis
  • CNIL employee-geolocation rules
  • Employee and representative consultation/information
  • Driver privacy and off-duty deactivation
  • Purpose limitation and proportionality
  • Record-keeping and data retention
  • Working-time monitoring
  • Enforcement and penalties

Key Compliance Obligations

  • Define and document a lawful, specific and proportionate purpose, such as vehicle or worker safety, theft recovery, dispatching workers to dispersed sites, or proving and billing a service.
  • Do not use geolocation to continuously monitor employees, control speed-limit compliance, or monitor working time where another method—even a less effective one—can be used.
  • Consult or inform employee representative bodies before deciding to implement the system, where applicable.
  • Give each employee clear information before installation about the controller, purposes, legal basis, data categories, recipients, retention period, access/rectification and objection rights, and complaint rights.
  • Maintain appropriate GDPR documentation, including the processing record; involve the data protection officer where one exists.
  • Limit retention to the applicable period: normally two months, with documented exceptions for one-year operational/proof purposes or five-year working-time records.
  • Provide a means to disable geolocation outside working hours when a company vehicle can be used privately.
  • Protect privacy during breaks and ensure elected or union representatives are not geolocated while acting in their representative capacity.

Driver Consent Requirement

Consent Rule: Employee consent is not the normal legal requirement and should not generally be relied on as the lawful basis because of the employer–employee power imbalance. Instead, the employer must establish an appropriate legal basis, demonstrate necessity and proportionality, and inform employees before installation. Employees must be able to deactivate tracking outside working time where vehicles may be used privately.

Data Retention Period

Minimum Retention: 2 months maximum in principle; up to 1 year for route optimisation or proving service delivery where no other evidence is available; up to 5 years for working-time monitoring, limited to the relevant time records

Enforcement Authorities

  • CNIL (Commission nationale de l’informatique et des libertés), for employee-location data protection and GDPR compliance.
  • French labour authorities and employee representative bodies, in relation to worker information/consultation and employment-law requirements.
  • French road-transport control authorities and police/gendarmerie; the Ministry for Ecological Transition oversees tachograph policy and controls.
  • DREAL, DRIEAT or DEAL, for road-transport operator registration and related administrative compliance.

Penalties for Non-Compliance

Non-compliant employee tracking can trigger complaints to the CNIL, orders or corrective action under data-protection law, and potential GDPR administrative penalties; it can also make unlawfully collected monitoring evidence difficult to rely on in employment disputes. Failure to comply with tachograph, driving-time or road-transport requirements may lead to roadside or administrative enforcement, sanctions affecting the driver or operator, and transport-licensing consequences. The applicable amount depends on the breach, vehicle, operation and enforcement process; the cited official guidance does not provide a single standard penalty for all construction contractors.

Implementation Best Practices

Use privacy-by-design settings: limit collection frequency, stored fields, access permissions and retention; where operationally sufficient, retain only the vehicle’s current position rather than a complete journey history. Configure automatic out-of-hours shutdown or driver-controlled privacy mode, maintain a written tracking policy and worker notice, document the legal basis and purpose for each data use, keep an access log, review vendor/sub-processor arrangements, and audit configurations and retention periodically. Separate ordinary telematics from legally required tachograph data, because CNIL treats tachograph control devices as a distinct transport-regulation regime.

Compliance Checklist

  1. Define and document a lawful, specific purpose for tracking, such as protecting vehicles or equipment, coordinating interventions, proving or invoicing services, or complying with a transport-law obligation.
  2. Carry out a proportionality assessment and collect only data necessary for that purpose; do not use GPS to permanently monitor workers, police speed-limit compliance, or track location outside working time.
  3. Inform or consult employee representative bodies before deployment where applicable.
  4. Give each affected worker clear prior information covering the controller, purposes, legal basis, recipients, retention period, rights of access and rectification, objection rights, and the right to complain to the CNIL.
  5. Provide a way to disable location collection or transmission outside working hours, including breaks and home-to-work journeys.
  6. Restrict access to authorised recipients, secure the system, and record the processing in the organisation’s record of processing activities; involve the DPO if one exists.
  7. Apply retention limits: normally no more than two months; up to one year for route optimisation or indispensable proof of service; up to five years for data used to monitor working time, limited to relevant working-time data.
  8. For vehicles covered by road-transport tachograph rules, install, operate, download and retain tachograph records as required; check whether a construction-material/equipment transport exemption applies to the particular vehicle, route and driver.
  9. For international goods operations, verify the applicable tachograph retrofit deadline and ensure the vehicle carries the required equipment and records.

Industry-Specific Guidance

Construction contractors commonly use vans, plant and goods vehicles across dispersed worksites. GPS can generally support dispatching, intervention proof, vehicle/plant security and protection of tools or materials, but it must not become continuous employee surveillance. A worker must be able to stop location collection outside working time, and tracking should not be used to enforce speed limits or duplicate an existing working-time system. Pay particular attention to vehicles carrying construction materials, equipment or machinery: vehicles over 3.5 tonnes used for goods transport may fall under EU driving-time and tachograph rules, while a specific exemption can apply to certain vehicles below 7.5 tonnes carrying the driver’s own equipment within 100 km where driving is not the driver’s main activity. The exemption is fact-specific and is not a blanket exemption for small contractors.

Recent Legal Updates

As at 12 October 2026, the major relevant tachograph deadline is the 1 July 2026 requirement for vehicles over 2.5 tonnes used for international goods transport to be equipped with a smart Gen2V2 tachograph; that deadline has passed. Earlier retrofit deadlines were 31 December 2024 for older international vehicles over 3.5 tonnes and 18 August 2025 for Gen2V1 international vehicles over 3.5 tonnes. New professional goods/passenger vehicles over 3.5 tonnes have required smart Gen2V2 tachographs since 21 August 2023. CNIL’s current guidance also emphasises data minimisation, including limiting location frequency, data volume and retention; no construction-specific relaxation of the employee-geolocation rules was identified.

Authoritative Resources

Related Blog Posts

Talk to GRS

Tell us about your fleet.

Get a package recommendation, transparent pricing and a practical deployment route.

Book a demoView resources