If you track vehicles or field employees, you’re collecting personal data, and India’s DPDP Act is about to change how you’re expected to handle it. This guide explains the key dates, what to review and how to prepare before May 2027. Whether you use field employee tracking software or a vehicle tracker, the questions are the same.
Please note: This article is general information, not legal advice. Your situation may differ, so please check it with a qualified lawyer.
A fleet manager opens the dashboard every morning. Locations, routes, stops, speeds. A sales manager checks where his team is working. An HR head looks at attendance records.
None of this felt like “data protection” before. Under the DPDP Act, it increasingly does.
The DPDP Act in Plain Words
The Digital Personal Data Protection Act, 2023 is India’s data protection law. It sets out how organisations (called “data fiduciaries”) must treat the personal data of individuals (called “data principals”). The DPDP Rules, 2025, notified in November 2025, explain how to put the Act into practice.
The Rules are being brought in step by step, so not everything applies today. Here’s the timeline as reported.
| Date | What happens |
| 13 Nov 2025 | Rules notified. Certain provisions, including those on the Data Protection Board, come into force |
| 13 Nov 2026 | Consent manager provisions (Rule 4) begin |
| Mid-May 2027 | Most obligations begin: notice, consent, security safeguards, breach reporting, data principal rights and retention. Reported as 13 May by the Gazette-based trackers and 14 May by some others |
Until the main obligations start, existing rules such as the IT Act and the SPDI Rules continue to apply. Always check the latest official notification, because dates are easy to misquote.
Why GPS Tracking Data Counts as Personal Data
Location data on its own may look anonymous. It usually isn’t.
- A vehicle’s location is linked to a driver.
- A field employee’s phone location is linked to a person.
- Attendance records may include a face scan or photo.
- School bus tracking involves the location of children.
Once data can be tied to an identifiable individual, it’s personal data. And personal data comes with responsibilities.
Does the DPDP Act Ban Employee GPS Tracking?
No. According to legal commentary, the Act doesn’t prohibit workplace monitoring. It does recognise certain employment-related processing, and processing to safeguard an employer from loss or liability, as a “legitimate use” under Section 7(i). In those cases, consent isn’t necessarily required.
But there are limits to how far you should lean on that.
- Commentators suggest the processing should be genuinely connected to the job and proportionate to the purpose.
- A broad consent clause buried in an employment contract doesn’t automatically solve privacy concerns.
- Tracking that goes beyond working hours, or follows movements unrelated to work, raises different concerns.
- Whether a particular type of monitoring falls within Section 7(i) is a legal question, and it may be debated.
The safe approach is simple: track what you genuinely need, for the hours you genuinely need it, and be open about it. That’s good practice whichever legal basis you use.
What Fleet Teams Should Do
If you run trucks, buses or delivery vehicles:
- Link data to people carefully. Know which data is tied to a named driver.
- Review driver behaviour monitoring and dashcams. Decide what’s recorded, why and for how long.
- Limit who can see location and driver data. Not everyone in the company needs access.
- Check vehicles used after hours. If drivers take vehicles home, define when tracking applies.
- Set a retention period. Don’t keep trip and driver data forever by default.
What Field Teams Should Do
If you manage sales reps, service engineers or survey staff:
- Be clear about when tracking is on. Working hours, check-in to check-out, not 24/7.
- Avoid tracking personal time. A work app shouldn’t follow someone to their home on a Sunday.
- Be careful with biometrics. If you use face recognition for attendance, treat that data with extra care.
- Explain it in plain language. What’s collected, why, who sees it and how long it’s kept.
- Give people a way to raise concerns. A named contact or grievance route builds trust.
A Practical DPDP Checklist for GPS Tracking
Use this as a starting point and add your lawyer’s advice.
- Map your data. List what you collect: locations, photos, attendance, phone numbers, driver details.
- Define the purpose for each type of data, in one clear sentence.
- Decide your legal basis (consent or legitimate use) with legal advice, not by assumption.
- Write a notice in plain language that explains the data, the purpose and how people can exercise their rights. Under the Rules, notices must be clear and understandable.
- Make withdrawal easy wherever you rely on consent. Withdrawing should be as easy as giving it.
- Limit tracking to working hours and work purposes.
- Control access. Use role-based permissions so people see only what they need.
- Secure the data. Use encryption, strong logins and access logs.
- Set retention and deletion rules. Decide how long each kind of data is kept.
- Prepare a breach response plan. Know who reports what, to whom, and how fast, as the Rules require.
- Review vendor contracts. Your GPS provider processes data on your behalf, so check what the contract says.
- Train managers. The biggest risks often come from how data is used day to day.
Tracking Children: A Special Case for School Bus Fleets
If you run school transport, children’s data gets extra attention. The Rules require verifiable consent from a parent or guardian for processing children’s data, with certain exemptions that may cover some education and safety-related uses.
Whether and how those exemptions apply to your school bus tracking system is a question for your lawyer. Don’t assume.
What to Ask Your GPS Provider
Your provider is part of your compliance picture. Ask:
- Where is our data stored, and who can access it?
- How is the data protected (encryption, access controls)?
- Can we set roles and limit who sees what?
- Can we set retention periods and delete data when needed?
- Are there audit logs of who accessed what?
- What happens if there is a data breach, and how will we be told?
- Can we export or delete data if we leave?
- Does the product support the notices and consent flows we’ll need?
A good provider will answer these clearly. If you get vague replies, treat that as information.
A Six-Month Plan Before May 2027
You have time, but not unlimited time. A sensible sequence:
| When | What to do |
| Oct–Nov 2026 | Map your tracking data and identify who is tracked |
| Dec 2026 | Decide purpose, legal basis and tracking hours with legal advice |
| Jan–Feb 2027 | Draft notices and update internal policies |
| Mar 2027 | Review your GPS provider and contracts, and fix access and retention settings |
| Apr 2027 | Train managers and brief employees |
| May 2027 | Final check before obligations begin |
Common Mistakes to Avoid
- Assuming “we have a consent clause” covers everything
- Tracking 24/7 when you only need working hours
- Keeping all location data forever
- Giving every manager full access
- Skipping the vendor review
- Leaving employees in the dark about what’s tracked
- Waiting until April 2027 to start
How SAHAJ GPS Fits In
SAHAJ GPS provides GPS tracking solutions for fleets, field teams, school buses and indoor operations across India. Its website states that data collected through the platform is protected with advanced encryption. Its vehicle tracking system and field employee tracking software include features like live location, geo-fencing, digital attendance with facial recognition and location validation, and automated reports.
One honest note: no tool makes you compliant on its own. Compliance depends on how you use the data, what you tell people and the policies you put in place. If you’re unsure how a feature fits your needs, ask the team directly. We’ve also covered related topics in our guides on field employee tracking data security and the cybersecurity risks in fleet tracking systems.
Frequently Asked Questions
Does the DPDP Act ban GPS tracking of employees or vehicles?
No. According to legal commentary, the Act doesn’t prohibit workplace monitoring, but you should keep tracking purposeful, proportionate and transparent.
When do the main DPDP obligations apply?
Most substantive obligations, such as notice, consent, security safeguards and breach reporting, apply from mid-May 2027. Some provisions are already in force.
Do I need employee consent for GPS tracking?
It depends. Section 7(i) recognises certain employment-related processing as a legitimate use, which may not require consent. Whether your tracking falls within it is a legal question.
Is vehicle GPS data personal data?
It can be. If location or driving data can be linked to an identifiable driver or employee, it’s likely to be treated as personal data.
What about school bus tracking?
Children’s data has stricter requirements, including verifiable parental consent, with certain exemptions. Check with a lawyer how they apply to your setup.
What should I do first?
Map the data you collect, define why you collect it, and review who can see it and how long you keep it.
Final Thoughts
The DPDP Act doesn’t make GPS tracking harder. It makes careless tracking riskier. Track what you need, tell people what you track, protect the data and delete it when you’re done.
If you’d like to talk through how your tracking setup works today, talk to the SAHAJ GPS team for a demo.