I asked for a copy of my tachograph data once. Agency work, depot near Birmingham, and a transport manager had made a comment I didn't like — something about knowing exactly where I'd been throughout the shift. I let it go at the time. But it sat with me. So I sent a Subject Access Request by email, stated it was under UK GDPR, and waited.
Three weeks later I got back a folder full of CSV files and spreadsheets. I spent a Sunday afternoon on it. And what I found out — about what's actually on the card, and what GDPR actually gives you — was different from what I'd assumed.
There's a lot of wrong information floating around on driver forums about tachograph data. Some of it is harmless confusion. Some of it could land you in real trouble if you act on it. So let's go through this properly.
What's actually on your driver card
Your driver card stores driver activity. That means the mode selections you make on the tacho head: drive, rest, work, availability. It also logs card insertion and removal events, faults, and daily start and end positions. The card holds a minimum of 28 days of this — your last four weeks, roughly. Not months. Four weeks.
I've heard drivers at Lymm Services absolutely convinced their card holds six months of data. It doesn't. The legal minimum storage on the card is 28 days. After that, older records are overwritten as new ones come in — which is exactly why the operator has to download your card at least every 28 days to keep a continuous record.
What the card doesn't store: detailed speed data, braking events, engine load figures, or any kind of per-event GPS track. That stuff exists in different systems, and I'll come to it. But the card itself is, at its core, a record of when you were driving, resting, working, or available — and where the working day started and ended.
Speed data: where it actually lives
The vehicle unit stores detailed speed data for approximately the last 24 hours. Not your card. When an operator downloads the truck, the speed data comes off the VU. Your card isn't involved. So when someone tells you they're pulling your speed profile off your driver card — they're either confused about the system, or they're downloading both at the same time and combining the output.
Braking events, harsh acceleration flags, engine load data — that's telematics or ECU data. Completely separate from the tachograph system. Different device, different data stream, different chain of custody. Your data protection rights apply to it, but it isn't tacho data.
The GPS question — it's not a simple yes or no
Whether GPS is recorded depends on what generation of tachograph is in the cab.
SMART tachographs — the second-generation units that came in from 2019 onwards — do record position data. But not the way most people assume. Under Regulation 165/2014 Article 8, the SMART tacho captures your position at the start of the daily working period, at the end of it, and then every three hours of accumulated driving. That's the requirement. Not every stop, not every event — a handful of position snapshots per shift, plus start and end.
First-generation digital tachographs? No GPS. Analogue charts? No GPS whatsoever. The location fields on those tacho heads show what the driver typed in manually at the start and end of the shift. Nothing more than that.
So if someone tells you the tachograph tracks your every move — the answer depends entirely on what's in the cab. And even on a SMART unit, it's not a continuous track.
UK GDPR applies — you are a data subject
I want to be clear on this because I've seen it written the wrong way more than once: UK GDPR absolutely applies to tachograph data. It is your personal data. You are the data subject. Your employer — or the transport operator you're deployed to, if those are different entities — is the Data Controller.
The fact that tacho data is also regulatory compliance data doesn't make it exempt. Both things are true simultaneously: it's data your employer is legally required to hold, and it's your personal data that you have rights over. UK GDPR doesn't disappear because the data has a compliance purpose.
Why are they allowed to have it?
Because they have a lawful basis. Two of them, actually. And understanding this matters — I've seen drivers go down the rabbit hole of thinking the employer is doing something wrong by downloading their card. They're not.
First: legal obligation. Under EU 561/2006 and the domestic drivers' hours regulations, the operator is legally required to download tachograph data, retain it, and produce it for DVSA on request. They have no choice. They must do this or they're non-compliant — which is a serious problem for their O-licence. Legal obligation is a recognised lawful basis under UK GDPR.
Second: performance of a contract. As part of engaging you to drive, they need to verify you're legal to be behind the wheel. That's baked into the employment or agency relationship. Another lawful basis.
The conclusion: your employer having your tacho data is not a privacy breach. It's a legal requirement — and UK GDPR is explicitly built to accommodate processing that's required by law. What they can't do is use that data for purposes wildly outside compliance and employment. But holding and processing it for those purposes? Entirely lawful.
Your right to ask for a copy
Article 15 of UK GDPR gives you the right of subject access. You can request a copy of the personal data any controller holds about you. That includes tachograph records — and specifically the data downloaded from your card. That data belongs to you as data subject.
They have one calendar month to respond. Usually at no cost. A request is only chargeable if it's judged to be manifestly unfounded or excessive — and a plain request for your tacho records covering a specific date range doesn't come anywhere near that threshold. I've done this. You get a response.
Put it in writing. Email is fine. State clearly that it's a Subject Access Request under UK GDPR Article 15. Be specific about the date range if you can — it makes the operator's job easier and means you get useful data rather than a generic dump. The ICO has template letters on their website if you want a starting point. Keep a copy of your email and note when you sent it.
Agency work and multiple controllers
If you've been doing agency shifts — I've done enough of those at DIRFT Rugby, around Immingham, and up near Carlisle to know how the structure works — you might have more than one controller in the picture. The transport operator you were actually driving for holds the operational tachograph data. The agency that placed you might hold separate records: your submitted hours, your availability, their own engagement records. Both are separate Data Controllers. You can make a Subject Access Request to each of them.
Don't assume the agency has nothing on you just because you were physically based at someone else's depot. They have records. They're subject to UK GDPR. Ask both — in writing, SAR clearly stated, date range specified.
What you can't do — and I'll be straight about this
The right to erasure — sometimes called the right to be forgotten — does not apply to legally-required records while the retention obligation is active. Your employer is legally obliged to keep those tachograph records. You cannot demand they delete them. UK GDPR explicitly recognises that some data must be retained because the law requires it, and tachograph records are squarely in that category.
You also can't use GDPR to block your employer's lawful processing. They need to download the VU and your card. They need to retain the records. They need to produce them for enforcement when asked. These aren't optional activities you can opt out of. Attempting to prevent lawful processing doesn't work, and honestly — if you tried it, it would look very strange to a traffic commissioner reviewing a compliance file.
What you can challenge is processing that goes beyond the lawful basis. Data shared somewhere it shouldn't have been. Data used for a purpose that has nothing to do with compliance or employment. If that's happened, the ICO is the right place to start. But the standard downloads, the retention, the DVSA production? Required by law.
How long do they keep it
The legal minimum retention period for tachograph records is 12 months. That's the floor.
The catch: if tachograph data is the only working-time record the operator holds — no separate WTD timesheets, no other records — the minimum rises to 24 months. Because in that case the tacho data is serving double duty as both the drivers' hours record and the working-time record under the WTD, and the two-year retention requirement then applies.
In practice, most operators keep records longer than 12 months anyway. DVSA can investigate incidents from further back, and traffic commissioners reviewing O-licence compliance look at historical records. Gaps are never good. But 12 months — or 24 months where tacho data is the sole WTD source — is what the law requires.
Download timescales are fixed by law. The vehicle unit must be downloaded at least every 90 days. Driver card data must be downloaded at least every 28 days. Those obligations line up: if the operator downloads on time, the 28-day card storage is enough to maintain a continuous record. Miss the window and there's a gap. That's the operator's problem to own — but worth knowing if you're ever in a dispute about missing data.
Fleet tracking is a different thing entirely
Fleet telematics — the tracking box sending live positions to a control room, logging harsh braking events, showing the vehicle on a map in real time — is completely separate from the tachograph. Different device, different data, different lawful basis, different retention rules. They often get conflated, and they really shouldn't be.
If the truck has a tracker, your employer is processing location and event data from that under separate grounds — usually legitimate interests or contract performance — and you should have been given a privacy notice explaining what data is collected and why. UK GDPR requires them to tell you. If you've never been shown one, it's worth asking. Not confrontational — just: can I see the privacy notice covering fleet tracking? You're entitled to it.
Your data protection rights apply to fleet telematics data too. A separate Subject Access Request would get you that data. What you'd receive would look very different from tachograph data — often continuous position history, harsh event logs, speed traces — because that system captures things the tacho doesn't. Same rights, different data, different request.
The short version
Your driver card holds about four weeks of your activity data — drive, rest, work, availability modes, card events, and daily start and end positions. The vehicle unit holds detailed speed data for the last 24 hours or so. SMART tachographs record a handful of GPS positions per shift; older units record none. UK GDPR applies to all of it. Your employer is the Data Controller with lawful grounds to hold and process your data — the law requires them to. You have the right to ask for a copy within one calendar month, usually free. You cannot demand deletion of compliance records. Minimum retention is 12 months, or 24 months if tacho data is the sole WTD record.
That's the actual position. Everything else is either fleet telematics (separate system, separate request) or someone on a forum guessing.
If you're tired of writing tacho infringements into a notebook, ShiftOwt tracks 561/WTD compliance automatically — £5.99/mo for drivers, agency pricing on request.