Driver apps: what they simplify and which privacy rules to consider

In brief

A driver app can remove a great deal of repetitive work from a small fleet: it can show assigned tasks, addresses and notes; allow the driver to update the status; return documents and report anomalies. Its main value is that the office and the road have the same information.

But an app installed on a worker's phone can also process personal data and, if it includes GPS or monitoring functions, enter the area of remote monitoring. Its design must therefore start from the principle of "collect only what is needed", not "if the phone can do it, let us record it".

Functions that are genuinely useful

For an SME, the basic functions can include:

• individual login;
• list of assigned tasks;
• collection/delivery with date and address;
• references and operational notes;
• status updates;
• reporting problems;
• possible upload of the necessary documents;
• notification of a plan change.

Functions such as chat, continuous geolocation, photographs, signatures or automatic detection can be useful in some processes, but they also increase the data processed, responsibilities and complexity. They should not be enabled simply because "everyone has them".

Do not turn the app into a surveillance system

A function intended to say "the driver has arrived at the customer" can, if poorly configured, collect the position minute by minute, including during breaks or outside working hours. A personal device may also contain calls, messages, photos and information unrelated to work.

The Italian Data Protection Authority has repeatedly highlighted the specific risks of geolocation applications on employees' devices, calling for measures to prevent the collection of excessive data and ensure transparency, limited access and configurations consistent with the purpose.

GDPR: purpose and minimisation

Article 5 of the GDPR sets out fundamental principles:

• lawfulness, fairness and transparency;
• purpose limitation;
• data minimisation;
• accuracy;
• storage limitation;
• integrity and confidentiality;
• accountability of the controller.

Applied to a driver app, this means, for example, that if it is necessary to know the status "arrived for collection", it is not automatically necessary to retain the worker's entire GPS route for months. If a photo of damaged goods is needed, the app should not obtain indiscriminate access to irrelevant content on the phone.

The legal basis, privacy notice, retention periods, authorised persons, any processors and security measures must also be defined.

Article 4 of the Italian Workers' Statute

In Italy, the use of technology in the employment relationship must also be assessed in light of Article 4 of Law 300/1970 (Workers' Statute). In 2026, the Italian Data Protection Authority again stated that systems and tools capable of enabling remote monitoring of workers' activities are subject to the sector rules, including the conditions and procedures set out in paragraph 1 where applicable.

The law also contains specific rules for tools used by workers to carry out their duties and for systems recording access and attendance. Establishing which category a particular app belongs to and which requirements are necessary calls for a concrete assessment: it is not prudent to assume that "because it is a work tool, GPS is always unrestricted".

Geolocation: why it requires care

If a GPS function is being considered, before developing or purchasing it, it is appropriate to define:

Purpose. Why is it really needed? Safety? Coordination? proof of arrival? optimisation?

Granularity. Is continuous location needed, or is an event at collection/delivery enough?

Hours. Does collection stop outside work?

Visibility. Does the worker know when location tracking is active?

Access. Who can see the position, and why?

Retention. How long are the data needed?

Employment-law procedure. Are a trade-union agreement, Labour Inspectorate authorisation or other conditions required under Article 4?

DPIA. Is a data protection impact assessment necessary based on the risk and characteristics of the processing?

These questions should be addressed with a DPO/privacy adviser and employment-law adviser before go-live.

Security and access

The app should provide at least:

• individual accounts, not shared credentials;
• prompt revocation when a driver leaves the company;
• encrypted communications and suitable infrastructure;
• role-based authorisations;
• protection for uploaded documents;
• reasonable logging of relevant operations;
• a procedure for a lost or stolen phone;
• separation, as far as possible, from non-work personal data.

Checklist before introducing a driver app

• What operational problem does each function solve?
• Which personal data does it process?
• Is there a legal basis and an adequate privacy notice?
• Does it collect more data than necessary?
• Is geolocation present? Continuous or event-based?
• Has compliance with Article 4 of the Workers' Statute been checked?
• Is access limited by role?
• Are retention periods defined?
• Is it possible to export/delete data according to the applicable rules?
• Are drivers trained in the safe use of the app?