Sole traders & SMEs
Data protection for
transport and logistics
Transport and logistics companies process driver data via GPS systems, tachographs and in-vehicle cameras, as well as delivery recipient data. Each of these processing activities carries its own obligations under the GDPR.
GPS
geolocation = personal data
1 year
tachograph data retention
Art. 28
GDPR — DPA with fleet platforms
24 h
personalised proposal
Sector challenges
General obligations for transport and logistics
Driver geolocation
GPS systems installed in vehicles that enable real-time tracking of a driver's location constitute personal data. The driver must be informed, and the use of geolocation outside working hours may be disproportionate.
Tachograph data
Driving times, speeds and stops recorded by the tachograph and linked to the driver are personal data subject to both the GDPR and transport regulations. They must be retained for the period required by sector-specific legislation.
In-vehicle video surveillance
Installing cameras in cabs or cargo areas requires informing the driver, justifying the purpose and limiting the retention period of recordings. Continuous monitoring without justification is disproportionate.
Recipient data
The recipient's name, address and contact details are the personal data of the consignor's customer. The transport company may act as a data processor in relation to the consignor or, depending on circumstances, as an independent data controller; the precise legal relationship should be analysed and regulated contractually.
Fleet management platforms and TMS
Transport management systems (TMS) and delivery-tracking applications that process driver and recipient data may act as data processors; the terms of each provider should be reviewed and a DPA formalised where appropriate.
Driver and employee data
Driving licences, ADR certificates, medical certificates for professional drivers, and occupational health and safety data generate employee data processing activities with their own specific obligations.
The service
What the service includes for your transport company
RoPA (Record of Processing Activities)
Tailored Record of Processing Activities: drivers, customers, recipients, geolocation and video surveillance.
Information clauses
Texts for drivers covering geolocation, tachograph data and in-vehicle cameras.
Privacy policy and legal notice
Documentation for the company's website.
Processing agreements
DPA with clients (consignors) and with fleet management platform and TMS providers.
Data breach protocol
Response procedure with notification within 72 hours.
Rights management
Procedure for requests from drivers, employees and recipients.
Document management platform
Access to a private platform with documents and electronic signature.
Ongoing support
Unlimited queries. Updates in response to regulatory changes.
External DPO (where applicable)
If your company falls within the cases set out in art. 37 GDPR or art. 34 LOPDGDD, it may be required to designate a DPO. The specific obligation depends on an individualised analysis of each case. Independent, bespoke contract.
Do you need a proposal for your transport company?
Tell us the size of your fleet and the type of service. Proposal within 24 hours.
FAQ
Frequently asked questions about data protection in transport and logistics
Is vehicle fleet geolocation personal data?
Yes. Vehicle geolocation that enables the real-time tracking of a driver's position and movements constitutes the driver's personal data. Its processing requires an appropriate legal basis (typically performance of the employment contract or the company's legitimate interest in fleet management) and the driver must be informed in advance and explicitly. Continuous monitoring outside working hours may be disproportionate.
Is tachograph data personal data?
Yes. Tachograph data (driving times, speeds, stops) linked to an identified driver constitutes personal data. Its processing is governed both by the GDPR and by road transport regulations. The company must inform drivers of the use of tachograph data and retain it for the period required by transport legislation (generally one year).
Is video surveillance in vehicles lawful?
It is possible to install cameras in transport vehicles, but only under strict conditions: a legitimate purpose must exist (road safety, cargo protection), drivers must be informed of the cameras and their purpose, and the data may not be used for other purposes. Continuous recording of the driver throughout the working day may be disproportionate if not duly justified.
Is delivery recipient data personal data?
Yes. The name, address, telephone number and email address of a delivery recipient are personal data. The transport company typically acts as a data processor on behalf of the consignor (the shop or company arranging the shipment). A Data Processing Agreement (DPA) must exist between the consignor and the transport company, and the recipient's data may only be used for the delivery and not for any other purpose.
How long may shipment data be retained?
Shipment data (consignor, recipient, address, parcel contents) must be retained for as long as necessary to manage the delivery and deal with any potential claims (generally one to two years) and for the fiscal retention period applicable to billing documentation (four years). Once these periods have elapsed, the data must be deleted or anonymised.
Do fleet management applications and GPS systems require a DPA?
As a general rule, yes. Fleet management platforms, GPS systems installed in vehicles, and delivery-tracking applications that process driver and recipient data may act as data processors. The precise legal relationship depends on each provider's terms and conditions; these should be reviewed and a DPA formalised where appropriate.
Free tool
Data protection self-check
Check in 5 minutes your overall adaptation level in personal data protection.
No email · Anonymous · No commitment
Transport & Logistics
GDPR compliance
for your transport company.
An expert analyses your operations and proposes the right solution. No intermediaries.
Proposal within 24 h · info@certix.es
Legal note: This content is for informational and educational purposes only; it does not constitute specialist legal advice. The application of the regulations to each specific case requires individual analysis.