You've picked a field staff tracking app. The demo went well, the price works, and your operations head is keen. Then someone in HR asks the question that stops the meeting: “Are we actually allowed to do this?”
In most countries, yes. Employers can generally track employees' location with GPS during working hours, for a legitimate business purpose, when employees have been clearly told about it. What's risky is tracking outside working hours, tracking secretly, or collecting more location data than the job needs. Specific rules vary by country and sometimes by state or province.
A quick note before we start:
This guide is general information to help you ask the right questions. It isn't legal advice. Employment and privacy laws change and differ by location, so confirm your setup with a qualified local adviser before rollout.
The 4 Principles That Apply Almost Everywhere
Here's the good news.
Although the laws differ, they keep coming back to the same four ideas. Get these right and you're most of the way there in almost any country.
The principles
- 1Purpose: track for a clear business reason, such as verifying attendance, proving client visits, staff safety or accurate travel claims.
- 2Transparency: tell employees what is tracked, when, why, and who can see it. Secret tracking is where most legal trouble starts.
- 3Proportionality: collect only what the job needs. Tracking during shifts is usually reasonable; tracking evenings and weekends usually isn't.
- 4Security: protect the location data, limit who can access it, and don't keep it longer than you need.
European Union and United Kingdom
Location data about employees is personal data, so the GDPR (and the UK GDPR) applies. Employers need a lawful basis, which for work-time tracking is usually legitimate interests rather than consent.
Why not just ask for consent?
Regulators generally view employee consent as unreliable, because employees may not feel free to say no to their employer. Instead, you weigh your business need against the employee's privacy and document that assessment.
What regulators expect in practice:
- 1A clear privacy notice explaining the tracking before it starts.
- 2A data protection impact assessment (DPIA), which is commonly expected for systematic employee monitoring.
- 3No tracking outside working hours, and an easy way to see when tracking is on.
- 4In some countries, such as Germany, involving the works council before introducing monitoring tools.
United States
There's no single federal law that bans employee GPS tracking. Tracking work-time location on company-owned devices or vehicles is broadly permitted. The detail is in state law.
A few states stand out:
- 1New York requires employers to give prior written notice of electronic monitoring and get employees to acknowledge it.
- 2Connecticut and Delaware also require employers to notify employees about electronic monitoring.
- 3California's privacy law (CCPA, as amended by the CPRA) gives employees rights over their personal information, including notice of what is collected. California law also restricts attaching tracking devices to vehicles without the owner's consent.
The safe habit:
Give written notice and collect an acknowledgement everywhere, even in states that don't require it. It costs nothing and removes most of the risk.
Canada
Privacy laws such as PIPEDA, along with provincial laws, expect monitoring to be reasonable and for a legitimate purpose. In Ontario, employers with 25 or more employees must have a written electronic monitoring policy that explains how and why employees are monitored.
Australia
Rules vary by state. New South Wales, for example, has a workplace surveillance law that requires written notice before tracking surveillance begins (generally at least 14 days for existing employees), and expects tracking devices to be visible or clearly disclosed. The ACT has similar notice rules.
India
India doesn't have a law aimed specifically at employee monitoring. The main law is the Digital Personal Data Protection Act, 2023 (DPDP Act), which covers digital personal data, including an employee's location, photos and face data. The Act's rules were notified in November 2025, with most obligations phasing in over 18 months, to around May 2027.
Do you need employees' consent?
Usually not as the main legal basis. The Act lists "legitimate uses" where personal data can be processed without consent, and these include purposes of employment and protecting the employer from loss or liability. Verifying attendance, confirming site and client visits, and checking travel claims during working hours fit naturally there.
But "no consent needed" doesn't mean "no obligations".
What employers should still do under the DPDP Act
- 1Use the data only for the employment purpose you've defined, not for unrelated monitoring.
- 2Collect what that purpose needs: work-hours location, not round-the-clock tracking.
- 3Keep it accurate, especially where it affects pay, such as attendance and overtime.
- 4Protect it with reasonable security safeguards, and limit who can see it.
- 5Delete it once it's no longer needed for the purpose, and set a retention period.
- 6Have a way for employees to raise questions or complaints about their data.
- 7Have a plan to notify the Data Protection Board and affected employees if there's a data breach.
What about face attendance?
The DPDP Act doesn't create a separate "sensitive" category, so face data is treated as personal data like any other. In practice, treat it with extra care. Biometric data is classed as sensitive under the older IT Act rules on sensitive personal data, which remain relevant until the DPDP framework fully takes over. Store face data securely, use it only to verify attendance, and tell employees how it's used.
Why this matters now:
Penalties under the DPDP Act are significant. The highest, for failing to take reasonable security safeguards, can reach ₹250 crore. The 18-month window is time to prepare, not a grace period, and good practice is cheap: a written tracking policy, employee awareness, tracking only during working hours, limited access and a clear retention period.
A practical India checklist
- 1Write a short tracking policy in plain language, and in the local language your field staff read.
- 2Share it at joining and before rollout, and record each employee's acknowledgement.
- 3State the purpose: attendance, visit verification, travel claims and safety.
- 4Track only during shifts, and switch tracking off at punch-out.
- 5Restrict dashboard access by role, so a site supervisor sees their team, not the whole company.
- 6Set retention periods for location history and face data, and stick to them.
- 7Check that your tracking vendor stores data securely and supports deletion.
Personal Phones vs Company Phones
Most field teams, especially in India, use their own phones for work. That's workable in most countries, but it raises the stakes on proportionality: the phone goes home at night, so tracking must clearly stop when work does.
If staff use their own phones
- 1Make tracking tied to the shift: on at punch-in, off at punch-out.
- 2Collect only what the app needs for work. No contacts, messages or personal photos.
- 3Tell employees how to see when tracking is active.
- 4Offer a company phone to anyone who prefers to keep work and personal use separate.
Where Employers Get It Wrong
So where does it actually go wrong?
Rarely because of the tracking itself. Almost always because of how it's done.
Common mistakes
- 1Tracking around the clock instead of only during shifts.
- 2Installing tracking quietly and telling staff later, or never.
- 3Tracking personal phones without a clear policy or the employee's agreement.
- 4Letting too many people see location data, or keeping it forever.
- 5Using location data for something employees were never told about.
A Checklist for Tracking Field Staff the Right Way
Here's the playbook:
Before and during rollout
- 1Write down why you're tracking and what decisions the data will support.
- 2Write a short tracking policy: what's collected, when, who can see it, and how long it's kept.
- 3Share the policy before rollout and get each employee's written acknowledgement.
- 4Configure tracking to run only during shift hours.
- 5Limit dashboard access to the managers who need it.
- 6Set a data retention period and delete old location data on schedule.
- 7In the EU or UK, complete a DPIA and check whether a works council or employee representatives must be involved.
- 8Review the setup once a year, or whenever the law or your use of the data changes.
How Long Should You Keep Location Data?
Most privacy laws, including the GDPR and India's DPDP Act, say the same thing in different words: keep personal data only as long as you need it for the purpose you collected it for. Few set a fixed number of days for location history.
So work backwards from what the data is for.
A sensible way to set retention
- 1Attendance records that feed payroll: keep them as long as your payroll, tax and labour-law record-keeping rules require.
- 2Detailed route history: usually only until the month's travel claims and visit disputes are settled, plus a short buffer.
- 3Face data used for verification: only while the person is employed, then delete it.
- 4Data linked to an open dispute or investigation: keep until it's resolved.
Write the periods into your tracking policy, and check them with your adviser against local record-keeping rules.
How Bazat Tracker Helps You Stay Compliant
The right tool makes the right habits automatic.
Bazat Tracker tracks location only during assigned shift hours, so personal time stays private by default. Attendance is tied to work locations through geofencing, access is controlled by roles, and the HR document module lets you share a tracking policy and record each employee's acknowledgement in the same system.
Your legal obligations still depend on where you operate, but you start from a setup designed around the principles regulators care about.
The Bottom Line
Tracking field employees is legal in most places when it's transparent, limited to working hours, and tied to a real business need. Tell people, track only what you need, protect the data, and check the local rules. That's what keeps tracking on the right side of the law.
