“Can I put GPS on the vans and see where the drivers are?” It’s one of the most common—and most misunderstood—questions for anyone running a fleet. The short answer is yes, but under precise conditions: geolocating company vehicles touches two bodies of law at once, the Italian Workers’ Statute and the GDPR, and ignoring them exposes the company to penalties and to the data collected being unusable.
This guide explains what it takes to use fleet GPS legitimately, without turning an efficiency tool into a liability.
Is it legal to install GPS on company vehicles?
Yes, geolocating company vehicles is legal, provided three conditions are met: a legitimate purpose (security, organization, asset protection), the procedure set out in Article 4 of the Workers’ Statute, and the GDPR obligations toward employees. The device itself isn’t banned: what’s prohibited is its unauthorized use and the disproportionate monitoring of the worker.
The underlying principle is that GPS must not become a tool for systematic surveillance of the individual, but it can legitimately serve to manage vehicles, safety and logistics.
The most common case where geolocation stops being a choice and becomes a legal mandate is hazardous waste transport: Category 5 of the Register of Environmental Managers requires GPS for RENTRI purposes, but that doesn’t excuse the company from the requirements covered below. See RENTRI, xFIR and category 5 GPS for the detail.
Article 4 of the Workers’ Statute: remote monitoring
Article 4 of Law 300/1970, as amended by Legislative Decree 151/2015 (the Jobs Act), governs tools from which the possibility of remote monitoring of workers also arises. A GPS tracker normally falls into this category.
The rule is:
- Installation is allowed only for organizational and production needs, workplace safety or protection of company assets.
- It requires an agreement with the union representatives (RSA/RSU) or, failing an agreement, authorization from the territorial office of the National Labour Inspectorate (INL).
There is an exception (paragraph 2) for “tools used by the worker to perform their job”. Be careful, though: according to the Labour Inspectorate’s guidance, GPS does not generally fall under this exception (it isn’t indispensable to driving the vehicle), so the agreement or authorization remains necessary.
Finally, paragraph 3 is decisive: the data collected is usable for all purposes connected to the employment relationship (including disciplinary ones) only if the worker has been given adequate notice of how it is used and monitored, and in compliance with the GDPR. Without that notice, the data cannot be used.
GDPR: notice, legal basis, minimization
Locating a vehicle driven by a person means processing personal data. Regulation (EU) 2016/679 requires you to:
- Identify a legal basis (typically the controller’s legitimate interest, balanced against the worker’s rights).
- Provide clear privacy notice to employees on what is collected, why, for how long and who accesses it.
- Apply minimization: collect only the data necessary for the stated purpose.
- Consider a DPIA (data protection impact assessment) when monitoring is systematic.
- Set retention periods that are limited and proportionate.
The limits set by the Garante (Italian DPA)
The rulings of the Italian Data Protection Authority on the geolocation of company vehicles converge on a few practical boundaries:
- No constant monitoring of position when it isn’t necessary for the purpose: tracking must be proportionate, not continuous by default.
- Deactivation off-duty: where possible, the system must allow tracking to be suspended during breaks and outside working hours.
- Limited access to data, restricted to authorized roles with defined purposes.
- Transparency: the worker must know the vehicle is geolocated.
In short: the purpose must be managerial and safety-related, not surveillance of the individual.
How to use fleet GPS compliantly
- Define the purpose: security, anti-theft, logistics optimization, asset protection. Put it in writing.
- Run the Article 4 procedure: union agreement or, failing that, an authorization request to the INL.
- Prepare the GDPR notice for employees and, if needed, the DPIA.
- Configure minimization: no tracking off-hours, limited retention, role-based access.
- Communicate transparently: explain the purpose and limits of the system to drivers.
- Document everything: agreement/authorization, notice, record of processing.
A good fleet tracking and management system is built with these capabilities from the start: access profiles, purpose configuration, and proportionate data collection. Technology doesn’t solve the procedure (that’s on the company), but it should make it workable rather than getting in the way.
Frequently asked questions
Is a union agreement mandatory to install GPS on company vehicles?
Usually yes: Article 4 of the Workers’ Statute requires an agreement with union representatives (RSA/RSU) or, failing that, authorization from the National Labour Inspectorate. GPS is generally considered a tool from which remote monitoring may arise, so it doesn’t fall under the “work tools” exception.
Can I use GPS data for disciplinary action?
Only if you have given employees adequate notice of how the system is used and monitored, and you comply with the GDPR (Article 4, paragraph 3, of the Workers’ Statute). Without prior notice, the data collected cannot be used for disciplinary purposes.
Must I be able to turn GPS off outside working hours?
The Garante’s rulings indicate that, where possible, the system must allow tracking to be suspended during breaks and off-duty, applying the minimization principle. Continuous, indiscriminate tracking is hard to justify as proportionate.
Does vehicle GPS require a DPIA?
When geolocation involves systematic monitoring of workers, the GDPR requires a data protection impact assessment (DPIA). It’s good practice to prepare one and keep it up to date.
Do I need Labour Inspectorate authorization to track third-party or owner-operator vehicles?
It depends on the contractor’s structure. If the owner-operator is a sole proprietorship with no employees, Article 4 of the Workers’ Statute does not apply: there is no subordinate employment relationship to protect. Tracking rests on the transport contract between the shipper and the contractor, plus GDPR obligations (privacy notice to the contractor, legal basis — typically the legitimate interest tied to delivery management). If the contractor is a cooperative or a company with employee drivers, Article 4 applies within the cooperative itself: the cooperative, as the employer, must run the procedure (union agreement or Labour Inspectorate authorization) for its own employees.
Who is responsible for compliance when the tracked vehicle belongs to a contractor?
Responsibility is shared between the shipper and the contractor. The shipper (the company commissioning deliveries) is typically the data controller for tracking data and must prepare the privacy notice, define the purposes and ensure minimization. If the contractor has employees, the cooperative or contracting company is responsible for the Article 4 procedure toward its own drivers and must provide them with an internal privacy notice. Between shipper and contractor, a data processing agreement under GDPR Article 28 (or a joint controllership arrangement under Article 26) is needed, depending on who actually determines the purposes and means of the processing. The compliance dossier (driver privacy notice, DPIA, technical note on the device) is the same kit used for company-owned vehicles, adapted to the specific roles.
How do I limit GPS data visibility to contracted service hours only?
The GDPR’s minimization principle and the Italian DPA’s rulings require that tracking is not active when it is unnecessary for the stated purpose. In practice, a properly configured fleet management system lets you filter data visibility by time windows: the shipper sees the vehicle’s position only during the contracted delivery windows, not during the rest of the day. This is particularly relevant for third-party vehicles, where the driver uses the same vehicle for other clients or personal use. The time-window filter satisfies the DPA’s “off-duty deactivation” requirement without requiring the driver to physically interact with the device.
This article is for information only and does not constitute legal advice. For your specific situation, check with a trusted labour or legal advisor.
The next step
Want a fleet management system built with access profiles and proportionate data collection? OptivoTrack also includes a compliance dossier: driver privacy notice, DPIA, technical note on the tracking device and support through the Labour Inspectorate authorization process — for both company-owned and third-party fleets.
Discover OptivoTrack or book a demo.