Fleet Tracking Regulations Explained: A Guide for Courier Businesses in Scotland

Guide to UK GDPR, driver monitoring and tachograph rules for courier fleets operating in Scotland.

9 October 20265 min read

Jurisdiction Scope

Scotland under Great Britain road-transport rules and UK data-protection law; tachograph and drivers’ hours rules apply where the vehicle and operation fall within their scope.

Overview of Fleet Tracking Laws

Applicable Business Type

Courier and delivery businesses

Country or Region

Scotland, UK

A practical compliance guide for courier businesses operating in Scotland. It explains how UK data-protection rules apply to GPS, telematics, vehicle surveillance and driver monitoring, and distinguishes optional fleet tracking from mandatory drivers’ hours and tachograph obligations for qualifying goods vehicles.

Legal Requirements Summary

Scottish courier businesses may use GPS and telematics, but data linked to identifiable drivers is personal data. They must establish a lawful basis, inform drivers and passengers, use monitoring proportionately, protect the data and delete or anonymise it when no longer needed. Driver consent is not automatically required for ordinary business tracking. High-risk systems such as in-vehicle cameras, audio or behavioural analytics generally require a DPIA, and private-use monitoring is normally difficult to justify. Separately, qualifying goods vehicles must meet Great Britain drivers’ hours and tachograph rules, including periodic downloads and retention of records for enforcement.

Main Regulatory Topics

Data Privacy
UK GDPR Lawful Basis
Driver Consent
Worker Monitoring
Vehicle Surveillance
DPIAs
Private-Use Monitoring
Installation and Data Protection by Design
Drivers’ Hours
Tachographs
Record-Keeping
Enforcement and Penalties

Key Compliance Obligations

Identify and document a lawful basis for processing location, route, mileage, speed, telematics or driver-behaviour data.
Give drivers and passengers clear privacy information, including appropriate in-vehicle notices and controller contact details.
Use tracking for defined, necessary and proportionate purposes; avoid unrestricted continuous monitoring, particularly during private use.
Disable or separate private-use monitoring where possible and provide a way to deactivate monitoring outside working hours.
Complete and document a DPIA for high-risk monitoring such as cameras, audio, continuous behaviour monitoring or analytics that infer or predict driver behaviour.
Apply data protection by design, suitable technical standards, access controls, security and data minimisation.
For qualifying goods vehicles, comply separately with drivers’ hours and tachograph requirements, including downloading vehicle-unit data every 90 days and driver-card data every 28 days.
Retain tachograph records for the required enforcement period and make them available for inspection; ordinary GPS data should not be kept longer than necessary.

Driver Consent Requirement

Consent Rule: Prior driver consent is not generally required for ordinary business fleet tracking. The courier should document an appropriate UK GDPR lawful basis, provide clear privacy information to drivers and passengers, and ensure monitoring is necessary and proportionate. Consent is usually not the preferred employment-law basis because of the power imbalance, although it may be relevant where a specific technical or legal context genuinely requires it.

Data Retention Period

Minimum Retention: 12 months for tachograph records that must be produced to enforcement officers; no universal statutory minimum is stated for ordinary GPS tracking data, which should be retained only as long as necessary.

Enforcement Authorities

Information Commissioner’s Office (ICO) for UK data-protection compliance and complaints/enforcement
Driver and Vehicle Standards Agency (DVSA) for goods-vehicle operator licensing, drivers’ hours, tachographs, vehicle condition and roadside/desk-based compliance checks
Traffic Commissioners for Great Britain for operator-licence regulatory decisions, including regulatory action against operators

Penalties for Non-Compliance

Non-compliance can lead to ICO investigation and enforcement action, including orders to stop or restrict unlawful processing and financial penalties under UK data-protection law. Drivers’ hours or tachograph breaches can result in enforcement action, prosecution and fines; inaccurate or missing records increase operator-compliance risk. Operating without the required goods-vehicle operator licence can result in DVSA enforcement and fines, and international journeys can also expose the operator to prosecution in the countries travelled through. Serious or repeated operator-compliance failures can threaten the operator’s licence and the business’s ability to operate.

Implementation Best Practices

Create a fleet-monitoring policy and data map covering GPS, telematics, tachograph, dashcam and delivery-app data. Configure collection to the least intrusive level needed for dispatch, safety, proof of delivery and legal compliance; separate operational tracking from employee performance decisions where possible. Use role-based access, encryption, audit logs, retention/deletion schedules and documented supplier/controller arrangements. Provide drivers with a concise notice and training, test privacy-mode controls, review the DPIA after material system or purpose changes, and audit tachograph downloads, drivers’ hours and maintenance records regularly.

Compliance Checklist

Identify the lawful basis and specific business purpose for live location, telematics, camera or driver-behaviour monitoring.
Complete and document a Data Protection Impact Assessment before high-risk monitoring, particularly driver-behaviour, camera or audio monitoring.
Give drivers and passengers clear privacy information; explain what is collected, why, who controls it, retention, access and rights. Use appropriate in-vehicle signage where surveillance occurs.
Do not monitor private journeys unless genuinely necessary and justified; provide a privacy mode or disable tracking outside working time where private use is permitted.
Keep access to tracking data restricted, secure and auditable; set a documented retention period and delete data when no longer needed.
For goods vehicles over 3.5 tonnes used under assimilated/AETR rules, fit and use an approved tachograph and record driving, breaks, rest, other work and availability.
Download tachograph vehicle-unit data at least every 90 days and driver-card data at least every 28 days; analyse it and retain required records.
For vehicles subject to GB domestic drivers’ hours rules, keep weekly written records where required, and have the operator check and sign them.
Check whether the courier operation needs a goods-vehicle operator licence, and ensure vehicles, maintenance, drivers’ hours and records are managed consistently with the licence.

Industry-Specific Guidance

A courier business operating in Scotland is subject to Great Britain rules rather than a separate Scottish fleet-tracking regime. GPS tracking is not automatically mandated merely because vehicles deliver parcels; it must be justified under UK data-protection law when it identifies drivers. Tracking is easier to justify for dispatch, route management, safety and customer delivery evidence during work, but continuous driver-behaviour monitoring, cameras and audio are more intrusive and normally require stronger justification and a DPIA. If vans exceed 3.5 tonnes, or the operation falls within the relevant international rules, tachograph and drivers’ hours obligations apply. Courier operators using larger goods vehicles for hire or reward will generally need the appropriate operator licence; international courier work in vans over 2.5 tonnes can also trigger international licensing requirements. Subcontractors and agency drivers must receive appropriate privacy information and operational instructions themselves; do not assume notice to the contracting company is sufficient.

Recent Legal Updates

As at 9 October 2026, the core position for Scotland remains the GB framework: UK GDPR/Data Protection Act requirements apply to identifiable tracking data; assimilated/AETR drivers’ hours and tachograph rules apply according to vehicle, journey and exemption; and operator-licensing requirements depend on vehicle weight, use and whether journeys are international. The GOV.UK guidance confirms that international hire-or-reward work in vans over 2.5 tonnes can require a standard international goods vehicle operator licence. No source reviewed identified a Scotland-specific new fleet-tracking mandate or a new 2026 deadline; operators should recheck ICO and GOV.UK guidance before implementation because applicability changes with vehicle weights, routes, private use and monitoring features.

Authoritative Resources

Information Commissioner’s Office (ICO): worker monitoring and vehicle surveillance guidance
GOV.UK: drivers’ hours and tachographs guidance
GOV.UK: goods vehicle operator licensing guide and operator-licence services
Driver and Vehicle Standards Agency (DVSA): operator compliance and enforcement guidance