Is GPS Vehicle Tracking Allowed in Kenya?
GPS vehicle tracking can serve legitimate business purposes, including fleet security, dispatch coordination, route verification and vehicle utilization monitoring. However, when location records can identify an employee or another individual, the information may constitute personal data under Kenya's data protection framework.
The key question is not simply whether a business can install a tracker. It is how the organization collects, accesses, uses, retains and protects the resulting information.
Kenya's Data Protection Act, 2019 establishes requirements for processing personal data. Employers should assess their specific monitoring arrangements against the applicable law and guidance from the Office of the Data Protection Commissioner (ODPC).
This article provides general operational guidance, not a legal opinion.
Why Does Data Protection Matter in Fleet Tracking?
A GPS record may show where a vehicle travelled, when it stopped and how frequently it was used. If the vehicle is assigned to a particular employee, these records may also reveal aspects of that person's movements.
Businesses therefore need to consider both fleet oversight and the privacy implications of their monitoring practices.
A responsible approach can help organizations clarify expectations, limit unnecessary data access and establish more consistent procedures for handling tracking records.
Five Practices for Responsible GPS Fleet Monitoring
1. Establish a Clear Vehicle Tracking Policy
Explain why vehicles are tracked, what information is collected, who can access it and how the information will be used.
For example, a company may monitor vehicles to coordinate deliveries, investigate suspected theft or verify authorized business journeys. The policy should describe the actual purposes rather than rely on broad statements such as monitoring productivity.
Employees should receive appropriate information about the monitoring arrangement before it begins, in line with applicable legal requirements.
2. Collect Only the Data You Need
Not every business needs to retain every tracking record indefinitely.
Determine which location data, reports and alerts are necessary for defined operational purposes. Review whether the information collected is proportionate to those purposes, and avoid collecting unrelated personal information.
The ODPC's data protection resources provide further guidance for organizations developing appropriate data-handling practices.
3. Restrict Access to Tracking Records
Access to fleet data should reflect job responsibilities.
Dispatchers may need live vehicle locations, while finance teams may need utilization reports. Not every employee needs access to complete trip histories or driver-specific information.
Organizations should use appropriate access permissions, secure accounts, strong authentication where available and procedures for reviewing who can access sensitive records.
4. Define Data Retention and Deletion Procedures
Decide how long different types of information need to be retained and why.
Routine trip records may have a different retention requirement from records linked to an unresolved accident, insurance claim or investigation. Retention decisions should reflect applicable legal obligations and the organization's documented purposes.
Avoid keeping information indefinitely simply because the tracking platform makes storage possible.
5. Review Monitoring Outside Working Hours
Company vehicles may sometimes be used for authorized personal journeys, or employees may take vehicles home overnight.
Organizations should consider these circumstances when designing tracking policies. Where appropriate and technically supported, monitoring arrangements should distinguish business requirements from periods when detailed employee location information is unnecessary.
The appropriate approach depends on vehicle ownership, employment arrangements, operational risks and applicable law.
Who Should Be Able to Access GPS Tracking Data?
Access should be assigned according to legitimate business responsibilities.
| Role | Example of a legitimate operational need |
|---|---|
| Fleet manager | Vehicle utilization, route compliance and maintenance planning |
| Dispatcher | Current location and delivery coordination |
| Security team | Investigating theft, unauthorized movement or an incident |
| Human resources | Relevant records for a documented employment matter, subject to policy and law |
| System administrator | Technical support and account management under controlled permissions |
These are examples rather than mandatory role assignments. Businesses should document their own access rules and ensure that any sharing of information has an appropriate basis.
What Should Businesses Review Before Deploying GPS Tracking?
Use this practical checklist:
Document the purposes for tracking vehicles.
Identify what personal data the system collects.
Inform affected employees appropriately.
Establish who can access location histories and reports.
Set retention, deletion and incident-handling procedures.
Assess relevant obligations under the Data Protection Act and applicable regulations.
Review supplier contracts, system security and any cross-border data transfers where relevant.
Organizations should seek qualified legal or data protection advice when the monitoring arrangement involves complex employment issues, sensitive information or high-risk processing.
Frequently Asked Questions
Does GPS tracking collect personal data?
It can. Vehicle location records may be personal data when they relate to an identified or identifiable person. The context and how the records are used matter.
Must employers inform employees about vehicle tracking?
Employers should provide appropriate information about the collection and use of personal data and assess their notification and other obligations under Kenyan data protection law. The exact requirements depend on the circumstances and applicable legal basis.
Can a business monitor company vehicles after working hours?
The answer depends on the circumstances, the purpose of monitoring, the vehicle-use arrangement and applicable law. Employers should establish a clear policy and avoid collecting more personal location information than necessary.
How can a fleet management platform support responsible monitoring?
Depending on the platform's capabilities, access permissions, reporting controls and retention settings can help organizations manage tracking information. Businesses should verify the actual controls available rather than assume every platform provides the same safeguards.
Build Fleet Visibility on Clear Policies
Effective fleet monitoring requires more than knowing where vehicles are. It also requires clear responsibilities, appropriate access controls and a documented approach to personal data.
Explore TrackAlways fleet management solutions and contact the team to discuss vehicle monitoring requirements and the information your operations need.