Geolocating drivers in Spain: what the law says

A company can geolocate its employees to monitor their work, but within the limits of the law and by telling them first in an express, clear and unambiguous way. It is regulated by article 90 of Organic Law 3/2018 (LOPDGDD, the Spanish data protection and digital rights law), and the Spanish Data Protection Agency (AEPD) adds that the legal basis is not consent but the employment contract, and that the system has to be proportionate.

In a coach company the question arises on its own: the coach moves and the driver is inside it. Here is what the law and the AEPD say, which safeguards apply, and why the Bus Center driver portal does not track anyone.

What the law says about geolocating employees

The law allows it on two conditions: that it serves employment monitoring within its legal framework and that people are informed beforehand. Article 90 of the LOPDGDD says that employers may process data obtained through geolocation systems to carry out the employee monitoring functions provided for in article 20.3 of the Workers' Statute (Estatuto de los Trabajadores), provided these functions are exercised within their legal framework and with the limits inherent to it.

The second condition is in the same article: beforehand, employers must inform employees and, where applicable, their representatives, expressly, clearly and unambiguously, about the existence and characteristics of these devices. They must also tell them how to exercise their rights of access, rectification, restriction of processing and erasure.

And the LOPDGDD leaves the door open to collective agreements: collective agreements may establish additional safeguards on employees' personal data and their digital rights in the workplace. Before installing anything, it is worth checking what yours says.

What the AEPD adds

The AEPD develops this in its guide on data protection in employment relationships. The first thing it clarifies is the legal basis: the legal basis for processing the data is not consent, but the employment contract and the monitoring powers legally conferred on employers. So it is not a matter of asking the driver's permission, but of using geolocation only for what justifies it.

The same guide recalls that introducing monitoring measures requires a proportionality test. And for geolocation in particular, that the principles of data minimisation and purpose limitation are fully operative, and that the principle of proportionality requires limiting this kind of system to situations where no less invasive means exist.

If the technology is new to the company, the AEPD also asks for an impact assessment before it is implemented.

The coach's GPS also locates the driver

Locating the vehicle is, in practice, locating whoever drives it. The AEPD guide records the view that vehicle tracking devices are not devices for locating employees, and at the same time warns that geolocation applied to the tool also entails the geolocation and monitoring of the employee themselves.

Several safeguards follow, which the guide lists. The data must be processed for a specific purpose and not for a broader one that allows continuous observation of employees. Whoever drives a vehicle with a tracker must be fully informed about the tracking and its purpose, and the AEPD advises that this information appear in a prominent place in each vehicle, in the driver's view.

The guide also cites a court ruling that sets the company's obligation to ensure that the vehicles' geolocation device will not be operational from the moment the working day ends.

The driver's phone is not a tracker

The driver's personal phone cannot be turned into the company's GPS. The AEPD puts it this way: it is not lawful to impose on the employee an obligation to provide personal means to facilitate geolocation, and it gives the mobile phone as an example.

Purpose limitation weighs here too: according to the guide, if the purpose of the geolocation is time recording, the data may not be used to check the employee's location at every moment. Data collected for one thing cannot be used for another.

Why the Bus Center portal does not track the driver

Bus Center has no GPS tracking of the fleet or of the drivers. The driver portal is a web page that opens on the phone, with nothing to install, and each driver sees only their own information: their next service, their expenses, their documents and their incidents.

Location appears at only one moment: when the driver reports an incident. Then the phone asks for the location, and the driver can say no; if they refuse, the incident is sent anyway. If they give it, it is stored to six decimal places, because the point is to find a bus stopped on a road, and the incident goes to the office and only to the office.

What the office sees of the driver in the program is their operational activity (what they send and what they are answered), not tracking. It is a design decision: to manage services, expenses and incidents there is no need to know where anyone is at every moment. We cover it in more detail in the driver's incident report and in what a driver needs on their phone.

What to check if you already use location tracking in your fleet

If your coaches already carry a tracker from another provider, these are the questions that follow from the law and the AEPD guide:

• Were the drivers told beforehand, expressly, clearly and unambiguously, that it exists and how it works?
• What exactly is it used for, and is it used only for that?
• Does it stop working when the working day ends?
• Is there a visible notice in each vehicle?
• Was the impact assessment carried out, if the technology was new to the company?
• What does the collective agreement say?

For any specific doubt, the answer comes from your employment or data protection adviser. You can see what the portal does in the drivers section (in Spanish).

Sources consulted

Checked on 11 October 2026. We link to the original source so that you can consult the current text.

• Ley Orgánica 3/2018, de 5 de diciembre, de Protección de Datos Personales y garantía de los derechos digitales (texto consolidado). BOE.
• La protección de datos en las relaciones laborales (guía). Agencia Española de Protección de Datos.