GRS Fleet Telematics

Fleet Tracking Regulations Explained: A Guide for Field Service Companies in France

Lawful vehicle geolocation guidance for French field-service employers: purposes, employee rights, off-duty privacy and CNIL retention limits.

5 min read
Fleet Tracking Regulations Explained: A Guide for Field Service Companies in France

Jurisdiction Scope

France; employment-related vehicle geolocation under CNIL guidance and French labour-law principles.

Overview of Fleet Tracking Laws

Applicable Business Type

Field service companies and other employers using company vehicles for mobile employees.

Country or Region

France

A France-focused guide to lawful vehicle geolocation for field service operations, covering proportionality, employee information and rights, representative-body consultation, permitted purposes, off-duty privacy, retention, and CNIL enforcement expectations.

Legal Requirements Summary

French employers may use vehicle geolocation for field-service purposes only when the processing is justified, proportionate and transparently communicated. Employee representative bodies must be informed or consulted before deployment, employees must receive prior privacy information and access/opposition rights, and tracking must not continue during non-working time. CNIL generally limits retention to 2 months, with specific exceptions of 1 year or 5 years depending on purpose. Continuous tracking without an off-duty pause mechanism may be excessive and subject to CNIL enforcement.

Main Regulatory Topics

  • Data Privacy
  • Employee Information and Transparency
  • Lawful Basis and Proportionality
  • Driver/Employee Rights
  • Employee Representative Consultation
  • Off-Duty Tracking Controls
  • Record-Keeping and Data Retention
  • Permitted Uses and Purpose Limitation
  • CNIL Enforcement

Key Compliance Obligations

  • Define a lawful, specific and proportionate purpose for tracking.
  • Inform and, where applicable, consult employee representative bodies before implementing the system.
  • Inform each employee before installation about the controller, purposes, legal basis, data recipients, retention, rights and CNIL complaint rights.
  • Do not use geolocation for permanent employee surveillance or to control speed-limit compliance.
  • Do not track outside working time; provide a way to disable collection or transmission during breaks and off-duty periods where vehicles may be used privately.
  • Do not track employee representatives while they act within their mandate.
  • Avoid using geolocation to calculate working time when another system already exists.
  • Retain data only for the applicable period: ordinarily no more than 2 months, with limited longer periods for route optimisation/intervention proof or working-time monitoring.
  • Provide access to relevant location data and applicable rectification and opposition rights.

Driver Consent Requirement

Consent Rule: Prior individual information is required, but employee consent is not stated as a general prerequisite. The employer must establish a lawful, justified and proportionate purpose; employees have an opposition right on legitimate grounds and must be able to disable location collection or transmission outside working hours where appropriate.

Data Retention Period

Minimum Retention: Generally no more than 2 months; up to 1 year for route optimisation or proving interventions where no alternative exists; up to 5 years when used for working-time monitoring.

Enforcement Authorities

  • Commission nationale de l’informatique et des libertés (CNIL) — data-protection regulator and principal authority for employee geolocation compliance.
  • Labour authorities and employment courts — relevant to disproportionate employee monitoring, labour-rights breaches and evidential use in disciplinary cases.
  • French transport control authorities under the Ministry responsible for transport — relevant to tachographs, driving/rest rules and road-transport compliance.
  • European Union institutions and national transport enforcement authorities applying Regulation (EU) No 165/2014 and related rules.

Penalties for Non-Compliance

Non-compliance can expose the company to CNIL enforcement and GDPR-related corrective measures and fines, employee complaints and litigation, invalid or inadmissible GPS evidence in disciplinary proceedings, labour-law disputes, and transport enforcement action for tachograph or driving-time breaches. The cited official guidance does not establish one universal fixed fine for ordinary employee fleet tracking; sanctions depend on the infringement, scale, negligence and applicable transport rules.

Implementation Best Practices

Use a privacy-by-design fleet platform: configure working-hours and break-time geofencing or a driver privacy switch; collect only the location and vehicle data needed for dispatch, safety, service evidence or legally required transport controls; separate live operational access from historical reporting; restrict and review user permissions; encrypt data in transit and at rest; document the purpose, legal basis, retention and deletion rules; keep an information notice and employee-rights procedure; test deletion and privacy-mode controls; audit access and configuration regularly; and conduct a DPIA where the scale or monitoring risk warrants one. Treat tachograph data as a distinct regulatory dataset rather than assuming an ordinary GPS tracker satisfies tachograph obligations.

Compliance Checklist

  1. Define a specific, necessary and proportionate purpose, such as dispatching field engineers, proving a service visit, protecting staff or vehicles, or optimising dispersed interventions.
  2. Complete a GDPR record of processing and document the legal basis, necessity, proportionality, recipients, access controls and retention periods; involve the DPO where applicable.
  3. Inform and, where required, consult employee representative bodies before implementation.
  4. Give each worker clear prior information covering the controller, purposes, data recipients, rights and how to exercise them; obtain acknowledgement where appropriate, but do not treat employee consent as the automatic legal basis.
  5. Provide a way to disable location collection/transmission outside working time, including breaks and private use.
  6. Do not use tracking for continuous surveillance, speed-limit enforcement, tracking outside working time, monitoring staff representatives acting in their mandate, or measuring working time where another system is available.
  7. Limit access to authorised personnel, secure the system and maintain audit logs.
  8. Apply retention limits: normally no more than two months; up to one year for route optimisation or irreplaceable proof of interventions; up to five years for working-time monitoring, limited to the relevant time data.
  9. If the fleet includes vehicles within tachograph scope, fit, operate, download and retain tachograph data in accordance with EU and French transport rules.

Industry-Specific Guidance

For French field-service companies, GPS tracking can support dispatching the nearest technician to a dispersed or urgent job, proving that an intervention occurred, allocating resources, protecting vehicles and staff, and—only where no less intrusive method exists—supporting working-time records. Tracking must be tied to those operational purposes and cannot become permanent employee surveillance. Technicians must be able to stop collection outside working time, including commuting and breaks, and employees with genuine freedom over how they organise travel may fall outside an appropriate tracking use case. Keep customer-facing service evidence separate from unnecessary employee-performance profiling. A French court has rejected GPS evidence where it was used to monitor working time despite another available method and to locate the employee outside working hours.

Recent Legal Updates

As at 15 October 2026, CNIL’s employee-vehicle guidance remains the central practical reference: it specifies purpose limits, privacy outside work, employee information and retention periods. CNIL also published updated employee-activity monitoring guidance on 9 July 2026, reiterating necessity, proportionality and that constant surveillance is generally excessive. For transport fleets, the final major tachograph retrofit deadline was 1 July 2026: international goods vehicles over 2.5 tonnes must use a Gen2V2 smart tachograph. Vehicles over 3.5 tonnes and passenger vehicles carrying more than nine people remain within the general tachograph regime subject to exceptions. CNIL’s June 2026 connected-vehicle recommendation concerns private owners/lessees and expressly does not replace its existing guidance for employer-provided vehicles.

Authoritative Resources

Related Blog Posts

Related reading

More from the blog.

Talk to GRS

Tell us about your fleet.

Get a package recommendation, transparent pricing and a practical deployment route.

Book a demoView resources