GPS tracking of fleet vehicles generates personal data about the employees who drive those vehicles location data, speed data, driving behaviour event records, and in some configurations, facial image data from driver-facing dashcams. UAE’s personal data protection framework, the UAE Federal Decree Law No. 45 of 2021 on the Protection of Personal Data (PDPL), establishes requirements for how employers collect, use, store, and secure this data. For fleet operators, the PDPL intersects with the operational and compliance value of GPS tracking in ways that require practical understanding rather than either ignoring the privacy dimension or treating it as a reason to avoid GPS monitoring.
The practical position for UAE fleet operators is: GPS tracking of company vehicles is legal, mandatory for most commercial vehicle categories, and operationally essential and it can be conducted in full compliance with UAE data privacy requirements through appropriate disclosure, data governance, and technical access controls. This guide explains what UAE law requires, what drivers must be told, how GPS data should be stored and accessed, and what fleet data privacy practices protect both the operator and the driver.
Key Takeaways
- GPS tracking of company vehicles in UAE is legal and for Abu Dhabi commercial vehicles, ADNOC contractor vehicles, Dubai rental cars and school buses legally mandatory under Asateel, IVMS, and SecurePath compliance programmes. Employers do not need driver consent to track company vehicles.
- UAE’s Personal Data Protection Law (PDPL, Federal Decree Law No. 45 of 2021) requires that employees are informed when their location and behaviour data is collected through GPS monitoring. Disclosure must be made in employment contracts, fleet policy documents, or specific monitoring notices not assumed from general employment.
- GPS data use must be proportionate and limited to legitimate operational purposes: route management, safety monitoring, compliance reporting, and vehicle security. Using GPS data for non-operational purposes personal surveillance of employees outside working hours, sharing GPS data with third parties without justification is not permitted under the PDPL proportionality principle.
- Data retention and security are mandatory PDPL requirements: GPS tracking data must not be retained longer than necessary for the operational or compliance purpose it was collected for, and must be stored securely with access restricted to authorised personnel. VZone International’s Wialon platform implements role-based access control, data encryption, and configurable retention periods as standard.
- Driver transparency and proportionate monitoring build the operational culture that makes GPS tracking most effective drivers who understand what is monitored, why it is monitored, and how the data will be used engage more constructively with coaching programmes than those who discover monitoring after deployment.
Section 1 UAE Legal Framework for GPS Fleet Tracking
UAE PDPL Federal Decree Law No. 45 of 2021
The UAE Personal Data Protection Law (PDPL), Federal Decree Law No. 45 of 2021, is the primary UAE legislation governing the collection, processing, storage, and transfer of personal data including the location and behaviour data generated by GPS fleet tracking. The PDPL came into effect in January 2023 and applies to all organisations processing personal data of individuals in the UAE, including UAE-registered companies processing the data of their UAE-based employees.
GPS fleet tracking generates personal data under the PDPL’s definition because it creates records that identify or enable identification of individual people through their association with a tracked vehicle. A GPS position record linked to a specific vehicle that is assigned to a specific named driver is personal data of that driver. A driver behaviour scorecard is personal data. A dashcam image of a driver’s face is sensitive biometric personal data subject to additional PDPL requirements. Fleet operators processing this data must satisfy the PDPL’s core requirements: lawful basis for processing, transparency to data subjects, purpose limitation, proportionality, data security, and data retention limits.
UAE Labour Law Employment Monitoring Provisions
UAE Federal Decree Law No. 33 of 2021 (UAE Labour Law) does not specifically address GPS vehicle tracking but establishes the general framework for employer monitoring of employees in the performance of their duties. UAE employment law permits employers to monitor employee conduct during working hours and while using company assets including company vehicles provided the monitoring is disclosed to employees and is proportionate to the legitimate management objective. An employer who installs GPS tracking on company vehicles without any disclosure to drivers is not necessarily acting illegally under UAE labour law, but is exposed to employee relations disputes and potential PDPL disclosure violations.
UAE Compliance Programme Data Requirements
ITC Asateel, ADNOC IVMS, and RTA SecurePath requirements create a specific data privacy context unique to UAE fleet operations: these compliance programmes require GPS data to be transmitted to government portals meaning data that includes vehicle location, speed, and driver behaviour is shared with UAE government authorities as a mandatory legal requirement. Fleet operators subject to these programmes cannot refuse to share GPS data with ITC or ADNOC on privacy grounds; the disclosure requirement for this data sharing with government is already covered by the compliance programme’s public regulatory framework. However, the compliance data sharing does not extend permission to share GPS data with third parties unrelated to the compliance purpose.
Section 2 What Fleet Operators Must Do Under UAE PDPL
Disclose GPS Monitoring to Drivers
UAE PDPL transparency requirements mean that fleet operators must inform drivers that GPS tracking is in operation on company vehicles before monitoring begins. This disclosure does not require individual driver consent to track company vehicles the legal basis for processing is legitimate interests (operational management, safety, compliance) rather than consent, which means tracking can proceed without a driver agreeing to it. However, the driver must be informed that tracking is happening, what data is collected, and how it will be used.
The disclosure should be made in writing ideally in the employment contract, the fleet policy document that drivers sign at employment, or in a specific GPS monitoring notice issued at the time of device deployment. The disclosure should cover: that GPS tracking is active on all company vehicles; what data is recorded (location, speed, driving behaviour events, and if applicable, dashcam footage); who has access to the data (fleet manager, safety officer, direct supervisor); how the data will be used (route management, driver coaching, compliance reporting, incident investigation); and how long the data will be retained. VZone International provides driver communication materials in Arabic and English as part of the fleet deployment onboarding package.
Limit Data Use to Operational Purposes
PDPL purpose limitation requires that GPS data collected for fleet management purposes is used only for those purposes and not repurposed for uses unrelated to the original collection purpose. Operationally legitimate uses of fleet GPS data include: real-time vehicle monitoring for dispatch and route management; driver behaviour scoring and coaching; compliance reporting to ITC, ADNOC, and RTA; incident investigation; fuel cost management; maintenance scheduling; and insurance claims documentation. Uses that are not operationally justified and would require separate disclosure include: monitoring driver locations during non-working hours (after the employee has returned the vehicle to depot and left for the day); sharing GPS data with third parties for commercial purposes unrelated to fleet management; and using GPS data to track employees’ personal movements.
Establish Data Retention Policies
GPS tracking data must not be retained longer than necessary for the purpose it was collected for. For operational fleet management purposes route records, driver behaviour scores, fuel monitoring data a retention period of 12 to 24 months satisfies most operational and coaching purposes. For compliance reporting purposes Asateel, IVMS, OPAL data records the retention period should match the compliance programme’s document retention requirement, typically 12 to 36 months. For insurance claims evidence GPS records relevant to a specific incident data should be retained until the claim is fully settled, which may extend beyond the standard retention period. UAE law does not specify a single GPS data retention period; the principle is ‘no longer than necessary for the stated purpose’, applied per data category.
VZone International’s Wialon platform configures data retention periods per data category trip records, event data, dashcam footage, and compliance submission records each have configurable retention settings that fleet operators set during platform configuration. Dashcam footage, which typically has the shortest retention period appropriate for privacy (7 to 30 days for continuous footage; longer for footage captured in specific alert events), is configured separately from GPS position data.
Restrict Data Access to Authorised Personnel
GPS tracking data that identifies individual drivers is personal data access should be restricted to personnel with a legitimate operational need to see it. Role-based access control in the fleet management platform implements this requirement technically: fleet managers see all vehicles and all driver data; depot supervisors see vehicles and drivers in their depot; HR personnel may have limited access to aggregated safety scores without individual trip-level data; finance teams may have access to per-vehicle cost data without driver identity information.
Driver self-access to their own data their own safety scores, trip records, and event history is both a PDPL data subject right and an operationally advantageous coaching tool. Providing drivers with a read-only driver app view of their own data satisfies the PDPL’s data subject access right while enabling the continuous self-feedback loop that accelerates coaching programme results. Driver access to other drivers’ individual data is not appropriate and should not be enabled in the platform configuration.
Section 3 GPS Data Privacy in Practice: Fleet Policy Framework
| Policy Element | What It Must Cover | UAE PDPL Requirement | Recommended Implementation |
| Monitoring disclosure | Statement that GPS tracking is active on all company vehicles; what data is collected; who accesses it; how it is used | Mandatory PDPL transparency obligation | Include in employment contract and fleet policy document; issue specific GPS monitoring notice at device deployment |
| Legal basis for processing | Identification of the lawful basis under PDPL for collecting GPS data from drivers | Mandatory PDPL requires identified lawful basis | Legitimate interests (operational management, safety, compliance) no consent required; note Asateel/IVMS legal obligation as additional basis |
| Data use limitation | Explicit statement of permitted and excluded uses of GPS data | Mandatory PDPL purpose limitation principle | List operational uses permitted; explicitly exclude personal surveillance, third-party sharing for commercial purposes, monitoring outside working hours |
| Retention periods | How long each category of GPS data is retained before deletion | Mandatory PDPL data minimisation and storage limitation | Trip data: 12-24 months; dashcam continuous footage: 7-30 days; incident footage: until claim settled; compliance records: per programme requirement |
| Access controls | Which roles have access to which categories of GPS data | Mandatory PDPL data security obligation | Platform role-based access control; fleet manager, supervisor, safety officer, finance (limited) — document in data processing register |
| Driver data rights | Process for drivers to access their own GPS data, correct inaccuracies, or raise concerns | Mandatory PDPL data subject rights | Driver app provides self-access to own data; HR contact for corrections or complaints; response within 30 days per PDPL |
| Data security measures | Technical and organisational measures protecting GPS data from unauthorised access or loss | Mandatory PDPL data security obligation | VZone/Wialon platform encryption, access logging, UAE data residency; internal access restricted to authorised personnel |
| Third-party data sharing | Which third parties receive GPS data and on what basis | Mandatory for any third-party sharing PDPL controller-processor requirements | ITC Asateel, ADNOC IVMS, RTA SecurePath government portals (legal compliance basis); insurance claims (legitimate interests); VZone as data processor (documented processor agreement) |
Section 4 Specific Data Privacy Considerations for UAE Fleet Monitoring
Dashcam and Driver-Facing Camera Data
AI dashcam systems that include driver-facing infrared cameras monitoring eye closure, head position, phone use, and seatbelt status generate data that goes beyond vehicle location to include biometric-adjacent personal data (facial position, eye movement) about the driver. UAE PDPL treats biometric data as a sensitive data category requiring additional protection. For fleet operators deploying driver-facing dashcam systems, the disclosure requirements are more specific: drivers must be informed that the camera captures their image and facial position data, that AI analysis is applied to detect fatigue and distraction events, and how long captured footage is retained.
Dashcam footage retention should be differentiated: continuous footage (the rolling buffer that records everything) should be retained for the minimum period that satisfies the safety monitoring purpose typically 7 to 14 days for operational fleets, overwritten automatically when the buffer is full. Footage captured in specific alert events (fatigue detection alert, harsh event, accident) should be retained for the duration of any investigation or claim resulting from the event. This differentiated retention approach minimises privacy exposure from continuous footage while preserving the evidence value of event-captured footage for legitimate safety and insurance purposes.
After-Hours Vehicle Monitoring
Monitoring a company vehicle’s location after the driver has completed their shift and parked the vehicle at the depot is operationally justifiable for security purposes after-hours geofence alerts detect theft attempts and unauthorised vehicle use. Monitoring a company vehicle during a period when the driver has taken the vehicle home (either as a perk or because depot return is not required) creates a more complex privacy situation, because the vehicle’s location during the driver’s private time may reveal information about the driver’s personal activities.
The recommended approach for after-hours monitoring of vehicles taken home by drivers is: configure geofencing and movement alerts that activate only outside the driver’s working hours (monitoring the vehicle, not the driver’s movements for personal purposes); disclose explicitly in the fleet policy that after-hours vehicle location is monitored for security purposes; and avoid using after-hours vehicle location data for any purpose other than security monitoring and incident investigation. A driver who uses a company vehicle to visit a medical facility or family member during a personal evening should not have that location associated with their employment record through GPS tracking data reviewed by their manager.
Cross-Border Data Transfers
GPS tracking data transmitted to the Asateel portal (ITC Abu Dhabi), ADNOC IVMS systems, and RTA SecurePath portal is shared with UAE government authorities a transfer that is lawful as the legal basis is compliance with UAE law. GPS tracking data processed by VZone International’s Wialon platform, hosted on servers with UAE data residency as the primary location, satisfies the PDPL’s data localisation considerations for UAE-resident data. For UAE fleets operating in GCC countries (Oman OPAL compliance, Saudi Arabia operations), data transmitted to Oman or Saudi government portals is a cross-border data transfer the PDPL permits such transfers where the destination country has adequate data protection standards or where the transfer is required by an international agreement or law.
Section 5 Communicating GPS Monitoring to Drivers Effectively
The effectiveness of a driver coaching programme built on GPS data depends partly on how well drivers understand and accept the monitoring. Drivers who receive adequate disclosure and understand the purpose of GPS monitoring safety improvement, fuel efficiency, compliance engage more constructively with coaching conversations than those who experience monitoring as surveillance imposed without explanation.
An effective driver communication approach for GPS monitoring covers: the operational rationale (why the company uses GPS tracking compliance requirements, safety improvement, operational efficiency); what data is monitored (location, speed, driving behaviour events, dashcam where applicable); how drivers can access their own data (driver app or HR request); how coaching works (weekly scorecard, specific event feedback, not punitive surveillance); and what positive outcomes are associated with strong safety scores (recognition, coaching conversation focus, potential insurance benefit sharing). This communication should be delivered in person before deployment, not sent as a PDF attachment to an email that drivers will not read before questions arise.
VZone International GPS Fleet Tracking with UAE PDPL-Compliant Data Governance
VZone International’s fleet management platform includes role-based access control, configurable data retention periods, driver self-access through the driver app, encrypted data storage, and UAE-based data processing supporting UAE fleet operators in meeting PDPL requirements alongside Asateel, IVMS, and SecurePath compliance. Contact our team for a fleet data privacy consultation alongside your fleet GPS deployment.
Frequently Asked Questions
Yes GPS tracking of employees while they are operating company vehicles during working hours is legal in UAE and, for most commercial vehicle categories, is legally mandated by compliance programmes including ITC Asateel (all Abu Dhabi commercial vehicles) and ADNOC IVMS (contractor vehicles). Employers do not need individual employee consent to track company vehicles the legal basis for processing is legitimate interests (operational management, safety, compliance) combined with the mandatory legal obligation created by applicable compliance programmes. The requirement under UAE PDPL is disclosure employees must be informed that GPS monitoring is in operation not consent. Fleet policy documentation and employment contracts are the appropriate disclosure vehicles.
Under UAE PDPL transparency requirements, drivers must be told: that GPS tracking is active on company vehicles they operate; what specific data is collected (location, speed, driving behaviour events, dashcam footage if applicable); who in the organisation has access to their data; how the data will be used (route management, coaching, compliance reporting, incident investigation); how long their data will be retained before deletion; and how they can access their own data or raise concerns. This disclosure should be made in writing in the employment contract, the fleet policy document, or a specific GPS monitoring notice and should be provided before monitoring begins, not discovered by drivers after deployment. VZone International provides Arabic and English disclosure templates as part of the fleet deployment onboarding package.
UAE PDPL requires that personal data including GPS location and driver behaviour data is not retained longer than necessary for the purpose it was collected for. For standard operational fleet management data, a retention period of 12 to 24 months satisfies most purposes. For compliance programme data (Asateel, IVMS, OPAL records), retention should match the compliance programme's document retention requirement typically 12 to 36 months. For incident-related GPS data (footage and records relevant to an accident, insurance claim, or investigation), retain until the matter is fully resolved. Dashcam continuous footage should be retained for 7 to 30 days before automatic overwrite the minimum period that satisfies the safety monitoring purpose without accumulating unnecessary biometric-adjacent data. Configure retention periods explicitly in the fleet management platform and document them in the organisation's data processing register.
Yes UAE PDPL grants individuals the right to access personal data held about them, including GPS tracking data. A driver has the right to request a copy of their GPS location records, driving behaviour event history, and safety scorecard data from their employer. Fleet operators must be able to fulfil this request within 30 days of receipt under PDPL timelines. For operational efficiency, providing drivers with self-service access to their own data through a driver mobile app showing their own trip history, event records, and safety scores satisfies the access right continuously without requiring manual data extraction for individual requests. Driver access to their own data should be limited to their own records; they should not be able to view other drivers' data through the same access.
