Is GPS tracking of drivers legal in Norway? What the rules say
Yes — GPS tracking of company vehicles is legal in Norway when the employer has a legitimate purpose (such as route planning or safety), informs employees before tracking starts, and does not store more data, or for longer, than the purpose requires. The Norwegian Data Protection Authority (Datatilsynet) requires necessity and proportionality, and tracking must be limited to work-related use.
On this page
Most delivery businesses considering GPS tracking land on the same question before adopting a system: is this actually legal? The answer is yes — but only if a few basic requirements are in place. This article walks through what the Norwegian Data Protection Authority actually requires, and how a system should be built to stay within the rules from day one.
Is it legal to GPS-track an employee’s vehicle?
Yes, as long as the employer has a legitimate purpose and the tracking is necessary and proportionate. Introducing GPS in company vehicles counts as a control measure under sections 9-1 and 9-2 of the Working Environment Act, and it must also have a legal basis under GDPR.
Legitimate purposes for delivery businesses typically include route planning and fleet management, driver safety, and statutory requirements such as driving and rest-time rules. Having a purpose on paper isn’t enough — the employer must actually assess whether the purpose could be achieved with less invasive means, and whether the benefit is proportionate to the intrusion on the driver’s privacy.
Must employees be informed in advance?
Yes — the duty to inform is absolute, and the information must be given before tracking begins. Mentioning it vaguely in a staff handbook isn’t enough. Employees must be told:
- what the purpose of the tracking is
- what data is collected
- how long the data is stored
- who in the company has access to it
Clear, specific information is also what determines which data can lawfully be processed at all — and for how long it can be kept.
How long can you store GPS data?
No longer than the purpose actually requires. For pure fleet management — knowing where the vehicle is right now, to plan routes and give customers a precise arrival window — it’s often the current position that matters, not a permanent history of everywhere the vehicle has been.
This is also why Framme automatically deletes raw GPS points 72 hours after they’re collected. The tracking data is used to plan and display the delivery while it’s happening — not to build up a historical log of the driver’s movements.
Can the driver be tracked during breaks or after work hours?
No — not without a separate, clearly stated purpose for that specifically. Tracking tied to fleet management must be limited to the work-related purpose it was justified by. The Data Protection Authority is explicit that position data cannot be used to check how long a driver’s breaks are, or which route was taken on a personal errand.
In practice, this means tracking should be tied to the route, not continuous. In Framme, the driver starts tracking themselves when the route begins, and it stops automatically the moment the route ends — there is no background tracking outside an active delivery.
What happens if the rules aren’t followed?
The Data Protection Authority can issue orders and infringement fines to businesses that breach the requirements for necessity, proportionality, or the duty to inform. Beyond the legal risk, there’s a trust cost: drivers who experience tracking as unexplained surveillance lose trust in their employer.
Employees also have the right to access their own personal data. Drivers in Framme can download their own position data directly from the app at any time.
How Framme is built to be compliant from day one
Privacy isn’t added afterwards — it’s part of how the system is actually built:
- Route-scoped tracking. The driver starts and stops position sharing themselves, per route. No tracking outside an active delivery.
- Automatic deletion. Raw GPS points are automatically deleted after 72 hours.
- No full history for the customer. The customer only sees the position once the delivery is approaching — never the driver’s full route or previous stops.
- The driver’s own data export. The right of access is built in as an actual feature, not just an email to support.
Want to see how this works in practice? Read more about live delivery tracking or getting started with Framme — your first route is ready two minutes after signing up.
Frequently asked questions
Is GPS tracking of company vehicles legal in Norway?
Yes, provided the employer has a legitimate purpose (such as route planning or safety), the tracking is necessary and proportionate, and employees are informed in advance — per sections 9-1/9-2 of the Working Environment Act and GDPR.
Do I need the driver’s consent?
Consent is rarely the right legal basis in an employment relationship, given the power imbalance between employer and employee. The usual basis is the employer’s legitimate interest, combined with clear information to employees.
How long should I store position data?
No longer than the purpose requires. Framme automatically deletes raw GPS points 72 hours after collection.
Can my customers see where the driver has been all day?
No. In Framme, the customer only sees the position once the delivery is approaching — never the driver’s full route or previous stops.
Can I track the driver during their free time?
No, tracking must be limited to the work-related purpose. In Framme, the driver starts and stops tracking themselves per route — there is no tracking outside an active delivery.
Related articles
Personvernerklæring på sporingssiden: dette må den faktisk inneholde
Kunden som åpner sporingslenken er en registrert etter GDPR fra det øyeblikket. Her er hva personvernerklæringen på selve sporingssiden faktisk må inneholde.
Sjåførens rettigheter ved GPS-sporing: hva kan arbeidsgiver faktisk se?
Sjåføren din spør hva dere egentlig ser når bilen spores. Her er hva innsynsretten faktisk gir rett til — og hvor lang tid dere har på å svare.
Hvor lenge kan du lagre kundedata? Praktisk guide for transportbedrifter
GDPR sier ikke «slett etter 30 dager» — den sier «ikke lenger enn nødvendig». Her er hvordan du faktisk fastsetter riktig lagringstid for kunde- og sjåførdata.