GDPR pack for fleet tracking

GDPR pack · for your team

In Denmark you may track company vehicles when the purpose is legitimate, the tracking is proportionate and your employees know about it in advance. These templates help you document exactly that.

Before the first trip

01
Decide the purpose
For example dispatch, the mileage logbook, theft protection or safety. Write it down, and collect only what that purpose needs.
02
Choose the legal basis
Usually your legitimate interest (GDPR article 6(1)(f)), weighed against your employees’ privacy.
03
Tell your employees in advance
Give them the written notice below. If your company is covered by the collective agreement on control measures, announce new measures at least six weeks before they start.
04
Assess the risk
Systematic location tracking of employees often requires a data protection impact assessment (GDPR article 35). Use the DPIA template below.
05
Set up MyFleets to match
In the MyFleets app, phones record only during a work shift the driver starts, with a private pause. Access follows roles. Retention follows your instructions.

Template A

Replace the text in brackets, then hand it out or put it in your staff handbook.

Information about GPS tracking and the electronic logbook

[Company name], CVR [number], is the data controller for the location data described here. Contact: [name, email, phone].

What we record

Position, time, speed and distance for [company vehicles / phones registered as vehicles]. With the MyFleets app, a phone records only during a work shift you start yourself, and you can pause for private matters.

Why

[Planning and dispatch / the mileage logbook / theft protection / safety]. We do not use location data to follow you outside working time.

Legal basis

Our legitimate interest in [the purpose] (GDPR article 6(1)(f)).

Who can see the data

[Roles, for example dispatch and management]. Our supplier CodifyAI S.R.L. (MyFleets) processes the data on our behalf under a data processing agreement, hosted in the EU.

How long we keep it

[Trip records used as accounting documentation: the period the accounting rules require. Raw positions: number of months].

Your rights

You may request access to, correction or erasure of your data, restrict or object to the processing, and complain to the Danish Data Protection Agency (Datatilsynet).

When it starts

Tracking starts on [date].

Template B

Answer each heading for your own company. Keep the result with your GDPR records and review it when something changes.

Data protection impact assessment: vehicle and phone location tracking

1. The processing

Which vehicles and phones, which employees, which data (position, time, speed, distance), when it is collected, and which system (MyFleets).

2. Purpose and legal basis

Each purpose, and the legal basis for it.

3. Necessity and proportionality

Why the purpose cannot be met with less intrusive means. How tracking is limited to working time (work shifts, private pause), who has access, and how long data is kept.

4. Risks to employees

For example monitoring outside working time, use of data for another purpose, unauthorised access, a data breach, or pressure on employees.

5. Measures

Role-based access, an audit trail, encryption in transit, hosting in the EU, a data processing agreement, deletion when the retention period ends, and written information to employees.

6. Conclusion

Remaining risk, whether it is acceptable, who was consulted (for example employee representatives), sign-off with name and date, and the next review date.

Privacy by design

Work shifts onlyIn the MyFleets app, a phone records only during a work shift the driver starts, and the driver can pause for private matters.
Encrypted on the phoneLocations waiting on the phone are stored encrypted until they sync.
Scoped by company and rolePeople see only their own company, and only what their role allows.
EU hosting, with a data processing agreementSub-processors are listed in the privacy notice.

These templates are a starting point, not legal advice. Adapt them to your company and check them with your adviser. See also the data processing agreement, the privacy notice and the guidance from Datatilsynet.

Track the fleet. Respect the people.

Five steps.

Decide the purpose

Choose the legal basis

Tell your employees in advance

Assess the risk

Set up MyFleets to match

Employee notice.