Fleet Tracking Regulations Explained: A Guide for Field Service Companies in Scotland

UK GDPR and tachograph guidance for Scottish field-service fleets on lawful GPS use, privacy, retention and driver-monitoring compliance.

13 October 20265 min read

Fleet Tracking Regulations Explained: A Guide for Field Service Companies in Scotland

Jurisdiction Scope

Scotland, under UK GDPR and UK-wide employment-monitoring and road-transport rules

Overview of Fleet Tracking Laws

Applicable Business Type

Field service companies operating work vehicles and monitoring employees or vehicle activity.

Country or Region

United Kingdom

A Scotland-focused guide to using GPS and telematics in field-service fleets, covering UK data-protection duties, transparency, lawful monitoring, private use, high-risk monitoring, and separate tachograph obligations where applicable.

Legal Requirements Summary

Field service companies in Scotland may use fleet tracking, but identifiable vehicle and driver data is personal information. They must establish a suitable lawful basis, provide transparent privacy information to workers and passengers, keep monitoring necessary and proportionate, restrict or suspend private-use monitoring, and apply a justified retention schedule. Higher-risk monitoring may require a DPIA. Vehicles covered by drivers’ hours rules have additional tachograph duties, including approved equipment, scheduled downloads, and analysis of records.

Main Regulatory Topics

Data Privacy
Lawful Basis
Worker and Passenger Transparency
Driver Consent
Private-Use Monitoring
Data Retention
Data Protection Impact Assessments
Tachographs and Drivers’ Hours
Real-Time and Behaviour Monitoring

Key Compliance Obligations

Identify and document an appropriate UK GDPR lawful basis for tracking and monitoring workers.
Explain the monitoring clearly to workers and passengers through privacy information and, where appropriate, vehicle signage.
Keep monitoring necessary, proportionate, and limited to the stated business purpose.
Avoid monitoring during private vehicle use unless it can be justified; provide a way to disable or suspend tracking where appropriate.
Create and follow a retention schedule; do not retain ordinary tracking data longer than necessary or merely for possible future use.
Carry out a data protection impact assessment for high-risk monitoring such as driver-behaviour analytics, cameras, or audio.
Where vehicles fall within drivers’ hours rules, use an approved tachograph and download vehicle-unit data at least every 90 days and driver-card data at least every 28 days.
Analyse tachograph records and maintain evidence of compliance with applicable drivers’ hours requirements.

Driver Consent Requirement

Consent Rule: Prior employee consent is not generally required as a standalone rule. The business must identify an appropriate UK GDPR lawful basis for the monitoring, inform workers and passengers, and ensure the monitoring is necessary and proportionate. Consent should not be assumed to be the appropriate basis in an employment context.

Data Retention Period

Minimum Retention: No fixed minimum period for ordinary fleet-tracking data under UK GDPR; retain it only for as long as necessary for the stated purpose, with a justified and regularly reviewed retention schedule.

Enforcement Authorities

Information Commissioner’s Office (ICO) — UK GDPR and employment-monitoring compliance.
Driver and Vehicle Standards Agency (DVSA) — enforcement of drivers’ hours, tachographs and roadworthiness/operator-compliance requirements.
Traffic Commissioners for Great Britain — operator-licensing regulatory action.
GOV.UK/Department for Transport — statutory and operational road-transport guidance.

Penalties for Non-Compliance

Non-compliance can lead to ICO regulatory action under UK data-protection law, including investigation, enforcement notices and potentially significant UK GDPR monetary penalties; it can also create compensation, employment, contractual and reputational exposure. Road-transport breaches may result in DVSA action, prohibitions, fixed or court-imposed penalties, tachograph/drivers’ hours enforcement and operator-licence consequences, including regulatory action against the operator’s licence. The exact outcome depends on the breach, seriousness, harm, culpability and compliance history; the sources do not establish one standard fine for ordinary fleet-tracking breaches.

Implementation Best Practices

Start with a documented purpose-and-necessity assessment for each tracking feature. Configure geofencing, driver identification, behaviour alerts and off-duty controls to collect no more data than required. Give field engineers a concise privacy notice and training, publish an internal telematics policy, and use role-based access with audit logs. Carry out a DPIA before deployment or material feature changes, consult workers where appropriate, review proportionality regularly, and set automated retention/deletion schedules. Keep tachograph compliance workflows distinct from ordinary fleet analytics, with calendar reminders for downloads, calibration and record reviews. Test supplier contracts, UK/international data transfers, security controls and data-subject access processes before go-live.

Compliance Checklist

Define the operational purpose for GPS, telematics, dashcams, driver-behaviour monitoring or location data.
Identify and document an appropriate UK GDPR lawful basis; do not rely on driver consent by default where tracking is an employment requirement.
Complete a Data Protection Impact Assessment before high-risk or intrusive monitoring, including continuous behaviour monitoring, cameras, audio or risk analytics.
Give drivers, passengers and other relevant individuals clear privacy information covering purposes, data categories, controller identity, access rights, retention and sharing.
Use proportionate monitoring: limit tracking to working time and operational needs, and provide a private-use/off-duty mode or disable tracking where vehicles may be used privately.
Display appropriate in-vehicle signage where surveillance or recording occurs; keep audio recording disabled by default unless separately justified.
Restrict access by role, secure the telematics platform and establish retention/deletion rules; retain data only as long as necessary.
If vehicles fall within goods-vehicle drivers’ hours rules, use an approved tachograph and keep required records separately from optional GPS data.
Download digital tachograph vehicle-unit data at least every 90 days and driver-card data at least every 28 days; analyse it for compliance.
Ensure tachographs are installed, calibrated, inspected and sealed by an approved manufacturer or calibration centre, and train and instruct drivers.
Check whether the operation requires a goods vehicle operator’s licence, normally relevant above 3.5 tonnes gross plated weight or for qualifying hire-or-reward operations.
Maintain documented policies, DPIA decisions, training records, access reviews, incident procedures and periodic audits.

Industry-Specific Guidance

Scottish field-service companies can generally use GPS and telematics to dispatch engineers, prove attendance, optimise routes, support lone-worker safety, manage maintenance and investigate incidents, but location, mileage, speed and driver-behaviour data linked to an engineer are personal data. There is no general UK rule requiring driver consent for ordinary operational GPS tracking; the employer must instead establish a lawful basis, be transparent and keep monitoring proportionate. Avoid unrestricted continuous surveillance, particularly outside working hours or when a van is taken home. Customer addresses, passenger information and incidental bystander data require minimisation and access controls. If the business operates heavier goods vehicles or qualifying hire-or-reward journeys, operator-licensing, drivers’ hours and tachograph requirements apply independently of ordinary telematics; vans below those thresholds may still be subject to data-protection and road-traffic obligations.

Recent Legal Updates

As at 13 October 2026, the evidence reviewed identifies no Scotland-specific new fleet-tracking regime or general driver-consent mandate. The applicable framework remains UK GDPR/ICO monitoring guidance plus Great Britain road-transport, operator-licensing, drivers’ hours and tachograph rules. Businesses should nevertheless re-check ICO guidance, GOV.UK/DVSA requirements and supplier arrangements before implementation, because regulatory guidance, tachograph requirements and data-processing risks can change. The current operational tachograph deadlines identified in GOV.UK guidance are vehicle-unit downloads every 90 days and driver-card downloads every 28 days.

Authoritative Resources

ICO — Data protection and monitoring workers: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/employment/monitoring-workers/data-protection-and-monitoring-workers/
ICO — Surveillance in vehicles: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/cctv-and-video-surveillance/guidance-on-video-surveillance-including-cctv/additional-considerations-for-technologies-other-than-cctv/surveillance-in-vehicles/
GOV.UK — Goods vehicle operator licensing guide: https://www.gov.uk/guidance/goods-vehicle-operator-licensing-guide
GOV.UK — Drivers’ hours and tachographs: https://www.gov.uk/guidance/drivers-hours-goods-vehicles/4-tachograph-rules
GOV.UK — Responsibilities of vehicle operators: https://www.gov.uk/guidance/drivers-hours-goods-vehicles/5-responsibilities-of-vehicle-operators
Scottish Environment Protection Agency vehicle-tracking assessment: https://beta.sepa.scot/about-sepa/how-we-work/equality-and-human-rights/equality-and-human-rights-impact-assessments-eqhria/vehicle-tracking/
DVSA/GOV.UK tachograph and road-transport guidance