Informing employees about GPS tracking: employer checklist and model notice

The employer is responsible for ensuring that GPS tracking of vehicles is lawful and that employees know about it in advance. This checklist helps you prepare tracking correctly; why notification is mandatory is explained in the article on tracking a company vehicle. Our roles and obligations are set out in the data processing agreement.

Employer checklist before switching the tracker on

1. Define the purpose (recording work trips, protecting property, logistics) and make sure tracking is necessary for and proportionate to that purpose.
2. Document the legal basis — as a rule, a legitimate interest assessment or performance of the employment contract; employee consent is generally not suitable (AKI). An employment contract does not in itself entitle you to GPS tracking.
3. Inform employees before tracking begins, in a form enabling written reproduction (model below). Secret tracking is prohibited.
4. Restrict access to the data to employees who need it for their work duties.
5. If the car is also used for private trips, agree on the arrangements in advance and limit tracking to work use. AKI does not allow real-time tracking outside working hours.
6. Review retention: the system keeps history for 24 months; if you need a shorter period, delete the data yourself or give us a written instruction. Do not automatically use the system’s 24-month ceiling as the justification for your own retention needs.
7. If tracking is continuous and in real time, or the fleet is large, assess whether a data protection impact assessment is required (Art. 35 GDPR; chapter 5 of AKI’s general guidance).

Model employee notice

Adapt the model to your company and fill in the parts in square brackets.

NOTICE: GPS tracker in a company vehicle

Controller: [company name, registry code, contact; data protection officer's contact,
if any].

[Company] gives notice that a GPS tracker has been installed on the vehicle
[make/model/registration number].

Purpose: [recording work trips / protecting company property / organising work].
Legal basis: [the company's specific legitimate interest, reference to the balancing
summary / performance of the employment contract].
Data collected: vehicle location, movement routes, speed, trip times.
Scope of tracking: [continuous / during working hours; arrangements for private
trips: …].
Retention: trip history for up to 24 months; after the service ends, up to 3 months
(in backups up to 12 months).
Access to the data: [roles/persons].
Recipients: the service provider OÜ Ravolar Grupp (Mugav Auto), which processes the
data on the company's behalf under the data processing agreement
(gpsauto.ee/andmetootlusleping, including sub-processors).

You have the right to access your data, to request rectification of inaccurate data,
erasure or restriction of processing and, where applicable, data portability. You may
object to processing based on legitimate interest on grounds relating to your
particular situation. Contact: [contact]. You have the right to lodge a complaint
with the Data Protection Inspectorate (aki.ee).

Date: …   Employee's signature (acknowledgement, not consent): …

The signature confirms acknowledgement, not consent

The employee’s signature on the model confirms that they have read the notice — it is not consent, because consent is generally not a suitable basis for tracking in employment relationships. If an employee refuses to sign, this does not prevent tracking on a lawful basis, but the fact of notification must be recorded in another way: for example, by an email with confirmed delivery or meeting minutes.

These are our supporting materials for employers, not a legal assessment of a specific company’s tracking arrangements. If you have questions, contact us.