When you subscribe to a GPS tracker, the provider collects a detailed history of your own vehicle's movements. This guide covers what South Africa's Protection of Personal Information Act (POPIA) says about that data — what's collected, how long a provider can keep it, who can see it, and what rights you have as the person being tracked.
This page is specifically about how your own tracking data — the location history a provider collects because you are subscribed to their service — is handled under POPIA. If your question is instead about whether it's legal to install a tracker on someone else's vehicle, or to track a vehicle without the driver's knowledge or consent, that's a different legal question covered on our is it legal to track someone else's car guide.
Every GPS tracker logs your vehicle's coordinates, speed, direction and timestamps as it moves, building a detailed history of where you go, when, and how often. Many devices also record ignition on/off events, idling time, and harsh braking or acceleration. Because this data can identify where a specific person lives, works and travels, it counts as "personal information" under POPIA the moment it can be linked to you or your vehicle.
On top of raw location data, tracking providers typically hold your name, contact number, vehicle registration, banking details for subscription billing, and installation address. Fleet accounts may also link this to an employer or driver profile.
Providers must be accountable for how data is processed and secured, limit processing to a specific lawful purpose, collect only what's genuinely needed, be open about what's collected and why, and apply reasonable security safeguards.
South Africa's Information Regulator investigates complaints about misuse of tracking data, can issue enforcement notices against non-compliant providers, requires notification of qualifying data breaches, and can impose significant fines for serious violations.
As the person whose vehicle is being tracked, you have the right to request a copy of the location and account data held about you, ask a provider to correct inaccurate or outdated records, object to processing that goes beyond the original purpose, and withdraw consent for optional data sharing at any time.
You can also request that your data be deleted once there is no lawful reason to retain it, ask how long your data will be stored before signing up, and lodge a complaint with the Information Regulator if a provider does not respond appropriately to a data request.
POPIA doesn't set a fixed retention period, but it does require that data isn't kept longer than necessary for the purpose it was collected. In practice, most South African tracking providers retain detailed location history for 6-24 months, then archive or delete it, keeping recovery-related records only as long as legally required.
Tracking data is commonly shared with vehicle insurers (for premium discounts), employers (for fleet management) and law enforcement (for stolen-vehicle recovery). Under POPIA this sharing must be disclosed upfront, limited to what's needed for that purpose, and covered by a lawful basis such as consent, contract or legal obligation.
If a tracking app or platform stores data on overseas servers, POPIA requires that the destination country offers an adequate level of data protection, or that the transfer is covered by a binding agreement giving equivalent safeguards to what POPIA requires locally.
Providers are expected to encrypt stored location data, restrict internal access on a need-to-know basis, and have a documented process for detecting and reporting data breaches to affected customers and the Regulator.
Look for a plain-language policy that explains what data is collected and for how long it's kept.
Confirm who else — insurers, employers, third-party apps — can access your location history, and on what basis.
Ask whether your data is stored locally or transferred to servers outside South Africa, and what safeguards apply.
Check there's a straightforward way to request access, correction or deletion of your own data.
Yes. Location data collected by a GPS tracker counts as personal information under POPIA whenever it can be linked to an identifiable person, such as a vehicle owner or driver. Tracking companies must have a lawful basis to collect, store and use this data.
POPIA requires that personal information isn't kept longer than necessary for the purpose it was collected. In practice, most South African tracking providers retain detailed location history for 6-24 months before archiving or deleting it.
As a data subject under POPIA you can request access to the personal information a tracking company holds about you, ask for corrections to inaccurate records, object to certain processing, and request deletion once there is no lawful reason to keep the data. You can also lodge a complaint with the Information Regulator.
Not without a lawful basis and, in most cases, your consent. Providers may only share location data with third parties such as insurers, employers or law enforcement where this is disclosed upfront, necessary for the service, required by law, or separately consented to.
That's a separate legal question from your own data rights as a subscriber, and it involves South African privacy law more broadly rather than just POPIA's data-handling rules. See our dedicated is it legal to track someone else's car guide.
Consent, ownership and the narrow lawful exceptions under South African law.
Read more →What happens to your account and data when you move to a new provider.
Read more →Browse the full resource library for pricing, features and buying advice.
Visit the Guide hub →We can help point you toward providers that are upfront about how they handle your data. For anything beyond that, please consult a qualified attorney.