Fleet Tracking Regulations Explained: A Guide for Courier Businesses in Ireland

Driver location data is personal data — Irish courier fleets need GDPR legal bases, privacy switches and limited retention.

10 October 20265 min read

Jurisdiction Scope

Republic of Ireland; GDPR and Ireland’s Data Protection Act 2018 apply, with Irish Data Protection Commission guidance for employer vehicle tracking.

Overview of Fleet Tracking Laws

Applicable Business Type

Courier businesses and employers operating tracked delivery vehicles in Ireland

Country or Region

Ireland

A practical compliance guide for Irish courier businesses using vehicle telematics or GPS tracking, covering GDPR lawful basis, transparency, purpose limitation, privacy controls, retention, and operational record-keeping.

Legal Requirements Summary

Irish courier employers must treat vehicle location data linked to an identifiable driver as personal data. They should establish a documented GDPR legal basis, notify drivers before tracking begins, define and limit the purposes, control access, and retain data only as long as necessary. Tracking must not become general employee surveillance. Privacy controls, including a privacy switch for private use scenarios, are required under the Irish regulator’s vehicle-tracking guidance. Separate commercial-vehicle maintenance and inspection records generally require at least 2 years’ retention.

Main Regulatory Topics

Data Privacy and GDPR
Driver Transparency and Consent
Lawful Basis and Purpose Limitation
Real-Time Vehicle Tracking
Privacy Switches and Private Use
Data Retention
Commercial Vehicle Record-Keeping
RSA/CVRT Inspections and Enforcement

Key Compliance Obligations

Identify and document an appropriate GDPR lawful basis before deploying vehicle tracking.
Provide drivers with clear advance notice of the tracking system, purposes, records created, access arrangements and retention period.
Use tracking for a legitimate, defined purpose rather than general monitoring of drivers or staff.
Apply purpose limitation and do not reuse tracking data for incompatible purposes.
Limit collection and retention of location and behavioural data to what is necessary.
Fit and train drivers on a privacy switch when vehicles may be used privately or when privately owned vehicles are used for work.
Keep commercial-vehicle inspection, maintenance and repair records for at least 2 years where the CVRT/RSA record-keeping rules apply.
Maintain records and systems that can be produced during authorised RSA-related inspections.

Driver Consent Requirement

Consent Rule: Prior employee consent is not generally required and may be unsuitable in the employment context because of the power imbalance. The employer must identify an appropriate GDPR legal basis, inform drivers in advance about the tracking, purposes, data, access and retention, and avoid using tracking for general staff monitoring. A privacy switch is required where a company vehicle is available for private use or a privately owned vehicle is used for work.

Data Retention Period

Minimum Retention: No universal statutory minimum period for vehicle-tracking data is stated; retention must be limited to what is necessary for the specified lawful purpose and communicated to employees. Separately, commercial-vehicle inspection, maintenance and repair records must generally be retained for at least 2 years.

Enforcement Authorities

Data Protection Commission (Ireland) — GDPR/Data Protection Act enforcement and complaints
Road Safety Authority (RSA) — transport officers, tachograph, drivers-hours and operator-licensing enforcement
An Garda Síochána — roadside and roadworthiness-related enforcement support
Irish courts — prosecutions and fines

Penalties for Non-Compliance

GDPR non-compliance can lead to DPC corrective measures, including warnings, reprimands, orders to bring processing into compliance or stop it, and administrative fines. The GDPR ceiling is generally the higher of €20 million or 4% of worldwide annual turnover for the gravest infringements, and the higher of €10 million or 2% for other specified infringements. For tachograph, drivers-hours and Smart Tachograph 2 breaches, RSA guidance states that prosecution can result in a Class A fine of up to €5,000 and/or up to six months’ imprisonment. Serious infringements may also lead to a journey prohibition or a requirement to present the vehicle for workshop inspection. Operating goods-for-hire-or-reward transport without the required operator licence can lead to summary penalties up to €5,000 and/or six months’ imprisonment, or on indictment up to €500,000 and/or three years’ imprisonment. Posting-of-drivers breaches may attract fines up to €5,000 on summary conviction or up to €50,000 on indictment.

Implementation Best Practices

Design the system around the vehicle and delivery-service purpose rather than continuous employee surveillance. Before deployment, document necessity, proportionality, lawful basis, data flows, access roles, retention and security in a DPIA and privacy notice. Configure geolocation minimisation, role-based access and audit logs; disable or mask tracking for permitted private use and train drivers on the privacy control. Keep a written policy, supplier/data-processing agreement and change log, and review the configuration and retention schedule regularly. Separate operational telematics from tachograph records where appropriate: GPS data does not replace legally required tachograph records. For cross-border courier work, maintain a vehicle-by-vehicle scope assessment, operator-licence evidence and tachograph/posting documentation.

Compliance Checklist

Identify the processing purposes and document an appropriate GDPR Article 6 lawful basis before activating tracking.
Complete and retain a Data Protection Impact Assessment (DPIA), because employee vehicle-location monitoring is likely to create a high risk to individuals’ rights.
Give each driver clear advance privacy information covering the device, data collected, purposes, access, retention and disclosures; do not use the data for undisclosed purposes.
Limit collection to what is necessary and proportionate; do not use vehicle tracking for general staff surveillance or behavioural monitoring.
Disable or privacy-switch tracking during authorised private use; fit a privacy switch where a company vehicle is available for personal use or a privately owned vehicle is used for work, and train drivers to use it.
Maintain a written vehicle-tracking and private-use policy, with records of driver notification/training and system configuration.
Set a documented retention period, restrict access, secure the data, and periodically review whether continued tracking remains necessary.
Determine whether each vehicle and journey falls within EU/Irish tachograph and drivers-hours rules; most goods vehicles at or below 3.5 tonnes are generally exempt, subject to exceptions.
For international goods transport or cabotage using an LCV/van over 2.5 tonnes maximum permitted mass, ensure a Smart Tachograph Version 2 is fitted from 1 July 2026 and drivers use driver cards and comply with applicable posting rules.
For vehicles within scope, download, preserve and inspect tachograph/driver-hours records and observe limits on driving, breaks and rest.
If carrying goods for hire or reward on public roads, obtain and maintain the required Irish operator licence, unless a specific exemption applies.

Industry-Specific Guidance

Irish courier operators commonly use vans below 3.5 tonnes, for which the standard EU drivers-hours/tachograph regime generally does not apply; confirm the precise vehicle, use and route because exemptions and exceptions matter. A courier fleet still processes drivers’ personal location data whenever a driver can be identified, so GDPR duties apply even where no tachograph is required. Tracking may support dispatch, proof of delivery, theft recovery, customer service and safety, but it should not become unrestricted off-duty monitoring. For international hire-or-reward work with vans over 2.5 tonnes, the rules change: from 1 July 2026 Smart Tachograph 2 is required, driver activity must be recorded, and posting-of-drivers obligations may apply. Larger goods vehicles over 3.5 tonnes are generally within the drivers-hours/tachograph framework, including limits, breaks, rest and record-inspection requirements. Operators carrying goods for hire or reward also need to assess Irish operator-licensing requirements.

Recent Legal Updates

The key current change for this article is the 1 July 2026 deadline: operators of light commercial vehicles and vans over 2.5 tonnes maximum permitted weight engaged in international goods transport or cabotage must have Smart Tachograph Version 2 installed and drivers must use driver cards. This deadline is now in effect as of 10 October 2026. The requirement does not mean that every Irish domestic courier van must have a tachograph; the international-operation, vehicle-weight and applicable-exemption tests must be applied. The underlying EU driving-time rules continue to provide, among other limits, a 9-hour normal daily driving maximum (extendable to 10 hours twice weekly), 56 hours weekly and 90 hours over two weeks, with required breaks and rest, subject to the rules’ exceptions and derogations.

Authoritative Resources

Data Protection Commission (DPC): Employer Vehicle Tracking guidance
Road Safety Authority (RSA): Smart tachograph 2 (LCVs)
Road Safety Authority (RSA): road-haulage enforcement guidance
European Commission: driving time and rest-period rules
Data Protection Act 2018 and EU GDPR