GRS Fleet Telematics

Fleet Tracking Regulations Explained: A Guide for Construction Contractors in Scotland

Guide for Scottish construction contractors on lawful vehicle tracking, GDPR, tachographs, retention and practical compliance.

6 min read

Jurisdiction Scope

Scotland; UK-wide rules, including UK GDPR and Great Britain drivers’ hours/tachograph requirements, apply.

Overview of Fleet Tracking Laws

Applicable Business Type

Construction contractors operating vehicle fleets

Country or Region

United Kingdom

A Scotland-focused guide for construction contractors on lawful vehicle tracking, worker monitoring, privacy safeguards, tachograph duties, retention, and practical compliance. It distinguishes ordinary GPS/telematics tracking from legally required tachograph records for qualifying goods vehicles.

Legal Requirements Summary

Scottish construction contractors may use fleet tracking, but identifiable driver and passenger data is subject to UK GDPR. They must establish a lawful basis, provide transparent privacy information, keep monitoring necessary and proportionate, restrict private-use monitoring, and conduct a DPIA where the processing is high risk. Ordinary GPS data has no universal statutory retention period and should be kept only as long as necessary. Separate legal duties apply to qualifying goods vehicles using tachographs, including scheduled downloads, analysis, compliant equipment and driver processes, and production of records for enforcement.

Main Regulatory Topics

  • UK GDPR and data privacy
  • Worker and passenger transparency
  • Lawful basis and driver consent
  • Proportionality and private-use limitations
  • DPIAs and high-risk monitoring
  • Retention and deletion
  • Tachograph installation and operation
  • Drivers’ hours and record-keeping
  • Real-time vehicle tracking
  • Enforcement and record production

Key Compliance Obligations

  • Identify and document a lawful basis for processing vehicle-tracking and driver data.
  • Give drivers and passengers clear, accessible privacy information about monitoring and the data controller.
  • Make tracking necessary, proportionate and limited to a defined business or legal purpose.
  • Avoid or disable monitoring during authorised private use unless there is a strong, documented justification.
  • Carry out a DPIA for high-risk driver-behaviour monitoring, analytics, cameras, audio or similarly intrusive systems.
  • Maintain a retention schedule, review it regularly, and delete ordinary tracking data when it is no longer necessary.
  • For vehicles subject to tachograph rules, download vehicle-unit data at least every 90 days and driver-card data at least every 28 days, then analyse compliance.
  • Keep applicable tachograph records available for enforcement for the required period, including at least 12 months where applicable.
  • Use systems with suitable technical and privacy-by-design controls; switch off in-vehicle audio by default unless exceptionally justified.
  • Comply with applicable tachograph equipment, driver-hours and record-production requirements, including current-day and preceding-period records where required.

Driver Consent Requirement

Consent Rule: Prior driver consent is not generally required for ordinary business fleet tracking. The contractor should identify and document a lawful UK GDPR basis, provide clear privacy information to drivers and passengers, and ensure monitoring is necessary and proportionate. Consent is usually inappropriate as the employment-lawful basis because of the employer–worker power imbalance. A separate tachograph rule may require driver consent where personal data is transmitted.

Data Retention Period

Minimum Retention: No fixed statutory minimum for ordinary GPS fleet-tracking data; retain only as long as necessary and justified. For applicable tachograph records, retain/provide records for at least 12 months.

Enforcement Authorities

  • Driver and Vehicle Standards Agency (DVSA)
  • Traffic Commissioners for Great Britain
  • Information Commissioner’s Office (ICO)
  • Police and other competent road-traffic enforcement bodies, where applicable
  • Transport Scotland and relevant Scottish contracting/public authorities for project-specific transport or construction conditions

Penalties for Non-Compliance

Non-compliance can expose a contractor to ICO regulatory action under UK data-protection law, including investigation, enforcement notices and potentially substantial UK GDPR/DPA 2018 fines, as well as complaints, compensation claims, reputational damage and employment disputes. Road-transport breaches can lead to DVSA prohibitions or other enforcement, driver-hours/tachograph penalties, prosecution and adverse findings affecting an operator licence. Failure to meet operator-licensing undertakings can threaten the licence and therefore the ability to operate relevant goods vehicles. Site or contract breaches may lead to corrective action, suspension of site access, payment or contractual consequences. The precise sanction depends on the breach, vehicle, journey and enforcement decision; no universal ‘fleet tracking fine’ applies.

Implementation Best Practices

Maintain a fleet-tracking policy, vehicle/driver privacy notice, lawful-basis record, retention schedule and access-control register. Configure geofencing and working-hours controls so tracking stops or becomes non-identifying during authorised private use. Use pseudonymisation or driver fobs where operationally feasible, separate driver identity from routine location data, and log every disclosure. Complete a DPIA for cameras, audio, behaviour scoring or automated driver decisions; consult workers and review necessity and proportionality. Keep tachograph downloads, infringement reviews, maintenance evidence and corrective actions in an audit-ready system, and test the device configuration periodically.

Compliance Checklist

  1. Define the business purpose for GPS/telematics and choose a UK GDPR lawful basis; do not assume employee consent is the appropriate basis in an employment relationship.
  2. Provide clear privacy information to drivers and passengers covering what is collected, purposes, controller identity, sharing, retention and individual rights.
  3. Limit tracking to working time and business use where possible; provide a privacy/deactivation mode for authorised private use.
  4. Complete and document a Data Protection Impact Assessment before high-risk monitoring, including driver-behaviour analytics, in-vehicle cameras or audio.
  5. Use the least intrusive technology that achieves the purpose; switch audio off by default unless exceptional necessity is documented.
  6. Restrict access to telematics data, secure it, set a documented retention period and review/delete data when no longer needed.
  7. Check vehicle weight, journey type and use. Goods vehicles over 3,500 kg used in trade or for hire/reward in Great Britain generally require an operator licence.
  8. Where assimilated or AETR drivers’-hours rules apply, fit and use an approved tachograph; download vehicle-unit data at least every 90 days and driver-card data at least every 28 days, then analyse compliance.
  9. Retain and produce tachograph, driver-hours, maintenance and operator-licensing records for DVSA or other authorised inspection.
  10. Ensure construction plant and vehicles are maintained and keep maintenance records available on site where project or contract requirements require them.

Industry-Specific Guidance

For Scottish construction contractors, GPS tracking is generally a data-protection and employment-monitoring issue rather than a standalone Scotland-specific tracking licence. It can support site arrival/departure records, plant and vehicle security, route planning, allocation, fuel control and environmental/site-traffic management, but it does not replace statutory tachographs, driver-hours records, operator licensing, vehicle maintenance or site documentation. Construction fleets often mix vans, HGVs, trailers, mobile plant and vehicles used on public roads. Classify each vehicle and journey separately: a UK-only van between 2.5 and 3.5 tonnes is normally not caught by the tachograph requirement merely because it is a van, while heavier goods vehicles and relevant international operations may be. If a vehicle is taken home or used privately, continuous location monitoring will rarely be justified. For project work, follow the contract and site plan as well as general law; Transport Scotland construction guidance can require traffic controls, minimised vehicle movement and maintenance records.

Recent Legal Updates

As at 11 October 2026, the principal recent changes relevant to a Scottish construction fleet are the Drivers’ Hours and Tachographs (Amendment and Modification) Regulations 2025, in force across Scotland, England, Wales and Northern Ireland from 21 April 2025, and the Goods Vehicles (Testing, Drivers’ Hours and Tachographs etc.) (Amendment) Regulations 2026, which extend to Scotland and came into force 21 days after being made. GOV.UK confirms that operators must download digital tachograph vehicle-unit data every 90 days and driver-card data every 28 days. A further practical change for contractors undertaking international work is the 1 July 2026 tachograph requirement for qualifying 2.5–3.5 tonne vans on relevant international journeys; UK-only construction vans remain under GB domestic drivers’ hours rules on that point. Check the final statutory text and current GOV.UK guidance before relying on any exemption, particularly for specialist construction vehicles or cross-border work.

Authoritative Resources

Related Blog Posts

Talk to GRS

Tell us about your fleet.

Get a package recommendation, transparent pricing and a practical deployment route.

Book a demoView resources