Three years doing tramping runs out of DIRFT and nobody once mentioned the tracking unit bolted above the dashboard. Small black box, three LEDs, wires disappearing into the cab roof. I knew what it did in a vague way — the TM could see where I was. Didn't think much beyond that.
Then I changed operator. New job, new induction, and the new TM walked me through their telematics system on a laptop. Showed me my previous day's route on a map. Speed profile. Stop durations. Which gear I'd been in going up the M6 J20 gradient. I had no idea that level of detail was sitting in a server somewhere with my name on it.
It is personal data. And you have rights over it.
What fleet telematics actually records
The box on your dash -- whether it's a Webfleet unit, a Samsara, a Radius, or whatever the operator uses -- pulls data from the vehicle's FMS interface and its own GPS receiver. What it sends back to the operator's dashboard varies by setup, but typically includes live vehicle position updated every 30-60 seconds while driving, full route history with timestamps, speed at each GPS point, ignition on/off events, idle time, and driver identification if the system ties into a driver card or tag.
Some setups also pull CAN bus data from the vehicle's own internal network. That gives acceleration and deceleration rates, rev range, gear selection, and brake application events. Driving-style scoring follows from that. A TM running a 12-vehicle fleet out of Coventry can see who's been hauling the engine to the limiter and who's feathering the throttle. Not always used, but the data's there.
None of this is tachograph data. Tachograph records -- daily rest periods, driving time, card events -- live in the vehicle unit and the driver card under Regulation (EU) 165/2014 as retained in UK law. Telematics data is a parallel stream from a different device. They can overlap but they're not stored in the same place and they're subject to different access rules. Getting them confused is common. The telematics unit is the one doing the granular location work.
UK GDPR applies -- the employer is the data controller
Your employer is the data controller. You're the data subject. That relationship is the same as it is for dashcam footage, payroll records, or CCTV at the yard gate. UK GDPR applies because GPS location data linked to a named driver -- or to a vehicle the operator can tie to you via shift records -- is personal data.
The controller has to have a lawful basis to collect it. For fleet telematics, the typical basis is one or both of the following.
Legal obligation. Operators must under their operator licence undertakings maintain vehicles safely and ensure drivers comply with driving time and rest rules. Telematics data supports this. It lets a TM verify route compliance and cross-check driving patterns against tachograph records. It's also relevant to WTD record-keeping -- the Road Transport (Working Time) Regulations 2005 require employers to keep working-time records, and telematics provides a parallel audit trail.
Legitimate interests. The operator has a genuine commercial interest in managing their fleet -- fuel costs, route efficiency, vehicle security, insurance. This has to be balanced against your rights as a worker, but for routine position and speed logging the balance tips toward the operator because the monitoring is proportionate to a genuine operational need, provided drivers are told about it.
The third basis -- consent -- almost never holds for workplace monitoring. You can't freely consent when your employment depends on agreeing. An operator who told you at induction that you needed to consent to tracking or you wouldn't get the job isn't collecting valid consent under UK GDPR.
You should have been told about it
The transparency principle requires the operator to tell you about the monitoring. Not in legalese in a document nobody reads -- clearly enough that you know what's collected, why, how long it's kept, and who it's shared with. Most operators cover this in an employment contract, staff handbook, or induction pack. If you signed something at induction without reading past page two -- most drivers do -- go back and look at it now. The monitoring policy should be in there somewhere.
If you've never been told anything at all, that's a transparency failure on the operator's part. Not a criminal offence, but it's a reportable breach to the ICO. Realistically most operators have got this covered at some level. The problem is usually that the policy exists but nobody explained it properly at induction -- a line in paragraph 14 of an employment contract isn't the same as being told.
For agency drivers, this gets murkier. The hirer operates the vehicle and the tracking. The agency employs you. You might get information from neither of them. The hirer, as controller of the vehicle and its telematics, is responsible for transparency with the drivers who operate it -- even agency drivers on short placements.
Your right to a copy of the data
UK GDPR Article 15 gives you the right to submit a Subject Access Request and receive a copy of your personal data. Any format works -- email, letter, even verbal if you follow up in writing. The controller has one calendar month to respond. Normally free. If the volume of your request is very large they can ask you to narrow it down, but they can't refuse outright.
For fleet telematics, that means GPS position history, speed logs, route data, any driver-specific scoring -- anything linked to you by name or by vehicle during your shifts. If the data uses a vehicle identifier without a name but the operator can tie it to you via their shift records, it's still your data. That's not a loophole.
They have to tell you how long they're keeping the data and who it's been shared with. Insurance companies, for example. Some fleet telematics data feeds directly into commercial vehicle insurance pricing. That's worth knowing.
What they can keep, and for how long
UK GDPR doesn't set fixed retention periods -- it says data shouldn't be kept longer than necessary for its purpose. For routine telematics, necessary is somewhere in the range of a few months for most operational purposes. For data relating to a specific incident -- an accident, an insurance claim, a DVSA investigation -- the retention extends until that matter is closed. That could be two years or more in a dispute involving personal injury claims.
The operator's privacy notice should state their retention periods. If it doesn't, that's a gap in their compliance. You can ask, and they should be able to tell you.
What UK GDPR can't do for you
You can't demand deletion of records the operator needs to keep for legal compliance purposes. If DVSA are investigating a possible drivers' hours breach and the telematics data covers the relevant period, the operator cannot erase it on your request. Legal obligation overrides the right to erasure. Same applies if there's an accident with a personal injury claim -- the data stays until the litigation is resolved.
You also can't prevent monitoring that's proportionate and disclosed. Routine position and speed logging for fleet management and WTD compliance purposes -- you can't opt out of that on data protection grounds and expect to keep driving for that operator. What you can do is hold them to their stated purpose. If the data starts being used for something they never told you about -- sold to a third party you haven't heard of, used for a purpose not mentioned in the privacy notice -- that's a complaint to the ICO.
The ICO (ico.org.uk) is the regulator. You can raise concerns there without going to a solicitor first.
What to do if the data doesn't look right
Telematics data has errors. GPS dropouts near bridges or in urban canyons, cold-start location jumps, FMS interface glitches that log events at the wrong time. It's not infallible evidence. If you put in a SAR and the data shows a route you didn't drive, a speed you didn't hit, or a stop at a location you weren't at -- worth raising.
If the data has been used against you in a disciplinary -- a speed reading triggering a warning, an idle time analysis implying something you dispute -- the data is one source of evidence. You're entitled to put your own account forward, and errors in telematics records have been challenged in employment tribunals.
Took me three years to realise any of this. If you're managing your own compliance as well as your operator's, ShiftOwt gives drivers their own record of hours and availability -- one place to see what your shift pattern looks like before anyone else pulls the data. 5.99 per month for drivers.
The short version
Your employer can track your vehicle. That's legal. But they have to tell you about it, they can't keep the data indefinitely, you can request a copy through a Subject Access Request, and they can't hand it to third parties beyond what they disclosed. If you've never thought to look into it, a SAR takes about ten minutes to send and the response might surprise you.