Tracker
Retrieve+
R99/month
Legal & Privacy · POPIA
GPS Tracker Data Privacy Laws in South Africa
When you subscribe to a GPS tracker, the provider collects a detailed history of your own vehicle's movements. This guide covers what South Africa's Protection of Personal Information Act (POPIA) says about that data — what's collected, how long a provider can keep it, who can see it, and what rights you have as the person being tracked.
This page is specifically about how your own tracking data — the location history a provider collects because you are subscribed to their service — is handled under POPIA. If your question is instead about whether it's legal to install a tracker on someone else's vehicle, or to track a vehicle without the driver's knowledge or consent, that's a different legal question covered on our is it legal to track someone else's car guide.
What's Collected
What Personal Data Does a GPS Tracker Actually Collect?
Location and trip data
Every GPS tracker logs your vehicle's coordinates, speed, direction and timestamps as it moves, building a detailed history of where you go, when, and how often. Many devices also record ignition on/off events, idling time, and harsh braking or acceleration. Because this data can identify where a specific person lives, works and travels, it counts as "personal information" under POPIA the moment it can be linked to you or your vehicle.
Account and billing data
On top of raw location data, tracking providers typically hold your name, contact number, vehicle registration, banking details for subscription billing, and installation address. Fleet accounts may also link this to an employer or driver profile.
The Legal Framework
POPIA and Vehicle Tracking Data
POPIA's core conditions
Providers must be accountable for how data is processed and secured, limit processing to a specific lawful purpose, collect only what's genuinely needed, be open about what's collected and why, and apply reasonable security safeguards.
The Information Regulator
South Africa's Information Regulator investigates complaints about misuse of tracking data, can issue enforcement notices against non-compliant providers, requires notification of qualifying data breaches, and can impose significant fines for serious violations.
Your Rights
Your Rights as a Data Subject Under POPIA
Access, correction and objection
As the person whose vehicle is being tracked, you have the right to request a copy of the location and account data held about you, ask a provider to correct inaccurate or outdated records, object to processing that goes beyond the original purpose, and withdraw consent for optional data sharing at any time.
Deletion and complaints
You can also request that your data be deleted once there is no lawful reason to retain it, ask how long your data will be stored before signing up, and lodge a complaint with the Information Regulator if a provider does not respond appropriately to a data request.
Retention, Sharing & Transfers
How Long Your Data Is Kept, and Who Can See It
Data retention
POPIA doesn't set a fixed retention period, but it does require that data isn't kept longer than necessary for the purpose it was collected. In practice, most South African tracking providers retain detailed location history for 6-24 months, then archive or delete it, keeping recovery-related records only as long as legally required.
Sharing with insurers, employers & authorities
Tracking data is commonly shared with vehicle insurers (for premium discounts), employers (for fleet management) and law enforcement (for stolen-vehicle recovery). Under POPIA this sharing must be disclosed upfront, limited to what's needed for that purpose, and covered by a lawful basis such as consent, contract or legal obligation.
Cross-border transfers
If a tracking app or platform stores data on overseas servers, POPIA requires that the destination country offers an adequate level of data protection, or that the transfer is covered by a binding agreement giving equivalent safeguards to what POPIA requires locally.
Security safeguards
Providers are expected to encrypt stored location data, restrict internal access on a need-to-know basis, and have a documented process for detecting and reporting data breaches to affected customers and the Regulator.
Before You Sign Up
Questions Worth Asking Before You Buy
A published privacy policy
Look for a plain-language policy that explains what data is collected and for how long it's kept.
Who else can access it
Confirm who else — insurers, employers, third-party apps — can access your location history, and on what basis.
Where it's stored
Ask whether your data is stored locally or transferred to servers outside South Africa, and what safeguards apply.
A clear request process
Check there's a straightforward way to request access, correction or deletion of your own data.
Frequently Asked Questions
Does POPIA apply to GPS tracker location data?+
Yes. Location data collected by a GPS tracker counts as personal information under POPIA whenever it can be linked to an identifiable person, such as a vehicle owner or driver. Tracking companies must have a lawful basis to collect, store and use this data.
How long can a tracking company keep my location history?+
POPIA requires that personal information isn't kept longer than necessary for the purpose it was collected. In practice, most South African tracking providers retain detailed location history for 6-24 months before archiving or deleting it.
What rights do I have over my own tracking data?+
As a data subject under POPIA you can request access to the personal information a tracking company holds about you, ask for corrections to inaccurate records, object to certain processing, and request deletion once there is no lawful reason to keep the data. You can also lodge a complaint with the Information Regulator.
Can a tracking company sell or share my location data?+
Not without a lawful basis and, in most cases, your consent. Providers may only share location data with third parties such as insurers, employers or law enforcement where this is disclosed upfront, necessary for the service, required by law, or separately consented to.
What about tracking someone else's vehicle without their consent?+
That's a separate legal question from your own data rights as a subscriber, and it involves South African privacy law more broadly rather than just POPIA's data-handling rules. See our dedicated is it legal to track someone else's car guide.
Keep Reading
Related Guides
Is It Legal to Track Someone Else's Car?
Consent, ownership and the narrow lawful exceptions under South African law.
Read more →Switching Your Tracker Provider
What happens to your account and data when you move to a new provider.
Read more →All Guides
Browse the full resource library for pricing, features and buying advice.
Visit the Guide hub →Questions About a Provider's Privacy Practices?
We can help point you toward providers that are upfront about how they handle your data. For anything beyond that, please consult a qualified attorney.