Fleet Tracking Regulations Explained: A Guide for Delivery Firms in Wales

Guide for Welsh delivery firms on lawful fleet tracking: UK GDPR obligations, DPIAs, tachograph downloads, retention and privacy limits.

Jurisdiction Scope

Wales (within the UK; the cited tachograph amendment regulations extend to England and Wales, Scotland and Northern Ireland)

Overview of Fleet Tracking Laws

Applicable Business Type

Delivery firms and goods-vehicle operators

Country or Region

United Kingdom

A Wales-focused compliance guide for delivery firms using vehicle tracking and, where applicable, tachographs. It covers UK GDPR requirements for monitoring drivers and vehicles, transparency and privacy safeguards, DPIAs, tachograph downloading and record production, and operational responsibilities for goods-vehicle operators.

Legal Requirements Summary

Welsh delivery firms may use fleet tracking, but tracking identifiable drivers is workplace monitoring and must comply with UK GDPR: it must have a documented lawful basis, be transparent, necessary and proportionate, and may require a DPIA. Driver consent is not normally the correct legal mechanism. Systems should not monitor private use excessively, and audio should normally be off. Goods vehicles subject to tachograph rules also require scheduled downloads, operator controls and records that can be produced for 12 months.

Main Regulatory Topics

UK GDPR and data privacy
Worker and vehicle monitoring
Lawful basis and transparency
DPIAs and data protection by design
Driver consent
Private-use and out-of-hours tracking
In-vehicle audio and surveillance
Tachograph installation, calibration and downloads
Record-keeping and enforcement production
Drivers’ hours compliance

Key Compliance Obligations

Identify and document a lawful basis for vehicle or worker monitoring.
Provide clear privacy information to drivers and passengers, including what is recorded, why, who controls the data, and how rights can be exercised.
Carry out a DPIA before high-risk monitoring and design tracking systems to be necessary, proportionate and privacy-preserving.
Avoid continuous tracking during private or non-working use unless specifically justified; provide an ability to deactivate monitoring where appropriate.
Keep vehicle surveillance audio disabled by default and use it only in exceptional, strongly justified circumstances.
For applicable goods vehicles, download vehicle-unit tachograph data at least every 90 days and driver-card data at least every 28 days.
Ensure tachographs are calibrated, inspected and maintained, train drivers, schedule work lawfully, and do not incentivise breaches through speed- or distance-related payments.
Retain tachograph records and be able to produce them to enforcement officers for 12 months.

Driver Consent Requirement

Consent Rule: Driver consent is not generally required as the legal basis for workplace tracking, and is usually inappropriate because of the employment power imbalance. The operator must instead identify and document an appropriate lawful basis, inform drivers clearly, and consult them where appropriate. Consent may be used only where drivers have a genuine, freely exercisable choice and can withdraw it without detriment.

Data Retention Period

Minimum Retention: 12 months for tachograph records that must be producible to enforcement officers

Enforcement Authorities

Information Commissioner’s Office (data protection and workplace monitoring)
Driver and Vehicle Standards Agency (DVSA)
Traffic Commissioners for Great Britain (operator licensing)
Welsh local authorities and police may also enforce relevant road-traffic requirements

Penalties for Non-Compliance

Non-compliant worker monitoring can lead to ICO regulatory action, complaints, required changes to processing and potential UK GDPR/Data Protection Act enforcement; the precise sanction depends on the facts. Tachograph and drivers’-hours breaches can lead to enforcement action, fines and operator or driver consequences, while serious or repeated safety failures can affect an operator licence and result in prohibitions or other DVSA action. Operating without a required goods vehicle operator licence is an offence and can put the operator’s licence and business operations at risk. Failure to provide statutory tachograph documents can attract a level-4 standard-scale fine under the Transport Act 1968. Do not advertise a fixed penalty amount without checking the specific offence and current DVSA/Traffic Commissioner policy.

Implementation Best Practices

Before deployment, complete a documented monitoring/data-protection assessment and explain the system to drivers. Configure geofencing, update frequency, driver identification, retention, access permissions and out-of-hours controls to collect only what delivery operations require. Keep a written policy covering purposes, lawful basis, disclosures, retention, complaints and data-subject rights; train managers not to use tracking for incompatible or excessive monitoring. Integrate telematics with tachograph and maintenance workflows, but do not treat ordinary GPS data as a substitute for legally required tachograph records. Audit configurations and access logs periodically, investigate anomalies, and preserve an inspection-ready evidence trail.

Compliance Checklist

Document the business purpose and lawful basis for GPS or in-vehicle monitoring; apply necessity, proportionality and data minimisation.
Give drivers and other affected people clear, accessible privacy information explaining what is collected, why, retention, access and their rights.
Limit tracking to working time where feasible; provide a private-use or out-of-hours mode where vehicles are available for personal use.
Control access to location histories, set and document a retention period, secure the data, and establish procedures for access, objection and other UK GDPR rights.
Check whether the fleet requires a goods vehicle operator licence: generally vehicles over 3.5 tonnes, and international hire-or-reward journeys using vehicles over 2.5 tonnes.
For vehicles within drivers’-hours rules, use an approved, correctly installed, calibrated and sealed tachograph; download vehicle-unit data at least every 90 days and driver-card data at least every 28 days, then analyse it.
Keep required tachograph records and ensure drivers deliver relevant records within the statutory period; retain roadworthiness inspection and repair records for at least 15 months.
Run documented daily walkaround checks, record defects and repairs, and make electronic maintenance records available for inspection.

Industry-Specific Guidance

A delivery firm operating in Wales is generally subject to the same UK-wide data-protection, drivers’-hours, roadworthiness and operator-licensing rules as firms elsewhere in Great Britain; Wales does not create a separate fleet-tracking regime. GPS can support dispatch, proof of delivery, route planning, theft recovery and safety, but continuous driver surveillance must be justified and proportionate. For ordinary UK-only vans between 2.5 and 3.5 tonnes, a tachograph is generally not required solely because the vehicle is tracked. The position changes for heavier vehicles, vehicles within drivers’-hours rules, and international hire-or-reward work. A Welsh courier crossing to the EU must check the applicable international operator-licensing and tachograph requirements, including the smart-tachograph rule for qualifying goods vehicles over 2.5 tonnes from 1 July 2026. Tracking customer addresses and delivery locations may also involve personal data, so access and retention should cover customer as well as driver information.

Recent Legal Updates

The key date for delivery fleets in this update is 1 July 2026: a full smart 2 tachograph must be fitted to goods vehicles over 2.5 tonnes used for international journeys for hire or reward, subject to the stated exceptions. GOV.UK guidance also says operators must download digital/smart tachograph vehicle-unit data every 90 days and driver-card data every 28 days. A March 2026 Traffic Commissioner update stresses regular tachograph review, risk assessment, anomaly investigation, and retention of tachograph records for at least 28 days—or 56 days for international journeys. UK GDPR and ICO monitoring principles remain technology-neutral, so there is no identified Wales-specific 2026 GPS-consent mandate in the cited official guidance.

Authoritative Resources

Information Commissioner’s Office (ICO): Data protection and monitoring workers
ICO: Surveillance in vehicles
GOV.UK: Drivers’ hours and tachographs—goods vehicles
GOV.UK: Goods vehicle operator licensing guide
GOV.UK/DVSA: Guide to maintaining roadworthiness