UK GDPR and location tracking of staff and volunteers, a practical guide for field operations

In the UK, the rules come from the UK GDPR and the Data Protection Act 2018, both amended by the Data (Use and Access) Act 2025, with the Information Commissioner’s Office (ICO) as regulator. Article 4(1) of the UK GDPR lists location data by name among the identifiers that make information personal. A live position tied to a named team member is personal data, and so is the track of where that person went during a shift. Collected over time, it can reveal a lot beyond work, such as where someone lives, when they take breaks or which doctor they visit.

Whoever decides why and how positions are collected is the controller, typically the employer, municipality, rescue organisation or NGO running the operation. A company hosting the software for you is normally a processor and needs a contract under Article 28. If several organisations share one operation, agree who is responsible for what; joint controllers have to set this out under Article 26.

UK GDPR consent has to be freely given. The ICO’s guidance on monitoring workers puts it plainly: consent is not usually appropriate in the employment context, due to the imbalance of power between employer and workers. Consent from someone who would face consequences for refusing is not valid.

Volunteers are not employees, though much the same pressure arises when tracking is a condition of joining a unit or a deployment. Consent can work for features that are genuinely optional, for example sharing a position with family during a long event. For the core of an operation, legitimate interests or a public task backed by a proper assessment is usually the more honest and more stable choice.

Where processing is likely to result in a high risk to people’s rights and freedoms, Article 35 of the UK GDPR requires a data protection impact assessment (DPIA). The ICO publishes a list of processing that always needs one, and under “tracking” it names processing the location data of employees. Field tracking also tends to hit other high-risk indicators:

• Systematic monitoring of people’s positions.
• Vulnerable data subjects. Employees count here because of the power imbalance, and so do young volunteers.
• Innovative use of technology, such as combining tracks with sensors, cameras or automated alerts.
• Matching or combining datasets, for example tracks with rosters and incident records.
• Large scale, when many people are tracked over long periods.

Articles 12 and 13 of the UK GDPR require clear information at the point when positions start being collected. For a field operation, that means telling people in plain language, before they switch the app on, at least who the controller is, why positions are collected and on what legal basis, who can see them, when tracking starts and stops, how long tracks are kept, and how to exercise their rights. That includes the right to object where the basis is legitimate interests or a public task.

The ICO is clear that covert monitoring is unlikely to be justified in most circumstances, and that outside very exceptional cases you must tell workers about any monitoring. Its guidance also points out that monitoring can reach outside work hours and onto personal devices. If phones or vehicles are also used privately, give people a way to turn tracking off when they are off duty. People tend to trust a visible indicator that sharing is on, with a clear point where it ends, far more than a long policy document.

Collect only what the purpose needs (Article 5(1)(c)) and keep it no longer than necessary (Article 5(1)(e)). The UK GDPR sets no fixed number of days, so you choose a period and justify it. Choices that tend to hold up:

• Live positions are shared only while an operation is active, and only with the roles that need them.
• Detailed tracks stay for as long as the debrief needs them; after that, delete or aggregate them.
• Anything kept longer needs a specific reason, such as an incident under investigation or a legal hold.
• Do not reuse tracks for performance monitoring unless that purpose was assessed and announced in advance.
• Strip location from photos before they leave the operation, unless it is actually needed.

A Sinkaos member can always see when their position is shared and with whom. Sharing can be limited to the length of the operation or to certain roles, and retention is set per type of data. Photo metadata is stripped or kept according to policy, while exports and admin actions are written to an audit trail. These settings support your UK GDPR work, but the decisions above stay with you. See the security page and team location sharing.