Location data produced by a vehicle tracking system is personal data under Türkiye's Personal Data Protection Law (KVKK) because it can be linked to the person driving. Tracking company vehicles is not forbidden, but the purpose must be defined, employees must be informed with a privacy notice, the data must be limited to that purpose and protected against unauthorised access.
Why is location personal data?
Law No. 6698 on the Protection of Personal Data (KVKK) treats any information relating to an identified or identifiable natural person as personal data. The Personal Data Protection Authority's guides list location among examples of personal data.
A tracker records where the vehicle is; but if a particular employee drives that vehicle at particular times, the record indirectly shows where the employee is. Fleet data should therefore be handled as the employee's personal data.
Which legal basis applies?
Article 5 of the KVKK lists the conditions for processing personal data. Besides explicit consent, these include processing necessary for the performance of a contract, compliance with a legal obligation, and the data controller's legitimate interest, provided it does not harm the person's fundamental rights and freedoms.
The Authority's guide points out cases in the employment relationship where the employee is not genuinely free to refuse consent. Relying only on "the employee signed a consent form" is therefore risky; it is usually sounder to define clearly which legitimate purpose tracking serves (vehicle security, operational planning, fuel and maintenance management and so on).
This article is general information, not legal advice. Design the practice in your company together with a lawyer.
Informing employees (duty to inform)
Article 10 of the KVKK requires the data controller to inform people when collecting their personal data. For vehicle tracking, the practical answer is a written privacy notice for employees who use company vehicles. It should at least cover:
- Which data is collected (location, speed, ignition on/off, route history and so on)
- For what purpose and on which legal basis
- Who can see the data and to whom it may be transferred
- How long the data is kept
- The employee's rights under Article 11 of the KVKK and how to apply
A checklist for good practice
- Write down the purpose: state why tracking is done in a vehicle use policy and share it with employees.
- Limit the data to the purpose: do not collect what operations do not need, and do not keep it longer than necessary.
- Restrict access: only people who need location history for their work should see it; set user permissions in the software accordingly.
- Address private use: if vehicles are also used privately outside working hours, decide in advance how that period is handled and ask your lawyer.
- Secure the data: Article 12 of the KVKK requires technical and administrative measures; encrypted connections, strong passwords and access logs are the basics.
- Ask your provider: find out on which servers and in which country the data is stored, and who can access it.
Domestic infrastructure and data security
When choosing a tracking system, where and how the data is kept matters as much as price and features. Weaver is a vehicle tracking and fleet management system made of hardware designed and manufactured by Aselsis in Türkiye and its own software; its multi-user structure lets you control who in your teams can access fleet data.
Frequently asked questions
- Is vehicle tracking against the KVKK?
- No, tracking itself is not forbidden. But since location is personal data, it must serve a defined purpose, employees must be informed, and the data must be limited and protected.
- Do employees have to give explicit consent?
- Not in every case; the KVKK also lists other bases such as performance of a contract, legal obligation and legitimate interest. Because consent in employment is often not truly free, decide the legal basis with a lawyer.
- What should employees be told?
- Which data is collected and why, who can see it, how long it is kept and their rights under the KVKK, in a written privacy notice.
- How long should location data be kept?
- The law sets no single period; data should be kept only as long as needed for its purpose. Define the period in your company's retention and destruction policy.
Sources