“Can I put GPS on the vans and see where the drivers are?” It’s one of the most common, and most misunderstood, questions for anyone running a fleet. The short answer is yes, but under precise conditions: geolocating company vehicles touches two bodies of law at once, the Italian Workers’ Statute and the GDPR, and ignoring them exposes the company to penalties and to the data collected being unusable.
This guide explains what it takes to use fleet GPS legitimately, without turning an efficiency tool into a liability.
Is it legal to install GPS on company vehicles?
Yes, geolocating company vehicles is legal, provided three conditions are met: a legitimate purpose (security, organization, asset protection), the procedure set out in Article 4 of the Workers’ Statute, and the GDPR obligations toward employees. The device itself isn’t banned: what’s prohibited is its unauthorized use and the disproportionate monitoring of the worker.
The underlying principle is that GPS must not become a tool for systematic surveillance of the individual, but it can legitimately serve to manage vehicles, safety and logistics.
The most common case where geolocation stops being a choice and becomes a legal mandate is hazardous waste transport: Category 5 of the Register of Environmental Managers requires GPS for RENTRI purposes. With note 831 of 28 January 2026 the National Labour Inspectorate clarified that GPS used exclusively for the traceability that law imposes falls outside Article 4. As soon as the same system also serves to plan routes, monitor fuel or driving style, which is how any fleet actually uses it, the procedure described below applies again. See RENTRI, xFIR and category 5 GPS for the detail.
Article 4 of the Workers’ Statute: remote monitoring
Article 4 of Law 300/1970, as amended by Legislative Decree 151/2015 (the Jobs Act), governs tools from which the possibility of remote monitoring of workers also arises. A GPS tracker normally falls into this category.
The rule is:
- Installation is allowed only for organizational and production needs, workplace safety or protection of company assets.
- It requires an agreement with the union representatives (RSA/RSU) or, failing an agreement, authorization from the territorial office of the National Labour Inspectorate (INL).
There is an exception (paragraph 2) for “tools used by the worker to perform their job”. Be careful, though: for the Labour Inspectorate, GPS is as a rule an element added to the work tool, not something indispensable to driving the vehicle (INL circular 2 of 7 November 2016), so it does not generally fall under this exception and the agreement or authorization remains necessary.
Finally, paragraph 3 is decisive: the data collected is usable for all purposes connected to the employment relationship (including disciplinary ones) only if the worker has been given adequate notice of how it is used and monitored, and in compliance with the GDPR. Without that notice, the data cannot be used.
Applying for Labour Inspectorate authorization
The law sets an order. If the company has union representatives (RSA or RSU, the closest Italian equivalent of a works council), the route is an agreement with them; the application to the Inspectorate is filed only where there are no representatives, or where the attempt at an agreement failed and that failure is documented. In both cases the content you have to write is the same, and it is what matters: most of the companies fined by the Italian data protection authority (Garante) in 2025 and 2026 did have the agreement or the authorization.
Union agreement first: when it is enough and what it must say
With RSA or RSU in place, the agreement closes the Article 4 procedure, with no step at the Inspectorate. It must name GPS as the tool (an agreement signed for cameras does not cover it), state which of the three legal needs justifies it, and describe the same operating conditions the Inspectorate asks for in the technical report: when position is recorded, who sees the data, how long it is kept, how drivers are informed. Writing them down also helps when you change supplier: if the new system meets the same conditions, the agreement stays valid.
An agreement that exists but is not reflected in the configuration offers no protection. In 2026 a regional health authority with an RSU agreement from 2018 was fined because it recorded position every 60 seconds, with real-time access and no impact assessment (Garante, decision 382 of 28 May 2026).
The application: form INL 1.2, stamp duty and the 60-day term
With no representatives, or with a record of failed negotiations, the application goes to the Inspectorate’s territorial office for the production unit. Since 2023 there has been a dedicated form for satellite tracking, INL 1.2, separate from the one for cameras: it is filled in digitally, signed by the legal representative and normally sent by certified email (PEC), which a foreign entity usually files through its Italian payroll or labour consultant. Companies with production units in several territorial areas may file a single application with the central office; several provinces under the same territorial office count as one area (INL note 4757 of 26 May 2025).
| Item | What applies |
|---|---|
| Form | INL 1.2, digital completion, signed by the legal representative, sent by PEC |
| Cost | Two €16 revenue stamps (application and decision), or the INL 1.4 self-declaration when filing digitally |
| Term | 60 days for the territorial office, 90 for the central office (INL directorial decree 10 of 24 February 2021), running from the stamp duty declaration |
| Silence | No tacit approval: an express decision is required (Ministry of Labour interpello 3 of 8 May 2019) |
Until the decision arrives, the GPS is not installed. The form’s instructions point out that installation alone, before authorization, triggers the penalties of Article 38 of the Statute: a criminal offence punishable by a fine or by imprisonment from 15 days to one year, for which the employer or the legal representative is personally liable.
The technical report: the seven points the Inspectorate reads
The form is the container; the decision is made on the attached report, signed by the legal representative. The form itself lists what it must contain.
| What the form asks | What to write |
|---|---|
| The needs | One or more of organizational and production needs, workplace safety, asset protection, with concrete detail. The Inspectorate’s own examples: better management of the vehicle fleet, planning of trips and journeys, locating the vehicle after theft, rapid response of rescue teams |
| Real-time access | Whether the platform shows current position, and why the declared needs require it |
| Access logging | How you keep track of who consults the data, when and for what reason |
| Awareness and deactivation | How the driver knows they are being tracked and whether they can pause tracking (the “privacy mode”) |
| Time window | In which hours the system is active and what happens off duty |
| Retention | How long data is kept and why: the longer the period, the stronger the justification must be, as the form itself warns |
| Data access | Who may consult the data, on which occasions and with what reasons |
These are the same seven points against which the Garante assessed, in 2025, a haulier that had obtained its authorization in 2021: continuous tracking including breaks, no anonymization, 180 days of retention, and a €50,000 fine. The conditions that recur in Inspectorate decisions, collected in INL note 2572 of 14 April 2023, are four: no continuous monitoring, deactivation as a rule during breaks and off duty, pseudonymization of data, retention proportionate to the purposes.
What you do not need, and what happens afterwards
- No list of licence plates: the decision covers the tracking tool, not the individual vehicles.
- Extending the system to further sites does not require a new application, as long as the reasons remain the ones authorized. Changing retention times is an amendment requested from the same office with the same form; changing the reasons requires a new authorization.
- The declared purposes cannot be changed afterwards: the Inspectorate checks that use stays consistent with what the application said (INL circular 5 of 19 February 2018).
- Signed consent from drivers does not replace the agreement or the authorization: without them, installation remains unlawful and criminally punishable (INL note 2572/2023, Court of Cassation criminal ruling 22148 of 2017). The Garante adds that in an employment relationship consent is, as a rule, not a valid legal basis, because of the imbalance between the parties.
- RENTRI-mandated GPS is the special case seen above: outside Article 4 only as long as it serves waste traceability exclusively.
GDPR: notice, legal basis, minimization
Locating a vehicle driven by a person means processing personal data. Regulation (EU) 2016/679 requires you to:
- Identify a legal basis (typically the controller’s legitimate interest, balanced against the worker’s rights).
- Provide a clear privacy notice to employees on what is collected, why, for how long and who accesses it.
- Apply minimization: collect only the data necessary for the stated purpose.
- Consider a DPIA (data protection impact assessment) when monitoring is systematic.
- Set retention periods that are limited and proportionate.
The limits set by the Garante (Italian DPA)
The rulings of the Italian Data Protection Authority on the geolocation of company vehicles converge on a few practical boundaries:
- No constant monitoring of position when it isn’t necessary for the purpose: tracking must be proportionate, not continuous by default.
- Deactivation off duty: where possible, the system must allow tracking to be suspended during breaks and outside working hours.
- Limited access to data, restricted to authorized roles with defined purposes.
- Transparency: the worker must know the vehicle is geolocated.
In short: the purpose must be managerial and safety-related, not surveillance of the individual.
Garante fines 2025-2026: what the fined companies were missing
The Garante’s decisions of the last two years on remote monitoring in vehicles say two things. First, the total absence of a procedure still exists, and it costs: one company used GPS from 2015 and applied for authorization only in 2023; another believed that its rental provider’s telematics, with no geolocation but with a driving score also computed on private trips, was not monitoring at all. Second, holding the paperwork is not enough: three companies out of five had the agreement or the authorization, and were fined for how the system was configured or for a notice never handed out.
| Decision | Who | What was missing | Fine |
|---|---|---|---|
| 7 of 16 January 2025 (docweb 10112287) | Road haulage, Sardinia, 50 drivers | Inspectorate authorization from 2021 in place, but position recorded every 3-5 minutes including breaks, no anonymization, 180 days of retention, inadequate notice | €50,000 |
| 755 of 18 December 2025 (docweb 10213711) | Seed company, Emilia, 11 leased cars (8 as fringe benefits, 3 pool cars) | No Article 4 procedure: the rental provider’s telematics had no GPS, but recorded every trip with a driving score, private trips included, for 13 months | €120,000 |
| 389 of 28 May 2026 (docweb 10293888) | Road haulage, Sardinia | GPS since 2015, authorization requested only in 2023; the record of processing listed a union agreement that was never signed | €10,000 |
| 382 of 28 May 2026 (docweb 10259916) | Regional health authority, Liguria | RSU agreement from 2018 in place, but recording every 60 seconds, real-time access, no impact assessment, disciplinary use | €6,000 |
| 585 of 6 August 2026 (docweb 10297306) | Private security, Bologna | Union agreement from 2019 in place, notice due within 30 days and never given; two data access requests from a driver left unanswered | €39,000 |
The common thread, for anyone running a fleet, is simple: the agreement or authorization covers the written conditions, and the software configuration has to match them. A line-by-line comparison between the authorization and the settings (recording frequency, time windows, retention, who sees the map) is the check none of these companies had done.
How to use fleet GPS compliantly
- Define the purpose: security, anti-theft, logistics optimization, asset protection. Put it in writing.
- Run the Article 4 procedure: union agreement or, failing that, an authorization request to the INL, with the report on the seven points described above.
- Prepare the GDPR notice for employees and, if needed, the DPIA.
- Configure minimization: no tracking off-hours, limited retention, role-based access.
- Communicate transparently: explain the purpose and limits of the system to drivers.
- Document everything: agreement/authorization, notice, record of processing.
For steps 3 and 6 you don’t have to start from a blank page. The compliance dossier includes the driver privacy notice and DPIA prepared with OptivoTrack, the technical note on the device to attach to the union agreement or the Inspectorate application, and our support through the process. Step 4 becomes a setting too: outside service time windows, the position is not recorded.
A good fleet tracking and management system is built with these capabilities from the start: access profiles, purpose configuration, and proportionate data collection. Technology doesn’t solve the procedure (that’s on the company), but it should make it workable rather than getting in the way.
Frequently asked questions
Is a union agreement mandatory to install GPS on company vehicles?
Usually yes: Article 4 of the Workers’ Statute requires an agreement with union representatives (RSA/RSU) or, failing that, authorization from the National Labour Inspectorate. GPS is generally considered a tool from which remote monitoring may arise, so it doesn’t fall under the “work tools” exception.
How do you apply for Labour Inspectorate authorization for GPS on company vehicles?
You apply to the territorial office of the National Labour Inspectorate with form INL 1.2, signed by the legal representative and normally sent by certified email (PEC), when the company has no RSA or RSU or no agreement was reached. The form is accompanied by a report explaining the needs (organizational, safety or asset protection), whether there is real-time access and why, how access is logged, whether and how the worker can pause tracking, the time window of activation, retention periods and who accesses the data. Two €16 revenue stamps are due, or the INL 1.4 self-declaration when filing digitally. No list of licence plates is required.
How long does Labour Inspectorate authorization for GPS take?
The term is 60 days for the territorial office and 90 days for the central office, which handles companies with units in several territorial areas (INL directorial decree 10 of 24 February 2021). It runs from the transmission of the stamp duty declaration, not from the date of the email. There is no tacit approval: without an express decision the GPS cannot be switched on (Ministry of Labour interpello 3 of 2019), and installing it earlier is already punishable under Article 38 of the Statute, even if it is never turned on.
Can I use GPS data for disciplinary action?
Only if three conditions are met together: the Article 4 procedure completed for that tool, adequate prior notice of how the system is used and monitored (paragraph 3), and data collection that complies with the GDPR. Without notice the data cannot be used. And notice alone does not cover everything: the Court of Cassation (labour section, ruling 16218 of 25 May 2026, on a satellite device placed by private investigators rather than on fleet telematics) held that data collected outside the Article 4 procedure to check the ordinary performance of the job is unusable. So-called defensive monitoring covers only misconduct unrelated to the contract and presupposes a well-founded suspicion. In the same year the Garante fined a health authority that had used the data in a disciplinary proceeding outside the conditions of its agreement. If you apply the Italian national collective agreement for logistics, freight transport and shipping (CCNL Logistica), Article 11 septies classifies satellite systems as defensive controls and rules out using their data for disciplinary action, with an individual notice to drivers based on the template attached to the agreement.
Must I be able to turn GPS off outside working hours?
The Garante’s rulings indicate that, where possible, the system must allow tracking to be suspended during breaks and off duty, applying the minimization principle. Continuous, indiscriminate tracking is hard to justify as proportionate.
How long can GPS data on company vehicles be kept?
The law sets no number of days: it requires a period proportionate to the purposes, and form INL 1.2 warns that the longer the period, the stronger the justification must be. The decisions give the scale: 180 days (2025) and 365 days (2018) were judged excessive, and in the leased-telematics case 13 months of retention counted towards the fine. The reference usually written into reports is the horizon within which a dispute about a delivery can arise, in the region of three months. Aggregated data without position, such as kilometres per month, follows the rules for management records.
Does vehicle GPS require a DPIA?
Yes: geolocation of workers is on the list of processing operations for which the Garante made the impact assessment mandatory (decision 467 of 11 October 2018), and its absence was among the violations fined in 2026. It must be written before processing starts and updated whenever the supplier, the device or the purposes change.
Do I need the agreement or authorization if the telematics belongs to the rental company, or doesn’t record position?
Yes, if employees drive the vehicles and the company can see where they are or how they are driven. Article 4 looks at the possibility of monitoring, not at who installed the device or whether it records position: in December 2025 the Garante fined a company with eleven leased cars €120,000. Its telematics had no GPS but recorded every trip, private trips included, with a driving score, and for that reason it had run no procedure at all (decision 755 of 18 December 2025, docweb 10213711).
Do I need Labour Inspectorate authorization to track third-party or owner-operator vehicles?
It depends on who employs the person driving. If the owner-operator is a sole proprietorship with no employees, Article 4 of the Workers’ Statute does not apply: tracking rests on the transport contract and on GDPR obligations towards the owner-operator (privacy notice, legal basis, typically the legitimate interest tied to delivery management). If the contractor has employee drivers, it is the contractor, as the employer, that must sign the union agreement or file the application with the Inspectorate for its own workers. With note 7020 of 25 September 2024 the Inspectorate clarified that it rejects the carrier’s application when the inquiry shows that the needs are in fact the shipper’s (for example an obligation written into the transport contract) and that the data controller, in the attached documents, is the shipper. The note does not say what the shipper should do; the route left open, and the one the dossier adopts, is that the needs are the carrier’s own and that control of its drivers’ position data stays with the carrier.
Who is responsible for compliance when the tracked vehicle belongs to a contractor?
Roles have to be separated by type of data. For delivery data (arrival times, proof of delivery) the shipper can be the data controller and define purposes and retention. For the position data of the carrier’s employee drivers, the reading consistent with INL note 7020/2024 is that the controller is the carrier: it runs the Article 4 procedure and gives the internal notice, while the shipper receives the data it needs for the service, for the contracted delivery windows only and without elements that identify the individual driver. The contract between the two governs that exchange (a processing agreement under GDPR Article 28 or joint controllership under Article 26, depending on who decides purposes and means). If the report to the Inspectorate or the notice names the shipper as controller, the application is rejected (INL note 7020/2024). The OptivoTrack compliance dossier (driver privacy notice, DPIA, technical note on the device) is the same kit used for company-owned vehicles, with the shipper and carrier roles written this way.
How do I limit GPS data visibility to contracted service hours only?
The GDPR’s minimization principle and the Italian DPA’s rulings require that tracking is not active when it is unnecessary for the stated purpose. In practice, a properly configured fleet management system lets you filter data visibility by time windows: the shipper sees the vehicle’s position only during the contracted delivery windows, not during the rest of the day. This is particularly relevant for third-party vehicles, where the driver uses the same vehicle for other clients or personal use. The time-window filter satisfies the DPA’s “off-duty deactivation” requirement without requiring the driver to physically interact with the device. In OptivoTrack the time-window filter works upstream: outside the windows the position is not recorded, so there is no data left to hide.
The next step
Want a fleet management system built with access profiles and proportionate data collection? With OptivoTrack we also prepare a compliance dossier: driver privacy notice, DPIA, technical note on the tracking device and support through the Labour Inspectorate authorization process, for both company-owned and third-party fleets.
Discover OptivoTrack or book a demo.
This article is for information only and does not constitute legal advice. For your specific situation, check with a trusted labour or legal advisor.