Vehicle tracker location data: what POPIA says about where your car goes

A vehicle tracker records where your car is and where it has been. The Protection of Personal Information Act lists location information as personal information, so the provider must be lawful and reasonable, tell you what it collects and why, keep it secure, and let you ask to see it.

Why is tracker data personal information?

A tracker reports a position by satellite and sends it over the mobile network to a control room. Over time it builds a pattern: where the vehicle sleeps, where it goes to work, how fast it moves. Because the vehicle is registered to a person and the account is in that person's name, the data relates to that person.

The Protection of Personal Information Act, 2013 (POPIA), defines "personal information" as information relating to an identifiable, living natural person, and lists examples. One example, in paragraph (c) of the definition, is "any identifying number, symbol, e-mail address, physical address, telephone number, location information, online identifier or other particular assignment to the person". So location information is named in the Act.

That does not mean tracking is unlawful. It means that whoever collects the data, called the responsible party, must follow the eight conditions for lawful processing set out in section 4 of the Act (accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards and data subject participation).

What rules apply to the provider?

Several sections apply directly to a tracker provider.

Lawful and reasonable. Section 9 says personal information must be processed lawfully and in a reasonable manner that does not infringe the privacy of the data subject.

No more than needed. Section 10 says that, given the purpose, personal information may only be processed if it is adequate, relevant and not excessive. A stolen-vehicle service needs the position when an alarm is raised. Whether a provider also needs a long history of every journey is a fair question to put to it.

A valid basis. Section 11(1) lists the grounds on which personal information may be processed. They include your consent, processing that is necessary to carry out a contract with you, processing that complies with an obligation imposed by law, and processing that is necessary for the legitimate interests of the responsible party or of a third party to whom the information is supplied. Where it relies on your consent, the provider carries the burden of proving it, and you may withdraw consent at any time (section 11(2)).

Telling you. Section 18 says that when personal information is collected, the responsible party must take reasonably practicable steps to make sure you know, among other things: what is being collected, the name and address of the responsible party, the purpose, whether supplying it is voluntary or mandatory, the consequences of not supplying it, the recipients or categories of recipients, your rights of access, correction and objection, and your right to complain to the Information Regulator with its contact details.

Keeping it safe. Section 19 requires appropriate, reasonable technical and organisational measures to prevent loss of, damage to or unauthorised destruction of personal information, and unlawful access to or processing of it.

Not keeping it for ever. Section 14(1) says records must not be retained longer than necessary for the purpose they were collected for, unless retention is required or authorised by law, the responsible party reasonably requires them for lawful purposes related to its functions, a contract requires it, or you have consented. Section 14(4) requires the record to be destroyed, deleted or de-identified as soon as reasonably practicable after the provider is no longer authorised to retain it.

What are my rights?

Section 5 of POPIA sets out the rights of a data subject. Those that matter most here are:

• To be notified that your personal information is being collected (section 18).
• To find out and see. Section 23 says that once you have given adequate proof of identity, you may ask a responsible party to confirm, free of charge, whether it holds personal information about you. You may also ask for the record, or a description of it, including the identity of third parties or categories of third parties who have or have had access, within a reasonable time, in a reasonable manner and in a form that is generally understandable. A fee may be charged for the record, at the prescribed rate if any, and the provider must give a written estimate before it does the work (section 23(3)).
• To have information corrected, destroyed or deleted where necessary (section 24).
• To object. Under section 11(3)(a) you may object at any time, on reasonable grounds relating to your situation, to processing that rests on the legitimate-interest grounds in section 11(1)(d) to (f). Under section 11(3)(b) you may object at any time to processing for direct marketing. Once you object, the provider may no longer process the information for that purpose (section 11(4)).
• To complain to the Information Regulator about interference with the protection of personal information (section 74).

What should I ask a tracker provider?

These are fair questions to put to the provider who calls you, and you can ask for the answers in writing.

1. What exactly does the device collect: position only, or also speed, ignition status, harsh braking or driver identity?
2. Is position reported all the time, or only when an alarm is raised?
3. Who can see the data? Its own staff only, a recovery partner, the police, or an insurer?
4. Is any of it shared with my insurer or finance provider, and under what condition?
5. How long is journey history kept? What happens to it when I cancel?
6. Is my data used for marketing, and how do I opt out?
7. How do I ask to see what you hold about me?

If the answer to any of these is not clear from the contract, ask for the privacy notice. Section 18 expects you to be told these things when the information is collected.

What if the vehicle is shared, or I sell it?

A tracker follows the vehicle, but the data relates to the people who drive it. If family members drive the car, they are data subjects too. Tell them it is fitted.

If you sell the vehicle, ask the provider how to remove the device and close the account, so that the new owner's movements do not appear in your account, and your history is not kept longer than the provider is allowed to keep it. Check what your insurer or lender requires before you cancel, because an insurance condition may require a working tracker. See what a tracking condition on a policy means.

What if there is a data breach?

Section 19 requires the provider to secure the information it holds. Section 5(a)(ii) gives you the right to be notified if your personal information has been accessed or acquired by an unauthorised person, as provided for in section 22. If you think your tracker account has been accessed without your authority, tell the provider in writing, change your credentials, and ask what it will do about it.

What about an employer or a fleet?

If a business fits trackers to vehicles that employees drive, the business is a responsible party for that data and the employees are data subjects. The same sections apply. Fleet owners should be ready to tell drivers what is collected and why.

How do I complain?

1. Write to the provider and describe what happened. Keep a copy.
2. If you are not satisfied, section 74 of POPIA lets any person submit a complaint to the Information Regulator in the prescribed manner and form.
3. For disputes about the contract, such as a cancellation charge, see our guide on your rights on a tracker contract.

What does Olvian do with my details?

Olvian is a lead-referral service. You ask once, and your request goes to licensed providers who pay Olvian a fee and call you back. Olvian does not supply or monitor trackers. Our own handling of your details is explained in what Olvian does with your details.

Sources

Checked on 31 October 2026. Olvian is not a financial services provider and this guide is information, not advice.

• Protection of Personal Information Act 4 of 2013, Government Gazette 37067 of 26 November 2013: section 1 (definition of personal information), sections 5, 9, 10, 11, 14, 18, 19, 22, 23, 24 and 74.