Organising a mobile team does not automatically require all-day live location sharing. The GDPR requires you to tailor monitoring to your specific need.
Why does the GDPR also cover live location data?
Even live viewing without storage is processing personal data if you can link the location to an identifiable employee. Choose deliberately between a status update, a one-off location and continuous location data.
When can location monitoring be justified?
For a private employer, legitimate interests, Article 6(1)(f) GDPR, may provide a lawful basis. You must answer three questions beforehand:
- What interest? Identify your specific need: urgent jobs, a demonstrable safety risk or performance monitoring. Mere curiosity is insufficient.
- Is location necessary? Compare it with scheduling, phone calls or records for each job.
- Does your interest outweigh the impact? Assess frequency, accuracy, duration, access and protection of private moments.
Document the balancing assessment. Restricting monitoring to working hours is insufficient; there is no universally permitted checking frequency.
Why is consent usually not the answer?
The EDPB explains that employees often cannot freely refuse. Consent is therefore usually unsuitable for monitoring. Starting location sharing themselves does not prove a free choice; signing to acknowledge receipt of your policy is not consent.
Why are personal phones and chat apps especially sensitive?
A personal phone also accompanies its owner during private moments. The Belgian Data Protection Authority (GBA/APD) therefore warns about geolocation on personal devices.
A staff group may give unnecessary recipients access. According to the WhatsApp Help Center, recipients can also still view the last updated location through the message after sharing stops. This is not a complete route history, but stopping does not erase all information.
Preferably provide a work device or an alternative without a personal phone. A work phone or professional app does not make excessive monitoring lawful either.
What can we learn from decisions of the Belgian Data Protection Authority?
In decision 61/2025 of 25 March 2025, the authority accepted legitimate interests for certain processing of field technicians’ location data. The necessary data and limited access during actual working hours were relevant factors. Nevertheless, it found infringements: the actual monitoring of work had not been adequately announced, and the information about processing was insufficient.
The authority also criticised continuous recording by the supplier. It did not find an infringement on that point because it lacked sufficient information about the actual recording. You must therefore limit both collection and consultation. Merely promising not to look continuously is insufficient.
In decision 15/2023 of 21 February 2023, the authority highlighted professional journeys during working hours, necessary data, limited access and consultation for a specific reason. That case concerned municipal vehicles and a possible public-interest lawful basis. A private employer cannot simply adopt that basis.
Both cases concerned vehicles. They do not provide blanket approval for live tracking through personal phones. The authority’s general guidance considers permanent monitoring with systematic consultation disproportionate in principle.
What less intrusive alternatives can you consider?
Start with the information you need for your actual purpose:
| You want to know | Consider first |
|---|---|
| Has a job started or finished? | An arrival and completion notification with the job number. |
| How much time was spent on a job? | A start and end record, with a way to explain errors. |
| Who can take an urgent job? | Availability, the work schedule and, if needed, a one-off current location. |
| How can you protect someone working alone? | An agreed check-in or alarm function; location sharing only to the extent required by the specific risk. |
These alternatives must also be necessary. Prevent an arrival notification from silently activating continuous background recording.
How do you introduce a proportionate approach?
1. Describe the purpose and use. Specify whether you use data for planning, invoicing, safety or performance monitoring. Do not call it only “planning” if you also use it to check working hours. A different use later requires a fresh assessment and prior information.
2. Limit recording through technical settings. Choose the necessary times and accuracy. Prevent tracking of breaks, private journeys and periods outside the relevant work. Also test what the supplier collects in the background. Allowing employees to switch tracking off helps; do not make them solely responsible for correct settings.
3. Restrict access and secure the data. Identify who needs the information for their role. Use individual accounts, secure access and prevent unnecessary sharing in group chats. Assess the supplier and enter into a data processing agreement where required.
4. Set specific retention periods. Do not automatically keep a current location as long as time records. There is no universal retention period for all location data. Define deletion times for each purpose, cover copies and backups, and check implementation. A specific dispute may justify keeping relevant data, not an unlimited archive of every journey.
5. Inform and consult in advance. Explain clearly who is responsible, what you collect, why, the lawful basis, who gets access, how long you retain it and employees’ rights. Mention any transfers outside the EEA and the associated safeguards. Follow applicable national rules on employee consultation and workplace regulations. A general statement that “GPS monitoring is possible” is insufficient.
6. Handle questions and objections. Where you rely on legitimate interests, employees may object on grounds relating to their particular situation. Assess each case under Article 21 GDPR. You must stop processing unless you can demonstrate the required compelling legitimate grounds or necessity for legal claims. Also provide a way to correct inaccurate data.
7. Document and review. Include the ongoing processing in your record of processing activities. Before starting, assess whether a DPIA is mandatory. It is required when processing is likely to result in a high risk or appears on a mandatory list. The Belgian list includes systematic processing of location data that is not strictly necessary for a service requested by the data subject. If your system falls within this category, carry out a DPIA beforehand, even for a small team. After introduction, check whether the data is still needed and whether switching off and deletion work.
What if attendance recording is required by law?
Check exactly what the law requires you to record. In Belgium, Check In and Out at Work may apply to certain cleaning activities, including window cleaning, depending on the applicable conditions and thresholds. The records cover the start, end and rest breaks. Such an obligation does not, by itself, justify continuous live monitoring by the employer.
What if everyone already shares their live location all day?
Suspend any unjustifiable blanket instruction. Identify recipients and stored data, and determine what you must lawfully retain or delete. Complete the assessment, settings and staff information before introducing a more limited approach.
What should you capture in your GDPRWise dossier?
If you use employees’ location data, add the staff process Employee geolocation during working hours under My Staff Dossier → Processes, using More processes… if needed. Follow the staff processes screen help.
- General: align the description and purpose with your own company’s process and purpose, such as a one-off location for an urgent call-out. Check the lawful basis; document your balancing assessment for legitimate interests. If our standard geolocation process card needs too many changes, create your own process via More processes….
- Data items: select only necessary data, such as employee identification, location and timestamp. Remove unnecessary suggestions and click Confirm Data items. Ensure the record matches the actual processing.
- Arrangements: edit the process and use the Add note feature to capture the arrangements made: your assessment of tools and measures, the frequency, who has access and any other arrangements that support the privacy of your staff, such as accuracy, retention and switching off during private moments. Configure the location app accordingly too.
- Systems and documents: list the app under Systems and check the staff register and staff privacy statement under GDPR Documents. Adding the process does not replace the necessity assessment or any required DPIA.
Use GDPRWise to identify your privacy obligations and discover which arrangements and documents your organisation needs.