No detours.
Even overnight.
x25pronto Austria carries approved goods shipments by car, van or Van XL personally and without unnecessary transhipment. Direct and overnight trips can be booked Monday to Sunday – subject to availability in the booking calendar.
Live tracking and data protection for sensitive cargo
Live tracking increases transparency. For sensitive cargo, GDPR compliance is required. This guide covers technical options, consent and documentation duties.
Quick answer
You can implement live tracking in a GDPR-compliant way. Choose the right technology (separate tracker, vehicle freight mode, app with on-demand tracking), obtain lawful consent or rely on contract performance, minimize and pseudonymize data, and keep required records (processing register, DPIA, technical measures).
When is live tracking permitted?
Live tracking is allowed when you have a legal basis. For customer shipments, contract performance (Art. 6(1)(b) GDPR) often applies. For employee location data you will need consent or a documented legitimate interest assessment (Art. 6(1)(f)). Treat customer, sender/receiver and staff data separately in your risk review.
Technical options for sensitive tracking
Match technology to risk. Options include dedicated GPS trackers on parcels, vehicle devices with a freight-only mode, mobile apps with explicit tracking activation, and on‑demand tracking that only transmits data when requested. Use end-to-end encryption and limit storage windows. Separate telemetry from personal driver profiles where possible.
Consent and transparency requirements
Inform customers clearly before activating tracking: purpose, legal basis, retention, recipients. For personal location data obtain a verifiable consent or document the contractual need. For employees, follow special rules: transparency, works council consultation where required, and documented legal basis.
Data minimization, pseudonymisation and deletion
Collect only what you need: timestamp, position, shipment ID. Pseudonymise driver IDs and use encrypted shipment identifiers. Define automatic deletion periods and record them in your processing register.
Documentation and data protection impact assessment
Maintain a processing register with purpose, legal basis, categories of data and technical safeguards. If tracking poses high risk (continuous employee location monitoring, high‑value or sensitive cargo) conduct a Data Protection Impact Assessment (DPIA) and document mitigations.
Technical and organisational measures (TOMs)
Apply encryption in transit and at rest. Restrict access by role and log accesses. Use secure APIs with strong authentication and network restrictions. Regularly test systems for vulnerabilities and maintain retention and deletion logs.
Frequently asked questions
Do I always need consent for live tracking?
Not always. If tracking is necessary to fulfil a contract with a customer, Art. 6(1)(b) may suffice. For employee location data you usually need consent or a documented legitimate interest assessment. Evaluate each case.
How long can I keep location data?
Keep data only as long as necessary. Set concrete retention periods (for example 30–90 days for traceability) and automate deletion. Document retention in the processing register.
What documentation does my company need?
At minimum a processing register, a DPIA if the risk is high, records of consent or legal bases, descriptions of technical measures, and an access control policy.
Can tracking data be pseudonymised?
Yes. Pseudonymisation reduces risk. Replace direct identifiers with codes and store mapping data separately and securely. Full anonymisation is best where possible, but often hard to achieve.