Employee location tracking raises significant privacy considerations, including the legal basis for collecting location data, the extent of employee consent required, and how organisations communicate and limit their use of tracking systems. Privacy concerns centre on the tension between an employer’s legitimate duty of care and an employee’s right to personal privacy, particularly when tracking extends beyond working hours or into personal devices. The questions below address each of these considerations in practical terms.
What legal obligations apply to employee location tracking?
Employers who track employee locations are subject to data protection law, which in most jurisdictions requires a lawful basis for processing personal data, a clear purpose for collecting it, and limits on how long it is retained. In the UK and EU, the General Data Protection Regulation (GDPR) and its domestic equivalents are the primary frameworks. In the US, obligations vary by state, with some states imposing specific notice requirements for GPS tracking.
Under GDPR, location data is treated as personal data because it can identify an individual’s movements, routines, and associations. Employers must identify a lawful basis before any tracking begins. Common bases include legitimate interests, contractual necessity, or legal obligation. Legitimate interests must be balanced against employee rights, meaning tracking must be proportionate, limited to work purposes, and not overly intrusive.
Beyond data protection law, employers in many countries must also comply with employment law requirements around monitoring, which may include works council consultations in some European jurisdictions, or written notice obligations in specific US states such as California. Failing to meet these obligations exposes organisations to regulatory penalties, employment tribunal claims, and reputational damage.
Do employers need employee consent to track location?
Consent is not always required for employee location tracking, but it depends on the legal basis the employer relies on and the jurisdiction. Under GDPR, consent is only one of several lawful bases. Many employers instead rely on legitimate interests or contractual necessity, which do not require explicit consent but do require transparency and proportionality.
Where consent is used as the lawful basis, it must be freely given, specific, informed, and withdrawable without detriment. In an employment context, consent is often considered unreliable because the power imbalance between employer and employee means workers may not feel genuinely free to refuse. For this reason, many data protection authorities advise employers to rely on legitimate interests rather than consent wherever possible.
Regardless of the legal basis chosen, employers must still inform employees that tracking is taking place. Notification is a separate obligation from consent and applies universally. Tracking employees without any form of notice, even where consent is not formally required, is likely to breach transparency obligations and may be unlawful.
What data is actually collected during employee location tracking?
Employee location tracking systems typically collect GPS coordinates, timestamps, speed of travel, and route history. Depending on the system used, they may also capture geofence alerts when an employee enters or leaves a defined area, device identifiers, and communication metadata. Some platforms integrate location data with other operational feeds, such as check-in status or incident alerts.
The scope of data collected varies significantly between systems. Basic GPS tracking on a company vehicle records position and movement during working hours. More sophisticated platforms used in travel risk management can capture real-time location, silent SOS signals, and two-way communication logs. The more comprehensive the system, the greater the privacy implications and the more carefully the data collection must be scoped and justified.
Employers should map exactly what data their chosen system collects, not just what it is configured to display. Many tracking platforms collect more data at the infrastructure level than the user interface reveals. Understanding the full data footprint is essential for writing accurate privacy notices and for conducting data protection impact assessments where required.
How should employers communicate tracking policies to staff?
Employers should communicate tracking policies through a clear written policy that explains what is tracked, why it is tracked, how the data is used, who can access it, how long it is retained, and what rights employees have. This information must be provided before tracking begins, in plain language, and in a format employees can easily access and refer back to.
A tracking policy should cover the following points at minimum:
- The specific types of location data collected and the systems used to collect it
- The purpose of tracking, such as duty of care, operational coordination, or lone worker safety
- The hours during which tracking is active, and whether it applies outside working hours
- Who within the organisation can access location data and under what circumstances
- How long data is stored and when it is deleted
- The process for employees to raise concerns or access their own data
Policies should be introduced through direct communication, not buried in a staff handbook. Where tracking systems are new or represent a significant change, employers should brief managers separately so they can answer questions accurately. Ongoing transparency matters as much as initial disclosure. If the scope of tracking changes, employees must be informed before the change takes effect.
What are the risks of employee tracking done without proper safeguards?
Employee tracking without proper safeguards creates legal, operational, and cultural risks. Legally, organisations face regulatory enforcement action, fines under data protection law, and potential employment claims. Operationally, poorly governed tracking systems can expose sensitive location data to unauthorised access. Culturally, tracking perceived as surveillance damages trust, reduces morale, and can increase staff turnover.
Legal and regulatory exposure
Data protection authorities have taken enforcement action against employers who track staff without a clear lawful basis, without adequate notice, or who retain location data longer than necessary. The financial penalties under GDPR can be substantial, and enforcement is not limited to large organisations. Even small teams operating internationally can face scrutiny if their tracking practices do not meet the standards required in each jurisdiction where employees are based.
Security and operational risks
Location data is operationally sensitive. If a tracking system lacks adequate access controls, encryption, or audit logging, the data can be accessed by people who have no legitimate need for it. In high-risk operating environments, a breach of location data can have direct safety consequences for the individuals being tracked. Organisations must treat location data with the same security rigour applied to other sensitive personal data, which means ISO 27001-aligned controls, access restrictions, and regular security reviews.
How can organisations balance duty of care with employee privacy?
Organisations can balance duty of care with employee privacy by limiting tracking to what is operationally necessary, being transparent about how it works, giving employees meaningful control where possible, and using systems that are purpose-built for safety rather than general surveillance. The key principle is proportionality: tracking must be no more intrusive than the risk it is designed to address.
In practice, this means distinguishing between different tracking contexts. A lone worker in a remote environment or a staff member travelling through a high-risk region has a different risk profile than an office-based employee. Tracking intensity and scope should reflect that difference. Applying the same level of monitoring to all employees regardless of risk exposure is difficult to justify and likely to be viewed as disproportionate.
Employees are more likely to accept tracking when they understand it exists to protect them, not to monitor their performance or behaviour. Framing tracking as a safety measure, giving employees access to their own location data, and building in clear off-duty boundaries all contribute to a more balanced approach. Where tracking is voluntary, such as through an opt-in safety app, uptake tends to be higher when the purpose is clearly communicated and the system is easy to use.
How NGS supports responsible employee location tracking
NGS provides personnel tracking solutions designed specifically for organisations with duty of care obligations, combining real-time visibility with the privacy safeguards that responsible tracking requires. The Aurora platform underpins this capability, offering:
- Live GPS tracking and geofencing for personnel operating in high-risk or remote environments
- Silent SOS alerts and two-way communication for field staff who need discreet emergency access
- Satellite tracking for locations where standard mobile networks are unavailable
- 24/7 monitoring through NGS’s Global Operations Centre, with rapid response capability averaging 40 minutes or less in urban areas
- Compliance reporting to support duty of care documentation and ISO 31030 alignment
NGS works with organisations across government, defence, and corporate sectors to implement tracking that is proportionate, transparent, and operationally effective. If your organisation needs to improve personnel visibility without compromising privacy standards, speak with the NGS team to discuss a solution built around your specific requirements.
Related Articles
- How does location data improve incident response planning?
- How do you integrate a tracking app into existing security workflows?
- What is a travel security briefing and when should you use one?
- How do organisations protect employees sent to high-risk regions?
- How does political instability affect travel safety in a region?
