Employee GPS Tracking and Consent: Where Monitoring Crosses the Line in India

In India, the act of employers tracking their employees through GPS raises legal concerns because of the intersection of the needs of the employer and the right to privacy of employees that has been enshrined through the Puttaswamy judgment and various acts such as the Digital Personal Data Protection (DPDP) Act. As per the law, it is legitimate for an employer to track the location of their employees in relation to their employment duties such as proving attendance, maintaining field safety, and logistics management. It is, however, illegal to engage in such activities if they do not adhere to the principles of transparency, necessity, and proportionality. The guidelines provided by Indian law for such data protection require that the tracking of employees should be done after giving prior written notice, within duty hours, with their explicit consent for personal gadgets, and continuously throughout their off-duty lives.

What Is Employee GPS Tracking?

In regard to the Indian labor market, location tracking refers to the utilization of mobile applications, telematics, and wearable technology in order to capture location information from field executives, deliverers, sales persons, and transportation staff. The rapid digitalization of logistics, quick-commerce, and gig economy companies operating in India has resulted in making location monitoring an integral part of business processes logging working hours, validating client visits, optimizing routes of deliveries, and automating travel allowance payouts. From the legal perspective, Indian law allows performing location monitoring on an operational basis as per Section 7 of the Digital Personal Data Protection (DPDP) Act, recognizing employment and enterprise HR activities as legitimate grounds for collecting data without the need to obtain consent every time.

The legal requirements in India place stringent limits on the use of location data, which are dictated by the privacy right ruling of the Supreme Court of India in Puttaswamy, as well as by the provisions of the DPDP Act. It is required that the employer develop clear policies stating what is being tracked, how it will be protected, and who has access to it. Tracking should be limited to shift time only, starting from check-in and ending at check-out; any tracking outside of this timeframe or round-the-clock tracking violates the privacy right and imposes severe financial sanctions according to the statute. Moreover, in case of the use of personal phones in a BYOD setting, the employer may track location only within the app used at work and not the entire phone.

Why Should Employers Care About GPS Tracking Rules in India?

Employers need to carefully consider the employee GPS tracking regulations in India because of extraterritorial laws, vendor liability, and data transfer challenges:

1. Extraterritorial Scope of Indian Data Protection Legislation: Pursuant to Section 3 of India’s DPDP Act, compliance requirements apply outside the boundaries of India as well. If a corporation oversees, supervises, or processes personal information, including current GPS tracking locations about their overseas workers, subcontractors, or subsidiary employees in India, then it will be considered a Data Fiduciary in accordance with Indian legislation.
2. Enormous Financial Fines: Any infringement of the regulation comes with severe legal penalties. An illegal surveillance process, absence of proper documentation, or processing of location data without adequate authorization is subject to a fine of up to ₹250 crore for each violation under the DPDP regime.
3. Vendor Joint Liability: In case Indian companies use services of Indian third-party vendors (BPOs, IT companies, or logistic firms) for performing business processes, they should take into account vendor liability issues. In case the Indian vendor employs non-compliant location tools (e.g., 24/7 surveillance of personal BYOD devices), such actions may adversely affect the Indian employer's position.
4. Cross-Border Data Transfer & Regulatory Audits: Transfer of employee location details from India to servers based in India must be done keeping in mind purpose limitation and encryption, with a mandatory 72-hour breach notification requirement. The unregulated flow of data leads to compliance violations and hampers cross-border operations.
5. Reputation and Operational Risk: The invasive monitoring policies conflict with the recognized fundamental right to privacy guaranteed by the Supreme Court of India (Puttaswamy case). Errors lead to workplace complaints, high staff turnover, and a bad reputation that hinder any business benefits associated with being present in India.

Do Employers Need Consent to Track Workers in India?

Indeed, employers need the legal basis to track their employees in India, but according to the current laws of the country, explicit consent is not always required to conduct routine work monitoring. Still, notice and strict policy compliance are legal obligations.

1. Legitimate Purpose vs. Explicit Consent (DPDP Act): According to Section 7 of the Digital Personal Data Protection (DPDP) Act in India, employment purposes (such as attendance, payroll, field safety, client billing, etc.) fall into the legitimate uses category. Explicit consent is not obligatory for the routine work-hour tracking required for job completion.
2. Mandatory Written Notice: Though case-by-case consent for each item of tracking is not mandatory for legitimate employment uses, notice is strictly obligatory. An employer should issue a transparent policy which would specify what data is collected and why, how long it is stored, and who has access to it.
3. Explicit Consent for Tracking Outside Working Hours: If the employer is going to track location outside shift time, including breaks, leave time, or even 24/7 tracking, he/she should have an explicit, freely provided and withdrawable consent, although, usually, the practice would fail the test of proportionality based on the fundamental right to privacy.
4. Bring Your Own Device (BYOD) & Personal Asset Tracking: If tracking is done using the personal smartphone or personal vehicle of the employee, then prior written consent of the employer is required. Tracking should be done within a particular workplace application in the log-in/log-out window, not through the entire device.
5. Proportionality and Duty Hours: In accordance with the judgment by Puttaswamy on privacy, tracking should be proportional. Tracking that happens without notice and outside of duty hours is a violation of privacy and subjects the employer to monetary liability up to ₹250 crore under DPDP.

Is Employee GPS Tracking Legal Under Indian Law?

1. Legitimate Use under the DPDP Act: The provisions in Section 7 of the Digital Personal Data Protection (DPDP) Act consider employment-related and HR related activities such as verification of attendance, safety of field workers, reimbursement of travel expenses, and billing and invoicing of clients to fall under legitimate uses. As such, there is no requirement for an employer to obtain separate and specific consents for location tracking of work hours.
2. Mandatory Prior Written Notice: While consent is not required for regular work functions, prior written notice is mandatory. A privacy notice that explains what location data is being collected, the purpose of data collection, the data retention period, and who all have access to the information is necessary. Any sort of hidden tracking is illegal.

• Proportionality Test (Puttaswamy Judgment): According to the Supreme Court ruling in respect to the right to privacy, tracking should always be proportionate to its operational purpose.
• Legal: Tracking of the field executive/delivery personnel during working hours (between login and logout).
• Illegal: 24x7 tracking, tracking outside work hours, or location tracking when the employee is on leave.

        3. BYOD Policies: Monitoring the personal smartphone of an employee can be done through sandboxed work-related applications that record locations during working hours. Any other means of monitoring would amount to a violation of DPDP guidelines as well as the Constitution.

Where Does Location Monitoring Cross the Privacy Line?

1. Off-Duty and 24/7 Monitoring

• Monitoring employees beyond their official work shifts during break times, weekends, and even during their leaves of absence.
• As soon as an employee leaves, the employer forfeits the right to a legitimate employment purpose stipulated in Section 7 of the DPDP Act. Permanent or 24/7 monitoring infringes upon the basic right to privacy, as personal time implies reasonable expectations of not being tracked by employers.

2. Secrecy and No Transparency

•  Installing invisible tracking applications, running silent background services, or tracking locations without giving any notice in writing.
• Transparency is obligatory under Indian data protection laws. The provisions of Section 6 of the DPDP Act require notifying employees in writing before tracking them regarding what data will be collected, why, and for how long. Invisible location tracking constitutes a violation of the law in its core regardless of the time of day or night when it takes place.

3. Intrusive BYOD Practices

• Gathering data at device-level (the entire smartphone location) instead of limiting data collection to the sandboxed workplace application only.
• In case of personal devices, full-device tracking will result in the collection of personal trip data that may include visits to sensitive locations like medical facilities, places of worship, bank branches, or residences of individuals. Employers need to gather location data only through an enterprise application.

4. Disproportionate And Excessive Data Gathering

• Gathering detailed and frequent GPS pinpoints of individuals whose job functions do not require physical movements.
• The necessity and proportionality requirement in the Puttaswamy framework will be violated in the case of gathering location data when less intrusive methods like periodic check-ins or geo-fencing would have sufficed.

What Risks Do Employers Face When Tracking Goes Too Far?

1. Enormous Financial Fines Imposed by the DPDP Law

According to the Digital Personal Data Protection (DPDP) law, there is a strict obligation on purpose limitation, safeguarding, and mandatory notification. In case of noncompliance, the financial penalties are as follows:

• Security and Safeguard Violations (Maximum of ₹250 Crore): The lack of technical measures (e.g., data encryption or access control measures) to safeguard the stored GPS location logs from unauthorized access or breach. 
• Breach Notification Fails (Maximum ₹200 Crore): Failure to report a breach of employees' location data to DPBI and affected employees.
• Notice and Rights Violation (Maximum ₹50 Crore): Location tracking without prior notice or without mentioning purpose or neglecting requests from employees to access or delete location logs.

2. Constitutional Privacy Litigation (Puttaswamy Violation)

Under the important case of Puttaswamy, privacy is established as a fundamental right under Article 21 of the Indian Constitution.

• Exposure to Litigation: Surveillance of employees outside their shift schedule, logging their movements even while on leave, or installing any background spyware on employees' devices exposes the company to legal action in the Indian civil court or writ petitions before State High Courts.
• Refusal to Accept Forced Consent Claims: Courts do not recognize forced consent provisions (consent to 24X7 surveillance or quit the job) since there is an imbalance in power between employers and employees.

3. Vicarious & Joint Liability of Third Party Providers

Indian companies and international companies that use the services of India's BPOs, staffing companies, or IT providers for managing their operations suffer joint liability:

• According to the principle of DPDP: The Data Fiduciary (the principal) will be liable for the breach of data caused by the Data Processor (tracking software company or outsourcing vendor).
• In Case of any Breach: Location or GPS logs outside work by third-party software, the principal suffers direct regulatory action and proceedings.

What Rights Do Employees in India Have Over Their Location Data?

1. Right to Prior Written Notice (Transparency): Workers should have the right to get a separate, plain language notice before location tracking is done. This notice should clearly indicate which tracking technology is being used, what information exactly is being collected (GPS locations, timestamps, etc.), the specific purpose of such use, and who will have access to it from inside or outside the company.
2. Right to Purpose and Temporal Limitations: Workers should have the right to be tracked only when they are actively working and for the specified professional purposes. Tracking should be automatically turned off at the time of shift checkout, lunch times, on weekends, and on leave periods.
3. Right of Access and Summary: Workers have the right to request a summary of all location data processed about them by the employers. They can request to view location logs, GPS signal pinging frequency, and any third parties (for example, clients of a BPO company, software providers) who have been receiving such location data.
4. Right to Correction and Right to Erasure: Employees have the right to dispute inaccurate location records (such as incorrect attendance records due to GPS drifting and application errors) and seek correction. Further, when the purpose of the data collection is achieved (or the statutory audit period expires), employees have the right to ask for permanent deletion of their past location records.
5. Right to Redress: The law mandates that employers appoint a specific Grievance Officer or redress channel. Employees have the right to raise grievances pertaining to intrusive tracking, off-duty logging, or unauthorized access without any fear of workplace retribution.
6. Right to approach the Data Protection Board of India (DPBI): In case the employer fails to redress a location privacy grievance within the statutory period (or indulges in any clandestine or illegal 24/7 tracking activity), employees have the right to raise a complaint directly to the DPBI, which can give statutory orders and fine the employers up to ₹250 crore.

Pro-tip

For full compliance and keeping your employees' trust, create a “Login to Logout” tracking framework on your company mobile apps, so that location tracking self-deactivates when an employee logs out; make sure BYOD configurations track the sandboxed business app, not the entire device; have a single-page policy that clearly outlines your location tracking rules, and periodically wipe historical GPS coordinates when the payroll or travel expense claims clear the audit.

Conclusion

GPS tracking for employees in India can be legally done only through a balance between the legitimate interests of the business and the privacy rights of employees. According to the DPDP Act and constitutional privacy laws, the tracking should remain limited to working hours, should include written notification, and shouldn’t violate employees’ privacy outside duty hours. With growing technology in the field of GPS location tracking, it is very important to introduce ethically designed HR, fleet, and field force tracking tools. At Techimply, your source for finding and comparing any business application, companies can choose the best tracking solutions for hassle-free operations while respecting the privacy limits of the workforce.