This is a plain-English summary of the Information Commissioner's Office (ICO) guidance, not legal advice. Read the ICO's monitoring workers guidance and take advice if you're unsure.
In short
- Have a clear reason and write it down, with a data protection impact assessment.
- Tell drivers in writing before tracking starts. Use the template letter below.
- Stay out of private lives. Don't look at personal journeys without a good reason.
Location data about a driver is personal data
When a vehicle is linked to a driver, where it goes and how it's driven is information about that person. UK GDPR and the Data Protection Act 2018 apply, and your business is responsible for how it uses that information.
Before you switch it on
- Write down why you're tracking. For example: knowing where vehicles are to send the nearest one to a job, recovering stolen vehicles, keeping vehicles maintained, or meeting insurance requirements.
- Choose your lawful basis. For most small businesses this is legitimate interests: you have a genuine business need, and tracking is a reasonable way to meet it.
- Carry out a data protection impact assessment (DPIA). The ICO treats vehicle monitoring as high risk and expects a DPIA. It's a written check of what you collect, why, the risks to drivers, and how you'll limit them. The ICO publishes a template.
- Tell your drivers, in writing, before tracking starts. The ICO says you must tell workers and passengers about any vehicle monitoring. There's a template letter below.
- Decide who can see what. In Keyring Live, drivers only see their own trips. Limit manager access to the people who need it.
Personal use of work vehicles
The ICO says you'll rarely be able to justify monitoring a vehicle while it's being used privately.
Keyring Live records every journey, and doesn't yet have a way for drivers to pause tracking for personal trips. It's best suited to vehicles used for work. If drivers take vehicles home, tell them that journeys outside working hours are recorded and agree when, if ever, anyone will look at them, for example only if a vehicle is reported stolen. Include this in your DPIA.
Driving behaviour
Speeding and harsh driving alerts tell you more about a person than location alone, so the ICO expects a stronger justification for them. Common reasons are road safety, insurance and fuel costs. Explain in your policy how you'll use this information, and talk to a driver before taking any action based on it.
Drivers' rights
- Drivers can ask for a copy of the information you hold about them (a subject access request). You'll usually need to respond within one month.
- They can object to tracking based on legitimate interests. You'll need to consider their objection.
- Keep information only as long as you need it, and say how long that is in your policy.
Template letter for drivers
Adapt this to your business and give a copy to each driver before tracking starts.
Dear [name],
From [date], the vehicles listed below will have a Keyring Live tracker fitted. This letter explains what it records and why.
What is recorded: the vehicle's location, speed and route while it is being driven, when the ignition is on and off, driving events such as speeding and harsh braking, and information from the vehicle such as its mileage and battery condition.
Why we record it: [for example: to send the nearest vehicle to jobs, to keep vehicles maintained, to recover vehicles if stolen, and to keep our drivers and other road users safe].
Who can see it: [names or roles]. You can sign in to Keyring Live to see your own trips.
Personal use: [for example: vehicles are for business use only / journeys outside working hours are recorded but will only be viewed if the vehicle is reported stolen].
How long we keep it: [period].
You have the right to ask for a copy of this information and to object to how we use it. If you have any questions, please speak to [name].
[Signature]
Last reviewed October 2026.