GPS tracking in rental cars: what the GDPR allows

GPS tracking in rental vehicles is lawful in Germany as long as it serves a narrowly defined purpose, rests on a legal basis under Art. 6 of the GDPR, known in German as the DSGVO, and the renter knows about it before signing. The opposite is unlawful: covert, permanently running tracking that produces a movement profile of the renter.

For a rental business this produces a very practical distinction. A location query on suspicion of theft or embezzlement, the search for a vehicle that does not come back after the rental period, or an alert when the vehicle leaves the contractually permitted area can all be justified. Logging every trip, every stop and every ignition cycle cannot be justified, because it is not necessary for any of those purposes. So the hardware may stay in the vehicle. What matters is when it generates data, who reads it and how long the data stays.

Which legal basis carries the tracking?

Location data is personal data as soon as it can be linked to a particular renter. With a rental vehicle that is practically always the case, because the rental agreement states exactly who had the vehicle in which period. Every processing operation therefore needs a legal basis under Art. 6 of the GDPR. Three of them are even conceivable in the rental trade, and they carry different distances.

• Contract performance: it only covers what is objectively indispensable for carrying out the rental agreement. Getting the vehicle back belongs there; continuous observation of the route does not. This basis is narrower than many agencies assume.
• Legitimate interest: this is the load-bearing basis for theft protection and for recovering embezzled vehicles. It requires a balancing of your security interest against the renter's rights, and you have to record that balancing in writing beforehand, not once a dispute starts.
• Consent: it must be freely given. An agreement without which the renter does not get the key is not freely given and will not hold as a basis. Consent therefore only fits genuine extra services the renter is free to decline.
• Purpose limitation and data minimisation sit above all three: a purpose added later, such as scoring driving style, is not covered by the old basis.

In practice that means configuring the system so that it stays silent in normal operation and only delivers data on a defined trigger. The narrower the trigger, the more easily the balancing falls in your favour. A system that runs from handover to return inverts that logic and is hard to defend.

Permitted and prohibited tracking scenarios

The comparison below covers the cases that actually arise in an agency with a small or mid-sized fleet. It is not legal advice, but it shows where the decision tips.

Information duties at the point of signature

The most common mistake in practice is not technical but formal: the tracking is well justified in substance, yet nobody told the renter. The duty to inform applies at collection at the latest, which means at signature and handover. These points belong in the privacy notice handed over with the agreement.

1. 1Who the controller is, with company name and address, and how to reach you on data protection matters.
2. 2What data is collected, that is location, time and where applicable odometer reading or ignition status.
3. 3The purpose of the tracking, in plain language: theft protection, recovery, compliance with the permitted area of use.
4. 4The legal basis, and where it is legitimate interest, exactly which interest that is.
5. 5Who receives the data, that is the telematics provider as a processor and, in a claim, the insurer or the police.
6. 6How long it is kept and what rights the renter has, in particular access, erasure and objection under Art. 21 of the GDPR.

On placement: one sentence in the small print of your terms is not enough. What works is a separate privacy information sheet handed over with the rental agreement and ticked off in the handover protocol, plus a short notice in the vehicle itself. If you hand over vehicles at an airport desk or at the Hauptbahnhof, the main station, where everything has to be quick, build the notice into the standard handover routine rather than leaving it to the day's rush.

Setting up cross-border geofencing properly

Geofencing is the easiest case to justify, because it reveals almost nothing. The system does not report where the vehicle is, only that a previously agreed boundary has been crossed. That is exactly how you should configure it.

• Put the permitted area of use in the rental agreement, country by country, not merely as a note on a sign at the counter.
• Let the system report the event only, not the ongoing position. An alert without a trail is the lesser interference.
• Decide in advance what follows the alert: a call to the renter, a reminder of the contractual position, documentation. Remote intervention in the vehicle's systems does not belong in that sequence, because it can endanger the renter in traffic.
• Also state the practical consequences of a permitted trip abroad. In Austria and Switzerland a vignette is required to use the motorway, and without a clear rule that question lands on your desk after the return.
• Delete geofencing alerts after a fixed period when no case has come of them.

Providers, retention and access in daily operation

Whether tracking survives scrutiny is rarely decided by the legal basis alone. It is decided by the documentation and the access rights, and that is work a small agency can get through in one afternoon.

• Sign a processing agreement with your telematics provider and check where the data is actually processed.
• Add the tracking to your record of processing activities, with purpose, legal basis, data categories and retention period.
• Check whether a data protection impact assessment is required. Your state authority publishes lists that let you gauge this.
• Restrict access to a named group, for instance the owner and the station manager, and log every query with its date and trigger.
• Set a short, fixed retention period for queries with no follow-up case, and actually keep to it. Excessive storage carries weight on its own.
• Train counter staff on two things: what has to be said, and that nobody queries a vehicle without a trigger.

Treat renters' requests about their own data as a test of your system rather than a nuisance. If you can say straight away which queries relate to a booking and why, your configuration is sound. If you have to ask your provider first, it is not.

An orderly back office carries the paperwork

Every one of these duties hangs on a question that is really commercial: who had which vehicle in which period, and what was agreed at handover? An agency that keeps bookings, calendar and fleet in one back office has already documented those periods and can answer an access request in minutes rather than days. On DRIVO, a European marketplace for renting directly from trusted independent and local agencies, such a back office for bookings, calendar and fleet management comes with the listing, and Germany is one of the countries served. Listing your fleet costs 0 euros, with no listing fee and no monthly fee; commission is charged only on completed bookings, payouts run automatically through Stripe, and listings appear in five languages. Data protection stays your job as controller, but its foundation, namely clean rental periods and traceable bookings, is the same order that makes the operation easier anyway.