Is GPS Tracking Legal for Tradies in Australia? (Driver Consent + Privacy Act)

Every tradie who looks at GPS tracking asks the same question at some point: am I allowed to do this? The honest answer is yes, as long as you do it the right way. Australian law does not ban employers from tracking work vehicles. It does require you to be open about it, get the right consent, and use the data only for legitimate work-related purposes. Done properly, this is not legally complicated.

The risk is doing it badly. Installing trackers without telling drivers, monitoring their personal time, or running an informal "I'll just see what they get up to" project is the path to a Fair Work complaint, an employee leaving with a grievance, or a privacy regulator getting involved. The compliance checklist at the end of this article will keep you on the right side of the line.

The short legal answer

GPS tracking of work vehicles in Australia is governed by two main pieces of law plus state-specific workplace surveillance rules.

The Privacy Act 1988 (Cth) applies to most businesses with annual turnover over $3 million (and to all businesses dealing with health data, credit data and some other categories). Even if you are under the threshold, the Australian Privacy Principles (APPs) within the Act are widely treated as best practice and most insurers and customers expect compliance.

The relevant APPs are:

• APP 3: only collect personal information that is reasonably necessary for your business.
• APP 5: notify individuals at or before the time of collection about what you are collecting and why.
• APP 11: take reasonable steps to protect the information you hold and to delete it when it is no longer needed.

The state Workplace Surveillance Acts apply on top of the Privacy Act. NSW has the strictest framework. Victoria, Queensland, WA and other states have less prescriptive rules but the same general direction: tell employees, get consent, have a written policy.

Done correctly, GPS tracking sits comfortably inside all of this. The legal weight is on the procedure, not the technology itself.

NSW: the Workplace Surveillance Act 2005

If you operate in NSW, the Workplace Surveillance Act 2005 is the strictest GPS-tracking framework in the country. Three rules matter most.

14 days written notice before installation

You must give each employee at least 14 days written notice before any surveillance starts. The notice has to specify the kind of surveillance (in this case, tracking), how it will be carried out (the device, the data collected), when it will start, whether it will be continuous or intermittent, and whether it will be ongoing or for a set period.

A written surveillance policy

The notice has to be accompanied by, or refer to, a clear written policy that explains the purpose of the surveillance, the data collected, who has access, how long the data is kept and how it will and will not be used.

No covert surveillance without a court order

Installing a tracker without telling the employee is illegal in NSW except in narrow circumstances and only with a magistrate's authorisation. This is the line you do not want to cross. If you suspect a specific employee of theft or fraud, talk to a lawyer before installing anything covertly.

The NSW framework is the easiest one to get caught out by, because the 14-day rule and the written policy requirement are explicit and a Fair Work Commission case can hinge on whether you produced them.

Victoria, Queensland, WA and other states

Victoria has the Surveillance Devices Act 1999, which deals more with covert surveillance than with employer-employee fleet tracking specifically. There is no mandatory 14-day notice period like in NSW, but the Privacy Act still applies and the practical advice is the same: notify in writing, have a policy, use the data only for legitimate purposes.

Queensland and WA do not have a workplace-surveillance-specific Act. They rely on the Privacy Act and general employment law principles. The practical compliance steps are identical: written notice, written policy, reasonable purpose.

South Australia, Tasmania, ACT and NT have their own surveillance device legislation that mostly mirrors the Victorian framework. None requires the explicit 14-day notice rule that NSW imposes.

The safest approach if you operate across multiple states is to apply the NSW standard everywhere. It is the strictest and gives you a compliant baseline whichever state you are working in.

What counts as a reasonable purpose

The Privacy Act and the state Surveillance Acts allow GPS tracking for legitimate work-related purposes. What counts as legitimate?

These are reasonable purposes:

• Fleet management and dispatching the closest vehicle to a job.
• Workplace health and safety (knowing where a lone worker is if they fail to check in).
• Asset protection (recovering a stolen vehicle).
• Verifying time and attendance for billing purposes.
• Insurance compliance where the policy requires a tracker.
• Maintenance scheduling based on distance and engine hours.

These are not reasonable purposes:

• Monitoring an employee's location during their personal time.
• Surveilling a specific employee because you suspect them, without a defined investigation process.
• Checking whether an employee is at a particular religious or political activity, union meeting or medical appointment.
• Selling or sharing the location data with anyone outside the business.

The line is "is this about running the business" versus "is this about watching the person". The first is fine. The second is not.

Driver consent versus notification

There is a common misconception that you need every driver to sign a separate consent form for GPS tracking. In most cases, you do not. What you need is notification: a written notice given to the employee that explains what you are doing, accompanied by a written policy.

If GPS tracking is included as a condition of employment in a new contract, the employee accepts it by signing the contract. For existing employees, the notification-plus-policy approach is the standard pattern. Get a signed acknowledgment that they have read the policy. This is not the same as consent (consent implies a free choice; an employee cannot meaningfully consent to a condition of their job), but it is the right paper trail for compliance and dispute resolution.

If a driver flatly refuses to drive a tracked vehicle, that becomes an employment matter that may need to be handled under your usual disciplinary or contract-variation process. Talk to a lawyer before getting into that territory.

How to write a compliant policy

A workable GPS tracking policy is a single A4 page. It needs to cover:

1. Purpose. "We use GPS tracking on company vehicles for fleet management, workplace health and safety, and asset protection."
2. Scope. Which vehicles are tracked, who drives them, and when tracking is active (usually 24/7 for asset protection, but the data is only reviewed during work hours).
3. Data collected. Location, ignition state, speed, trip start and end times, route history.
4. Who has access. The business owner, the office manager, and named delegates. Drivers can request access to data about their own vehicle.
5. How long it is kept. Typically 12 to 24 months, then deleted.
6. What it will and will not be used for. Mirror the reasonable-purpose list above.
7. Personal use of vehicles. If drivers are allowed personal use, address how their privacy is protected during personal time (often via a "private mode" on the tracker or an agreement not to review data outside work hours).
8. Complaints process. Who to talk to if the driver has concerns.

Most GPS tracking vendors will provide a template policy. Use it as a starting point and tailor it to your business and state. Get an employment lawyer to review it once, then it will serve for years.

The compliance checklist

What happens if you get it wrong

The most common consequences of non-compliant GPS tracking, in order of how often they happen:

1. An employee leaves and complains. The complaint goes to Fair Work or a state tribunal. If you cannot produce written notice and a policy, the case favours the employee.
2. An employee uses the privacy issue as a defence against a separate dismissal. If you sacked someone for tardiness based on tracker data that was collected without proper consent, the data may be excluded and the dismissal challenged.
3. A privacy complaint to the OAIC. Less common but possible. The Office of the Australian Information Commissioner can investigate and order changes.
4. A criminal-level breach for covert installation. Rare but serious. Do not install trackers without telling drivers.

The risk profile is low if you follow the checklist. It is meaningful if you do not.