GPS in a company car and the Kodeks pracy - employee rights and employer obligations

The employer wants to know where its cars are, whether they are carrying out planned tasks, and whether fuel is being used as intended. The employee wants to be sure that the company car does not become a tool for observing their private life.

Both sides have legitimate needs. The law allows GPS monitoring, but sets limits on its use. The mere fact that a car belongs to the company does not give an unlimited right to track the person using it. At the same time, the employee's right to privacy does not entitle them to jam the system with a device bought online.

Below, we explain the rules for employees employed under an employment relationship: when monitoring is allowed, what obligations both sides have, and what consequences intentional GPS interference may have. B2B cooperation and civil law contracts require a separate assessment, although they are also subject to personal data protection regulations.

Can an employer install GPS in a company car?

Yes, if monitoring is necessary to achieve a permitted purpose and is properly introduced.

The basis in the Kodeks pracy is Art. 22³ § 4 in conjunction with § 1-3. These provisions cover forms of monitoring other than email monitoring, including GPS monitoring. They allow its use to ensure work organization that enables full use of working time and proper use of work tools provided to the employee. [1]

A company car is such a tool. However, the employer should explain what it needs the data for and why this purpose cannot be achieved by a less intrusive method. UODO emphasizes the need to assess the necessity and proportionality of monitoring. [3]

For example, a service company may need vehicle locations to dispatch the nearest available team to a breakdown. A transport company may want to verify that transport tasks are being carried out and vehicles are being used properly.

These are specific organizational needs. A general statement like "I want to know everything about employees" is not sufficient justification.

Is a vehicle's location personal data?

If the vehicle's location can be linked to a specific employee, it is information about that person. The name does not have to be displayed on the map. It is enough that the driver can be identified based on the vehicle assignment or schedule. [2][4]

That is why GPS monitoring must take into account both the Kodeks pracy and RODO.

According to UODO's position, the basis for processing employee data as part of monitoring carried out under the Kodeks pracy is Art. 6 sec. 1 point f RODO, meaning legitimate interest. This requires a prior balancing test: assessing the purpose, the necessity of processing, and the impact on the employee's rights. It is not an automatic right arising from ownership of the car. [3]

Does the employee have to consent to GPS?

A signature under the statement "I have read the monitoring rules" confirms receipt of the information. It is not the same as consent to any kind of tracking.

On the other hand, simply collecting signatures under "consent to GPS" will not fix excessive monitoring. In an employment relationship, the voluntary nature of consent requires particularly careful assessment because of the employee's dependence on the employer. [4]

What must the employer do before launching monitoring?

Art. 22³ § 3-4 refers to the corresponding application of Art. 22² § 6-10 of the Kodeks pracy. This creates specific obligations. [1]

Define the purpose, scope, and method of monitoring

The rules should be set out in a collective labor agreement, work regulations, or - in cases provided for by law - in a notice.

They should be described so that the employee knows:

• which vehicles are covered by monitoring;
• what data is collected;
• when monitoring is active;
• what the company uses the data for;
• how private trips are handled.

A general statement that "cars have GPS" does not explain the control rules.

Inform employees in advance

Employees must be informed about the introduction of monitoring in the manner adopted by the company no later than two weeks before it starts.

Before allowing an employee to work, the employer must provide information on the purpose, scope, and method of applying monitoring. The current wording of Art. 22² § 8 allows paper or electronic form. This change applies from January 27, 2026. [1]

Provide clear information in the vehicle

The provisions on marking monitoring apply accordingly. Art. 22² § 9 provides for marking no later than one day before monitoring starts. For GPS, a practical solution is visible information in the car, supplemented with access to the full rules. Placing information within the driver's line of sight is also indicated in the Article 29 Working Party opinion on workplace data. [1][4]

However, a sticker does not replace the regulations or the RODO information obligation.

Provide the information required by RODO

The information under Art. 13 RODO should include, among other things, the controller, the purposes and basis of processing, the legitimate interest, data recipients, the retention period or criteria for determining it, and the employee's rights. The other elements required by this provision should also be included, as appropriate to the implementation. [2]

Company car used privately - where does company control end?

If the employer allows the car to be used after work, this does not mean the employee agrees to disclose all private routes.

Location history may reveal a visit to a clinic, a meeting place, or family habits. The obligation to respect dignity and other personal rights follows from Art. 11¹ of the Kodeks pracy, and monitoring limits also follow from Art. 22³ § 2 and 4. [1]

In Opinion 2/2017, the Article 29 Working Party points to the possibility of temporarily switching off location tracking as an important protection measure when private use is allowed. This is not a separate provision requiring a specific button in an application, but an interpretive guideline on the proportionality of monitoring. [4]

During implementation, it must be determined what "private mode" actually does. Does it stop recording the route, or only hide it on one screen? Who can still read it? What data remains necessary to settle the use of the car?

A private trip should also not be confused with every trip outside regular working hours. An evening callout to a breakdown may be work related. The rules should reflect the actual way work is performed.

Protecting a car against theft requires a separate assessment of the scope of access and the conditions for activating it. In itself, it does not justify daily review of private routes. [4]

What rights does the employee have?

The employee may ask about the monitoring rules and exercise the rights arising from RODO. [2]

An objection does not automatically mean that every form of monitoring must be disabled. The controller must assess it in accordance with Art. 21 RODO and demonstrate the grounds for further processing if it wants to continue it.

Requests concerning RODO rights are generally answered within one month, with the possibility of a legally permitted extension under the rules of Art. 12 sec. 3 RODO. [2]

For example, if a report assigns an employee a trip made by another person, the employee should be able to challenge that assignment. A point on the map does not determine on its own who was driving the car.

What obligations does an employee have?

Privacy does not exempt an employee from using the entrusted car properly.

Art. 100 § 1 and § 2 points 1, 2 and 4 of the Kodeksu pracy provide, among other things, for the obligation to perform work diligently, follow lawful instructions, observe working time and workplace rules, and protect the employer's property. [1]

In practice, this means following legally established rules for using the vehicle, reliably marking business and private trips, and reporting any defects noticed.

Using an agreed private mode is different from disconnecting the device on one's own or emitting interference. Concerns about the legality of monitoring should be reported to the employer or the data protection officer, instead of interfering with the installation.

Can an employee jam GPS in a company car?

No. An employee cannot treat a GPS jammer as a legal way to disable company monitoring.

A jammer emits interference. Its operation may also affect devices located outside the user's car. The fact that a device is available in an online store does not mean it may be switched on.

UKE explains that jammers are designed to cause harmful interference, which means they cannot meet the requirements for being lawfully placed on the market for civilian use. This also applies to devices advertised as a way to protect privacy. [6]

Which regulations apply to using a jammer?

Under Art. 138 sec. 1 of the Prawa komunikacji elektronicznej, using radio equipment requires a permit, except where regulations provide otherwise. An ordinary user cannot assume that a jammer benefits from exemptions applicable to lawful consumer devices.

Art. 447 of this act provides for:

• a fine from 500 to 5000 zł for using a transmitting or transmitting and receiving radio device without the required permit;
• in the case of persistent conduct - a fine, restriction of liberty or imprisonment for up to two years;
• the possibility of ordering forfeiture of the device, and in certain cases the obligation to order it. [7]

Applying a specific provision requires determining the type of device and the circumstances of its use. This does not mean that every single use automatically carries a two year prison sentence.

Even an employee's belief that the employer is conducting monitoring unlawfully does not make emitting interference legal. Such a situation should be clarified by requesting information, reporting it to the data protection officer, filing a complaint with UODO or using appropriate employment law measures.

What can the employee face from the employer?

Deliberately preventing properly introduced monitoring from working may breach the employee obligations indicated in Art. 100 Kodeksu pracy. The consequences depend on what has been proven, why the employee did it, what risk it created and whether damage occurred. [1]

For example, knowingly and repeatedly jamming the system to hide unauthorized use of the car may justify a much more serious response than an unclear, isolated incident. However, each case requires an individual assessment.

Can the employer simply deduct a penalty from salary?

The employer cannot arbitrarily set a "GPS fine".

Financial penalties under Art. 108 § 2 Kodeksu pracy apply to the violations indicated in that provision. Obstructing monitoring alone is not a separate, automatic basis for imposing such a penalty. [1]

Compensation is different from an order-related penalty. The employer must prove the conditions for liability, including the damage and its link to the employee's conduct. The rules of liability are set out in Art. 114-122 Kodeksu pracy, and in the case of entrusted property, Art. 124 and the following may also apply.

Art. 122 provides for full compensation for damage caused intentionally. However, intentionally switching on a jammer does not automatically mean intentionally causing every later item of damage.

The requested compensation also cannot be arbitrarily deducted from remuneration. The limitations arising from Art. 87 and 91 Kodeksu pracy apply. [1]

What should an employer do if it suspects jamming?

A reasonable order of action is:

• 1. Secure event data: time, reports, available diagnostic messages and vehicle information.
• 2. Check the installation with service support: determine whether there are technical reasons for the data loss.
• 3. Establish the facts: who used the car, what evidence there is of device use and what explanations the employee provides.
• 4. Verify the monitoring rules: whether it was introduced lawfully and whether the employee was properly informed.
• 5. Match the response to the findings: if there is a justified suspicion of illegal emissions, report the matter to UKE or the Police, and assess employment consequences separately.

Do not switch on a found jammer "as a test" in a parking lot. Verification of its operation should be left to authorized authorities or specialists acting under legally permitted conditions.

Before an order-related penalty is imposed, the employee must first be heard. The deadlines under Art. 109 Kodeksu pracy apply: as a rule, two weeks from learning of the breach and three months from the breach itself.

For termination under Art. 52, a one month deadline applies from learning of the circumstance justifying termination, along with the appropriate formal requirements and consultation with the trade union organization representing the employee, if such representation exists. [1]

What if the employee has already used a jammer?

Stopping use of the device does not automatically remove liability for earlier conduct. Employment consequences, liability under radio regulations and - if damage occurred and the conditions are met - liability for damages may apply. [1][7]

At the same time, the employee retains the right to challenge the allegations, provide explanations and seek legal assistance. The employee does not have to accept every data gap as proof of their own conduct.

If a disciplinary sanction was imposed unlawfully, art. 112 of Kodeks pracy provides seven days to file an objection. After it is rejected, the employee who filed the objection has 14 days to apply to the labor court to have the sanction revoked.

The time limit for appealing against a notice of termination or for seeking reinstatement or compensation after termination without notice is generally 21 days from delivery of the relevant letter, under art. 264 of Kodeks pracy. [1]

The right to privacy should be protected through clear monitoring rules and lawful safeguards. A jammer is not a substitute for private mode, and an employer cannot replace evidence with mere suspicion.

Can GPS be used to settle working time?

GPS data can help explain how the day unfolded, but driving time, ignition-on time and an employee's working time are different things.

A car may be stationary while an employee unloads goods or works at a client's site. It may also be moving during an permitted private trip.

The obligation to keep working time records and make them available to the employee on request follows from art. 149 § 1 of Kodeks pracy, subject to statutory exceptions. GPS history can be supporting material, but the map itself does not replace proper records. [1]

Data can work in favor of both sides. It can help the employer verify task completion and help the employee explain a late return after an intervention. Assessment requires comparing it with orders, the schedule and the actual scope of duties.

How long can GPS data be stored?

There is no single statutory retention period that applies to all GPS data.

The three-month limit in art. 22² § 3 of Kodeks pracy applies to video recordings. The reference for other forms of monitoring covers § 6-10, so it does not automatically extend that limit to location history. [1]

The retention period must be justified by the purpose and the storage limitation principle under art. 5(1)(e) of RODO. The technical ability to keep the full history is not a sufficient reason. [2]

In practice, it is worth defining current management needs separately from how specific data relating to a dispute is handled. Securing one incident should not automatically mean indefinite storage of all routes of the entire team.

Is the system provider responsible for the legality of monitoring?

Buying a system does not transfer decisions about the purpose of employee monitoring to the provider.

Usually, the employer is the data controller and the provider processes data on its behalf. In that case, arrangements compliant with art. 28 of RODO are needed. Safeguards also follow from art. 25 and 32. If the risk is high, an impact assessment under art. 35 is required. [2]

Before implementation, check whether the system allows you to restrict access to routes, set data retention, handle private trips and respond to employee requests.

The same applies to an AI assistant connected to telemetry. The ability to ask "where was the driver?" should not open access to data for someone who does not have permission to view it in the standard panel.

What should you do if monitoring raises concerns?

An employee can start by asking for the monitoring rules and pointing to a specific problem: tracking private routes, lack of information or incorrect trip assignment.

In data protection matters, a complaint may be filed with the President of UODO under art. 77 of RODO. Issues concerning compliance with labor law can be reported to Państwowa Inspekcja Pracy, and claims can be pursued before the competent court.

Documentation gaps are not just a formality. In its 2023 report, UODO described a case in which an employee was verbally aware of GPS, but the company had not set the required rules or provided the required information. The authority found a breach of information obligations. [5]

Clear rules protect both sides

The employer should be able to explain why it needs a specific piece of information. The employee should know what data is collected and where the limits of control are.

In practice, it is worth separating questions needed for fleet management from information about private life: whether the car reached the client, whether the task was completed, or whether there was a fuel loss that needs checking.

This approach is in line with the direction in which we are developing Multiflot: the system should provide the information needed for decisions and signal events that require attention. However, the scope of monitoring must always be adjusted to the work organization and applicable regulations.

Planning fleet monitoring? Start by defining needs and rules for using cars, then choose the system configuration together with the person responsible for labor law and data protection.

Legal status: 30 September 2026. This article is for information purposes only; a specific implementation or employee case requires an assessment of the monitoring purposes, its scope and the circumstances of the case.

Legal bases and source materials

• 1. Kodeks pracy - consolidated text, Dz.U. of 2026, item 1245. In particular, art. 11¹, 22², 22³, 30, 52, 87, 91, 100, 108-122, 124, 149 and 264.
• 2. RODO - text made available by UODO. In particular, art. 4-6, 12-18, 21, 25, 28, 32, 35 and 77.
• 3. UODO: which ground is the basis for data processing by an employer using monitoring?.
• 4. Opinion 2/2017 of the Article 29 Working Party on data processing at work. Especially section 5.7 on vehicles. Interpretative document, not a separate act.
• 5. Report of the President of UODO for 2023. Section "Employee monitoring using a GPS system", p. 63.
• 6. UKE: notice on jamming devices.
• 7. Prawo komunikacji elektronicznej of 12 July 2024. In particular, art. 138 and 447.
• 8. Sąd Najwyższy, ref. II PSKP 35/22. Judgment on the general conditions for a serious breach of employee duties, not a case about a GPS jammer.