If your company tracks vehicles or field employees, you’re collecting personal data, and India’s DPDP Act changes what’s expected of you. This guide is written for HR heads, legal teams and enterprise buyers who need to know what applies, who owns what and what to ask vendors, whether you use field employee tracking software or a vehicle tracker.
Here’s a scene that’s about to become common. A legal team asks HR how long field employees’ location data is kept. HR says it’s with operations. Operations says it’s with the GPS vendor. The vendor’s contract doesn’t say.
Under the DPDP Act, “we’re not sure” is a harder answer to give. Let’s go through what’s changing, and what each team should do.
Who This Guide Is For
- HR heads decide how employees are tracked, what they’re told and what happens to their data.
- Legal and compliance teams decide on legal basis, notices, contracts and breach response.
- Enterprise buyers and procurement decide which vendors handle this data on the company’s behalf.
Most of the risk sits in the gaps between these three teams. That’s why the guide covers all of them.
The Dates That Matter
The DPDP Rules, 2025, were notified in November 2025 and are being brought in step by step.
| When | What happens |
| 13 Nov 2025 | Rules notified. Provisions such as those on the Data Protection Board come into force |
| Mid-Nov 2026 | Rule 4 on consent managers begins (one year from notification) |
| Mid-May 2027 | Core obligations begin: notice, security safeguards, breach reporting, data principal rights and more (18 months from notification; reported as 13 or 14 May) |
Until the main obligations start, existing laws such as the IT Act and SPDI Rules continue to apply. Always confirm dates against the latest official notification.
Why GPS Tracking Data Is Personal Data
Location data can look anonymous. It usually isn’t.
- A vehicle’s location is linked to a driver.
- A field employee’s phone location is linked to a named person.
- Attendance records can include a face scan or photo.
- School bus tracking involves the location of children.
Once data can be linked to an identifiable individual, it’s personal data, and you’re a “data fiduciary” responsible for it.
What the Rules Ask For, in Plain Words
| Area | What it means for GPS tracking |
| Notice (Rule 3) | Tell people what you collect, why and how to exercise their rights, in clear, plain language and with an itemised description of the data |
| Security safeguards (Rule 6) | Use measures such as encryption or masking, access controls, backups and access logs. Logs and related data must be retained for a minimum of one year. Processor contracts must require equivalent safeguards |
| Breach reporting (Rule 7) | Inform affected people and the Data Protection Board without delay, with a detailed report to the Board within 72 hours |
| Children (Rule 10) | Verifiable parental consent for children’s data, with certain exemptions |
| Rights and grievances | A way for people to ask what you hold and to raise concerns |
These apply to personal data in general. Which ones apply to your tracking, and how, is a question for your legal team.
For HR Heads
Employee tracking is where HR and the law meet most directly.
Know where the legal basis comes from. According to legal commentary, the Act doesn’t prohibit workplace monitoring, and Section 7(i) recognises certain employment-related processing as a “legitimate use,” where consent isn’t necessarily required. But commentators also stress purpose, proportionality and transparency, and whether a given type of tracking falls within it is a legal question.
Practical steps:
- Define when tracking is on. Working hours, check-in to check-out. Not evenings and weekends.
- Don’t track what you don’t need. If you need attendance and visit proof, you may not need continuous location.
- Treat biometrics with extra care. Face-recognition attendance involves sensitive data. Be clear on why it’s needed and how it’s stored.
- Explain it in plain language. What’s collected, why, who sees it, how long it’s kept.
- Give people a route to raise concerns. A named contact builds trust.
- Train managers. Most misuse happens when someone with access looks at data they don’t need.
An honest note: transparency isn’t only a legal matter. Teams accept tracking far more easily when they understand it.
For Legal Teams
Map your legal basis. For each type of tracking data, decide whether you rely on consent, a legitimate use or something else, and document why.
Draft the notice. It needs to be understandable, itemised and clear about purpose. Treat it as a working document, not a one-time policy.
Review the vendor contract. If a GPS vendor processes personal data for you, the contract matters. At minimum, it should cover:
- Security safeguards the vendor must maintain
- Breach notification to you, with timelines that let you meet your own deadlines
- Log retention
- Use of sub-processors
- Return or deletion of data at the end
- Audit or assurance rights
- Where data is stored
Prepare a breach protocol. Rule 7’s timelines are tight. Decide in advance who investigates, who informs the Board and how affected people are told.
Set retention rules. Decide how long each category of data is kept, and make sure that’s consistent with the one-year log retention in Rule 6 and with any other law that applies.
Check cross-border storage. If your vendor stores or processes data outside India, have your lawyers check what applies.
For Enterprise Buyers
When you buy GPS tracking, you’re also choosing a data processor. Add these to your evaluation:
- Where is our data stored, and who can access it?
- How is it protected (encryption, access controls, logs)?
- Can we set roles and limit who sees what?
- Can we set retention periods and delete data?
- How will we be told about a breach, and how fast?
- Can we export or delete data if we leave?
- Does the contract reflect the Rule 6 safeguards?
- Does the product support the notices and processes we’ll need?
If the answers are vague, treat that as a finding. For a wider checklist, see our guide to choosing a GPS tracking system for your business and our post on the cybersecurity risks in fleet tracking systems.
Who Owns What
| Team | Owns |
| HR | Tracking policy, employee communication, grievance route |
| Legal | Legal basis, notices, contracts, breach protocol |
| IT and security | Access controls, encryption, logs, incident response |
| Operations and fleet | Day-to-day use, who has access, hours of tracking |
| Procurement | Vendor due diligence and contract terms |
If a task has no owner, it won’t get done. Name one person per row.
Tracking Children: School Bus Fleets
Children’s data gets extra attention. The Rules require verifiable consent from a parent or guardian for processing children’s data, with certain exemptions that may cover some education and safety-related uses.
Whether and how those exemptions apply to your school bus tracking system is a question for your lawyer. Don’t assume.
A Six-Month Plan Before May 2027
| When | What to do |
| Oct–Nov 2026 | Map all tracking data and name an owner for each team |
| Dec 2026 | Decide purpose, legal basis and tracking hours with legal advice |
| Jan–Feb 2027 | Draft notices, policies and the breach protocol |
| Mar 2027 | Review vendor contracts, access settings and retention |
| Apr 2027 | Train managers and brief employees |
| May 2027 | Final check before obligations begin |
Common Mistakes to Avoid
- Assuming a consent clause in the employment contract covers everything
- Tracking 24/7 when working hours are enough
- Keeping all location data forever, with no retention rule
- Giving every manager full access
- Skipping vendor contract review
- Nobody owning the breach response
- Starting in April 2027
How SAHAJ GPS Fits In
Sahaj GPS provides GPS tracking solutions for fleets, field teams, school buses and indoor operations across India. According to its website, data collected through the platform is protected with advanced encryption, and its vehicle tracking system uses encrypted servers and role-based access. Its field employee tracking includes features such as digital attendance with facial recognition and location validation, geo-fencing and automated reports.
One honest note: no tool makes a company compliant on its own. Compliance depends on how data is used, what people are told and what’s in the contract. For specifics such as retention settings, data location and breach handling, ask the team in writing as part of your vendor review. We’ve also covered related ground in our guide to field employee tracking data security.
Frequently Asked Questions
Does the DPDP Act ban GPS tracking of employees or vehicles?
No. According to legal commentary, it doesn’t prohibit workplace monitoring, but tracking should be purposeful, proportionate and transparent.
When do the main DPDP obligations apply?
Most substantive obligations, such as notice, security safeguards and breach reporting, apply from mid-May 2027. Some provisions are already in force.
Do we need employee consent for GPS tracking?
It depends. Section 7(i) recognises certain employment-related processing as a legitimate use. Whether your tracking falls within it is a legal question.
What should be in a contract with a GPS vendor?
Security safeguards, breach notification timelines, log retention, sub-processor rules, return or deletion of data, audit rights and data location.
How long must logs be kept?
The Rules require logs and related data to be retained for a minimum of one year for detecting and investigating breaches, unless another law requires longer.
What should we do first?
Map the data you collect, name an owner in each team, and review who can see it and how long you keep it.
Final Thoughts
The DPDP Act doesn’t make GPS tracking harder. It makes careless tracking riskier. Decide what you need, tell people what you track, put it in the contract and give each task an owner.
If you’d like to talk through how a tracking setup works today, talk to the SAHAJ GPS team for a demo.