A live map answers a useful fleet question: where is the vehicle doing company work? It can also describe where an identifiable driver went, when they stopped, how fast they moved, and which places they visit repeatedly. That makes GPS an operating tool and a data-protection responsibility at the same time.
Kenya’s Data Protection Act expressly includes location data among the identifiers that can relate to a natural person. A registration number is about a vehicle; once the shift roster or trip assignment links that vehicle to a driver, the route history can also be about the driver. This guide is operational guidance, not legal advice.
The practical rule
Collect the least location data needed for a stated fleet purpose, tell the driver what happens to it, restrict who can use it, keep it only as long as necessary, and provide human review before it causes a serious decision.
Start with purpose, not with every feature the tracker offers
The Act’s principles include lawful, fair, transparent processing; an explicit and legitimate purpose; data minimisation; accuracy; and retention only for as long as is reasonably necessary. “We installed trackers” is not a purpose. Dispatching an active trip, investigating a collision, recovering a stolen vehicle, or giving a customer a controlled ETA are purposes that can be documented and tested.
| Purpose | Minimum useful data | Appropriate audience |
|---|---|---|
| Dispatch and ETA | Current position, direction, last update, assigned trip | Dispatcher and the customer view for that trip only |
| Safety review | Speed, harsh events, route, time, and vehicle context | Safety or operations managers with a documented review process |
| Theft recovery | Live and recent vehicle location plus authorised immobilisation state | A small incident-response group and lawful authorities when required |
| Customer proof | Trip-specific milestones and delivery evidence | That customer—not the fleet’s other trips, drivers, or vehicles |
Do not keep adding secondary uses because the data already exists. If location was collected for dispatch, reusing it to rank every driver or monitor private activity is a new purpose that needs its own lawful basis, necessity test, notice, access rules, and risk review.
Give notice before the first tracked assignment
Section 29 of the Act sets out information to provide before collection, including why the data is collected, who may receive it, safeguards, contact details, and the consequences of providing or not providing it. Put that information in a short driver tracking notice and a fuller policy—not only in a contract nobody can find.
- Name the operational purposes: dispatch, safety, theft recovery, customer visibility, compliance, or verified trip records
- Tell drivers what is collected, when tracking is active, who can see it, and how long it is kept
- Limit live-map and route-history access to roles that need it, and review that access regularly
- Separate working-time vehicle tracking from any off-duty use of an assigned vehicle
- Give drivers a route to access, correct, or challenge data and decisions based on it
- Record retention, deletion, incident response, vendor, and cross-border processing rules
A signed acknowledgement can prove the notice was delivered, but it does not cure an excessive practice. Consent is only one lawful basis under the Act. Whichever basis a fleet relies on must be connected to the purpose and supported by necessity and proportionality. Employment also raises the question of whether consent is genuinely freely given, so obtain advice rather than making a consent checkbox carry the whole programme.
Turn policy into permissions
A privacy notice is only useful when the software follows it. Kora keeps live tracking, customer visibility, trip records, and audit history behind role and tenant boundaries.
Draw a hard line around off-duty tracking
A company truck that sleeps at the depot presents a different privacy question from a vehicle assigned to one person and permitted for private use. Define when a shift or trip begins and ends. If theft protection requires the device to remain connected, restrict ordinary access outside work, document the exception, and log exceptional access. A tracker being technically able to report every minute does not make every minute operationally necessary.
An alert is evidence to review, not a verdict
GPS positions drift, speed readings spike, assignments change, devices report late, and poor coverage can draw a straight line between distant points. Before a warning, withheld payment, suspension, or dismissal, verify the device, timestamp, driver assignment, route, and corroborating records. Let the driver correct an inaccurate record and explain the operating context.
The Act gives data subjects rights that include being informed, accessing their data, objecting to processing, and correcting or deleting false or misleading data. It also places controls on decisions based solely on automated processing that significantly affect a person. Keep a named human accountable for the decision and preserve what evidence they reviewed.
Run a DPIA before the risk becomes an incident
Assess privacy risks before introducing monitoring. Where processing is likely to pose high risks to people’s rights and freedoms, section 31 requires a DPIA before it starts. The assessment documents necessity, proportionality, risks and safeguards; use the ODPC guidance to determine the requirements for the planned processing.
The assessment should follow the real data path: tracker hardware, mobile network, device platform, fleet software, support access, customer communications, exports, backups, deletion, and any processing outside Kenya. Confirm controller and processor roles, contract terms, subprocessors, breach handling, return or deletion at termination, and appropriate safeguards for transfers.
A fleet manager’s 30-minute control review
Purpose
Can every collected field be tied to a current operating purpose?
Notice
Can a driver find a plain-language explanation before tracking starts?
Access
Can you name every role that sees live location and route history?
Retention
Does route history expire according to a written schedule?
Fairness
Does a person review evidence before an adverse decision?
Vendors
Do contracts cover security, deletion, subprocessors, and incidents?
Privacy does not require giving up operational visibility. It requires making the visibility deliberate. The strongest fleet record is one that is useful enough to run the work, controlled enough to defend, and clear enough that the people being tracked are not surprised by how it is used.
Official sources and further reading
Editorial review: 14 September 2026. The sources below support the privacy principles discussed; they are not certification that a particular deployment complies.
- Kenya Law: Data Protection Act, 2019
- Kenya Law: Data Protection (General) Regulations, 2021
- ODPC: Guidance Note on Data Protection Impact Assessment
- ODPC: compliance self-assessment resources
Frequently asked questions
Is GPS location data personal data under Kenya’s Data Protection Act?
It can be. The Act includes location data in the information that may identify a natural person. When a vehicle is assigned to a known driver, its route and time history can describe that person’s movements and behaviour, so the fleet should manage it as personal data.
Does a fleet need driver consent before tracking a company vehicle?
Consent is not the only possible lawful basis, and employment can make freely given consent difficult. A fleet should identify and document the lawful basis that fits each purpose, test necessity and proportionality, and still give clear notice before collecting the data. Obtain Kenyan legal advice for your circumstances.
Can a company track a vehicle when the driver is off duty?
Continuous tracking needs a defined, necessary purpose. If private use is allowed, adopt an off-duty rule such as a privacy mode, restricted access, or a tightly scoped theft-recovery exception. Do not quietly reuse operational tracking for unrelated monitoring.
Can GPS evidence be used to discipline a driver?
Telematics can support an investigation, but one alert should not be treated as a verdict. Validate device accuracy, trip context, assignment, road conditions, and the driver’s explanation. Decisions with serious effects should have meaningful human review and a way to challenge inaccurate data.
When should a fleet consider a data protection impact assessment?
A DPIA is required before processing likely to create high risks to people’s rights and freedoms; it is not simply optional in that situation. Assess the nature, scope, context and purposes of the proposed monitoring against the Act and ODPC guidance.