Fleet Tracking Regulations Explained: A Guide for Delivery Firms in the UK

Clear UK guidance for delivery firms on GDPR, tachographs, DPIAs, retention and drivers’ hours to ensure compliant fleet tracking.

1 October 20265 min read

Jurisdiction Scope

UK-wide guidance, with the cited tachograph material applying to UK goods-vehicle operations and including separate rules for international journeys involving the EU or AETR countries

Overview of Fleet Tracking Laws

Applicable Business Type

Delivery firms and courier businesses operating goods vehicles in the UK

Country or Region

United Kingdom

A UK-focused compliance guide for delivery firms using vehicle tracking and, where applicable, tachographs. It covers UK GDPR requirements for monitoring drivers and vehicles, transparency and proportionality, DPIAs, retention, and the separate drivers’ hours and tachograph obligations applying to qualifying goods vehicles.

Legal Requirements Summary

Delivery firms may use fleet tracking, but tracking that relates to identifiable drivers is personal-data processing. They must establish a lawful basis, provide clear prior information, use tracking proportionately for defined purposes, secure it and delete or anonymise it when no longer needed; a DPIA may be mandatory for high-risk monitoring. Driver consent is not automatically required and is often not an appropriate employment-law basis. Separately, qualifying goods vehicles must comply with UK drivers’ hours and tachograph rules, including regular downloads and retaining records available for enforcement for 12 months.

Main Regulatory Topics

UK GDPR and data protection
Worker transparency and privacy
Lawful basis and driver consent
DPIAs and monitoring governance
Purpose limitation, minimisation, security and retention
In-vehicle surveillance and audio
Drivers’ hours and tachographs
Record-keeping and enforcement inspections
International UK-EU/AETR journeys

Key Compliance Obligations

Identify and document a lawful basis for processing vehicle-location and driver-monitoring data.
Tell drivers in advance what is tracked, why it is tracked, how long data is retained, who can access it and how it is used.
Carry out a DPIA before monitoring likely to create a high risk to workers or other people, and consult affected workers as appropriate.
Apply purpose limitation, data minimisation, security and storage limitation; avoid tracking outside working hours where private use is permitted unless justified.
Restrict in-vehicle audio or other especially intrusive surveillance unless there is a strong justification.
For qualifying goods vehicles, ensure tachographs are calibrated, inspected and maintained, and train and instruct drivers.
Download vehicle-unit tachograph data at least every 90 days and driver-card data at least every 28 days, or more often where needed to prevent loss.
Keep tachograph charts, manual records and digital data and be able to produce them to enforcement officers for 12 months.
Schedule work and manage delivery incentives so they do not encourage breaches of drivers’ hours rules.

Driver Consent Requirement

Consent Rule: Prior informed consent is not universally required for business fleet tracking. The firm must identify and document an appropriate UK GDPR lawful basis, notify drivers clearly in advance about the tracking, purposes, access and retention, and limit monitoring to what is necessary. Consent is generally unsuitable as the routine lawful basis in an employer-worker relationship because it may not be freely given; if consent is used, it must be demonstrable and revocable.

Data Retention Period

Minimum Retention: 12 months for tachograph records that must be producible to enforcement officers; no universal minimum retention period is stated for ordinary GPS fleet-tracking data, which should be kept only as long as necessary for the stated purpose.

Enforcement Authorities

Driver and Vehicle Standards Agency (DVSA)
Traffic Commissioners for Great Britain, in relation to operator-licensing action
Information Commissioner’s Office (ICO), for UK data-protection compliance

Penalties for Non-Compliance

Non-compliance can lead to DVSA roadside or desk-based enforcement, fixed penalties and roadside deposits, prohibitions, adverse OCRS findings, prosecution and increased scrutiny. Serious or repeated drivers’-hours, vehicle-condition or operator-management failures can affect the operator’s licence and lead to regulatory action by the Traffic Commissioner. Poorly justified or excessive employee tracking can also create ICO enforcement, employment-law, privacy and compensation risk. The exact sanction depends on the offence, seriousness, history and available evidence; the cited DVSA sanctions policy includes graduated fixed-penalty levels of £50, £100, £200 and £300 for applicable offences.

Implementation Best Practices

Adopt a written telematics policy covering purpose, legal basis, monitored data, working/private use, access, retention, driver rights and complaint routes. Configure systems for working-hours or business-use tracking, role-based access, audit trails and automatic deletion. Integrate telematics with tachograph analysis, but do not treat ordinary GPS data as a substitute for a legally required tachograph. Schedule automatic downloads before statutory deadlines, issue regular infringement reports, and retain documented driver training, investigations and remedial action. Before relying on tracking data for discipline or automated decisions, provide human review and follow UK GDPR employment-monitoring safeguards.

Compliance Checklist

Define and document a lawful, necessary business purpose for GPS/telematics monitoring.
Carry out and document a data-protection impact assessment where monitoring is likely to create high risks; provide clear privacy information to drivers and passengers.
Limit tracking to business use and working time where possible; provide a means to disable or suspend monitoring during authorised private use.
Control access to location, speed, route and driver-behaviour data, establish retention periods, and use the data only for the stated purpose.
Use an approved tachograph where the applicable drivers’-hours rules require one; ensure drivers record driving, breaks, rest, other work and periods of availability.
Download vehicle-unit tachograph data at least every 90 days and driver-card data at least every 28 days, and download sooner when necessary to prevent data loss or before a driver leaves or a vehicle changes control.
Analyse tachograph and telematics records, investigate infringements, train drivers, and keep evidence of corrective action and disciplinary processes.
Maintain operator-licence, vehicle-maintenance, driver-training and drivers’-hours records so they can be supplied during DVSA checks or audits.

Industry-Specific Guidance

Delivery firms commonly need live location and route data for dispatch, customer ETA updates, proof-of-delivery support, theft recovery and safety management. That operational need does not remove privacy obligations: drivers and passengers must be informed, monitoring should be proportionate, and private journeys should generally not be tracked when private use is permitted. A GPS tracker records operational information but is not automatically a tachograph. For goods vehicles over 3.5 tonnes, the assimilated or AETR drivers’-hours framework generally applies; from 1 July 2026, the assimilated rules also extend to light goods vehicles over 2.5 tonnes used on qualifying international transport operations between the UK and EU, including cabotage. Operators remain responsible for their own and controlled drivers’ compliance, including agency drivers.

Recent Legal Updates

The key date for delivery fleets is 1 July 2026: the assimilated drivers’-hours rules extend to light goods vehicles over 2.5 tonnes used on qualifying international transport operations in the UK and EU, including cabotage, and those vehicles must use tachographs where the rules apply. The existing UK operator responsibilities remain important: vehicle-unit downloads are generally required at least every 90 days and driver-card downloads at least every 28 days. DVSA’s 2024 operator-compliance-audit material emphasises tachograph analysis, infringement reporting, download monitoring, driver handbooks, training and evidence of corrective action. Businesses should verify the precise vehicle, route and journey exemptions before 1 July 2026, particularly for AETR-regulated journeys.

Authoritative Resources

Information Commissioner’s Office (ICO): worker-monitoring and UK GDPR guidance
GOV.UK: Tachographs—rules for drivers and operators
GOV.UK/DVSA: Drivers’ hours and tachographs guidance
GOV.UK/DVSA: Operator Compliance Audits and Operator Compliance Risk Score (OCRS) guidance
DVSA enforcement sanctions policy