POPIA for SA Fleets: What Driver Data You Can Track 2026

Published: 22 September 2026

Digital transformation logistics South Africa is no longer optional for fleet operators who want to survive the next decade. The Protection of Personal Information Act (POPIA) has fundamentally changed how you can collect, store, and use driver data from telematics systems, dashcams, and fleet management software. Get it wrong, and you face fines of up to R10 million or 10 years imprisonment under the Information Regulator's enforcement powers.

But here is the reality most fleet operators miss: POPIA does not ban driver monitoring. It regulates it. You can still track vehicle location, monitor driving behaviour, and use telematics data for operational decisions. You just need to do it properly.

This guide covers exactly what driver data you can legally track, what requires explicit consent, how long you can keep it, and how to handle driver access requests without disrupting your operations.

What Does POPIA Mean for Fleet Telematics in South Africa?

POPIA treats any information that can identify a specific driver as personal information. This includes GPS location data, driver scorecards, biometric data from fatigue monitoring systems, and even dashcam footage that shows a driver's face.

For SA fleet operators, this creates specific compliance requirements:

• Telematics data tied to a specific driver is personal information
• Vehicle-level data (without driver identification) falls outside POPIA's scope
• Dashcam footage showing faces or number plates is personal information
• Biometric data from fatigue detection systems requires explicit consent

The key distinction is whether data can be linked to an identifiable individual. A vehicle's fuel consumption is not personal information. That same consumption data attributed to Driver X becomes personal information the moment you link it to a specific person.

Many operators assume installing a tracking device automatically breaches POPIA. It does not. The RTMS scheme actually requires vehicle tracking as part of its accreditation criteria. What matters is how you handle the data, not whether you collect it.

What Driver Data Can You Legally Track Without Explicit Consent?

POPIA provides a crucial exemption for fleet operators: legitimate interest. You can process personal information without consent when you have a legitimate business interest that does not override the driver's rights.

For transport and logistics operations, legitimate interest covers:

Operational necessity data:

• Real-time vehicle location for dispatch and scheduling
• Speed monitoring for safety compliance
• Route adherence for delivery verification
• Engine diagnostics for maintenance planning
• Fuel consumption for cost management

Compliance-driven monitoring:

• Driving hours for National Road Traffic Act compliance
• Rest period tracking to prevent fatigue-related accidents
• Load weights for overloading prevention
• Certificate of Fitness documentation linked to vehicle assignments

Safety and security data:

• Harsh braking and acceleration events
• Accident reconstruction data
• Vehicle theft recovery information
• Emergency location tracking

The critical requirement is proportionality. You can track a driver's speed because it directly relates to road safety. You cannot track their personal phone calls during rest periods because that has no legitimate operational purpose.

What Requires Explicit Driver Consent Under POPIA?

Some monitoring crosses the line from legitimate interest into requiring explicit, informed consent. SA fleet operators must obtain written consent before collecting:

Biometric data:

• Facial recognition from in-cab cameras
• Fingerprint scanning for vehicle access
• Iris recognition systems
• Fatigue detection that analyses facial features

Health-related information:

• Medical fitness assessments linked to driver profiles
• Substance testing results
• Fatigue monitoring data that indicates health conditions

Communication monitoring:

• Recording in-cab audio conversations
• Accessing driver mobile phone data
• Monitoring personal communications during work hours

Off-duty tracking:

• GPS location outside working hours
• Vehicle use during personal time (unless company policy prohibits it)

Consent must be specific, informed, and voluntary. A blanket clause buried in an employment contract does not meet POPIA's requirements. Drivers must understand exactly what data you collect, why you collect it, and how you use it.

T-ERP's driver management capabilities include consent tracking features that document when drivers acknowledge monitoring policies. This creates an audit trail proving you obtained proper consent before implementing specific monitoring technologies.

How Do You Structure a POPIA-Compliant Driver Monitoring Policy?

Your driver monitoring policy is your first line of defence against POPIA complaints. It must be clear, accessible, and comprehensive.

Essential policy components:

1. Purpose specification - State exactly why you monitor each data type
2. Data inventory - List every type of driver data you collect
3. Legal basis - Explain whether each data type relies on consent or legitimate interest
4. Retention periods - Specify how long you keep each data type
5. Access rights - Explain how drivers can request their data
6. Security measures - Describe how you protect driver data
7. Third-party sharing - Identify who receives driver data and why

The policy must be provided to drivers before they start work. Existing drivers must receive updated policies with adequate time to review them. Keep signed acknowledgement records for every driver.

For mining operations, integrate your POPIA policy with your mining transport compliance documentation. The Mine Health and Safety Act has its own driver monitoring requirements that overlap with POPIA considerations.

How Long Can You Retain Driver Data in South Africa?

POPIA requires that you keep personal information only as long as necessary for the purpose it was collected. For fleet operators, this creates a balancing act between operational needs, legal requirements, and privacy rights.

Minimum retention periods (regulatory requirements):

| Data Type | Minimum Retention | Legal Basis |
|-----------|------------------|-------------|
| Driving hours records | 5 years | National Road Traffic Act |
| Accident investigation data | 5 years | COID Act, civil liability |
| Vehicle inspection records | 2 years | NRTA Regulations |
| Weighbridge records | 3 years | RTMS, overload regulations |
| Cross-border trip records | 5 years | C-BRTA requirements |

Recommended retention (operational needs):

• Real-time GPS data: 90 days rolling, then purge or anonymise
• Driver scorecards: 2 years for performance trend analysis
• Dashcam footage: 30 days unless incident occurs, then 5 years
• Telematics raw data: 12 months, then aggregate and anonymise

The key principle is purpose limitation. Once data no longer serves its stated purpose, you must delete it or anonymise it so it cannot identify individual drivers.

T-ERP's fleet management system includes automated data retention rules. You set retention periods for each data type, and the system automatically archives or purges data according to your POPIA-compliant schedule.

What Happens When a Driver Requests Access to Their Data?

Under POPIA Section 23, drivers have the right to request access to all personal information you hold about them. You must respond within a reasonable time, and you cannot charge excessive fees.

The access request process:

1. Driver submits written request (email is acceptable)
2. You verify the driver's identity
3. You have 30 days to respond
4. You provide data in an accessible format
5. You explain the sources and recipients of the data

For fleet operators, common access requests include:

• Historical GPS location data
• Driver scorecard calculations and raw data
• Dashcam footage featuring the driver
• Performance reports submitted to clients
• Any data shared with insurers or third parties

You can charge a reasonable fee for data compilation, but not for providing basic access. The fee must not discourage drivers from exercising their rights.

Exemptions to access rights:

You can refuse access requests if disclosure would:

• Reveal another person's personal information
• Prejudice ongoing legal proceedings
• Compromise crime prevention activities
• Reveal commercially sensitive decision-making processes

Document every access request and your response. This creates an audit trail if the Information Regulator investigates.

How Do You Balance Operational Necessity with Driver Privacy?

The tension between operational needs and privacy rights is real. Fleet operators need comprehensive data to manage costs, ensure safety, and meet client requirements. Drivers deserve privacy and dignity at work.

The solution is proportionality. Ask three questions before implementing any monitoring:

1. Is this data necessary? Could you achieve the same operational goal with less intrusive monitoring?
2. Is this data proportionate? Does the benefit to your business justify the privacy impact on drivers?
3. Is this data secure? Are you protecting this data adequately against breaches?

Practical examples:

Dashcams: You can use forward-facing cameras to record road conditions and accidents without consent. Driver-facing cameras require consent because they capture biometric data. Consider whether you actually need driver-facing footage, or whether forward-facing cameras meet your insurance and safety requirements.

GPS tracking: Real-time location during work hours is legitimate. Tracking drivers during rest periods in their personal vehicles is disproportionate. Configure your telematics to respect off-duty boundaries.

Driver scorecards: Using telematics data to identify unsafe driving patterns is legitimate. Publishing individual driver scores to clients without driver knowledge breaches trust and potentially POPIA. Aggregate data protects privacy while still demonstrating fleet performance.

Read our guide on driver performance management for detailed strategies that respect privacy while improving safety outcomes.

What Are the Penalties for POPIA Non-Compliance?

The Information Regulator can impose significant penalties on fleet operators who breach POPIA:

Administrative fines:

• Up to R10 million for serious breaches
• Enforcement notices requiring immediate changes
• Public naming that damages your reputation

Criminal offences:

• Up to 10 years imprisonment for intentional obstruction
• Criminal liability for directors and responsible officers
• Personal liability even when acting through a company

Civil liability:

• Drivers can sue for damages caused by data breaches
• Class actions from multiple affected drivers
• Compensation for emotional distress, not just financial loss

Beyond legal penalties, POPIA breaches damage driver trust and make recruitment harder. The transport industry already faces driver shortages. A reputation for invasive monitoring makes attracting quality drivers even more difficult.

How Does T-ERP Support POPIA-Compliant Fleet Management?

T-ERP was built for South African transport operators navigating local regulations including POPIA. The platform includes specific features for compliant driver data management:

Consent management:

• Document driver acknowledgement of monitoring policies
• Track which drivers consented to specific monitoring types
• Flag data collection that lacks proper consent

Data retention automation:

• Set retention periods per data type
• Automatic archiving and purging on schedule
• Audit trails showing what was deleted and when

Access request handling:

• Generate comprehensive driver data reports
• Export data in standard formats for access requests
• Document response timelines and outcomes

Purpose limitation:

• Role-based access controls restrict who sees driver data
• Data segregation prevents unnecessary exposure
• Audit logs track every access to driver information

The technology modules integrate these compliance features with your daily operations. You do not need separate systems for POPIA compliance - it is built into how you manage your fleet.

For operators using CAN bus and OBD data, T-ERP processes vehicle telemetry while maintaining clear boundaries between vehicle data and driver personal information.

What Should SA Fleet Operators Do Next?

POPIA compliance is not a one-time project. It requires ongoing attention as your operations evolve and regulations develop. Start with these priorities:

Immediate actions (next 30 days):

1. Audit current data collection against POPIA requirements
2. Draft or update your driver monitoring policy
3. Identify any monitoring that requires consent you have not obtained
4. Review data retention practices and set deletion schedules

Short-term improvements (next 90 days):

1. Implement access request procedures
2. Train operations staff on privacy requirements
3. Review telematics contracts for data protection clauses
4. Configure systems to enforce retention policies automatically

Ongoing practices:

1. Include POPIA in driver induction processes
2. Annual review of monitoring policies and practices
3. Regular audits of data access and retention compliance
4. Stay current with Information Regulator guidance

The FleetWatch SA industry publication regularly covers regulatory developments affecting SA fleet operators, including POPIA enforcement trends.

Conclusion

POPIA compliance for SA fleet operators comes down to transparency, proportionality, and respect. You can legally track the data you need for safe, efficient operations. You just need to tell drivers what you collect, why you collect it, and how long you keep it.

The practical steps are straightforward: document your monitoring purposes, obtain consent where required, set appropriate retention periods, and respond properly to access requests. Most of what you already do with telematics and fleet management is perfectly compliant under the legitimate interest exemption.

T-ERP's integrated fleet management platform handles the technical complexity of POPIA-compliant data management. Automated retention policies, consent tracking, and access request tools are built into the system you already use for daily operations.

Do not let POPIA fear prevent you from using the technology that makes your fleet safer and more efficient. Get your policies right, configure your systems properly, and focus on running your business.

See how T-ERP handles driver data compliance - book a demo to see the privacy controls in action.

---

The information in this article is for general guidance only. Regulations and requirements may change - always verify current requirements with the relevant South African regulatory authority.

Frequently Asked Questions

Can I track driver location 24/7 with GPS telematics?

You can track vehicle location during working hours under the legitimate interest exemption. Tracking drivers during off-duty periods or in personal vehicles requires explicit consent and a clear operational justification. Most operators configure systems to pause tracking when vehicles are parked at driver residences outside working hours.

Do I need written consent for dashcam footage?

Forward-facing dashcams that only record the road do not require consent. Driver-facing cameras that capture facial features are biometric data under POPIA and require explicit, written consent. Ensure your consent form specifically mentions in-cab cameras and explains how footage will be used.

How do I respond if a driver asks to see their telematics data?

You must respond within 30 days. Provide the data in an accessible format such as PDF reports or spreadsheets. You can charge a reasonable fee for compiling extensive historical data, but you cannot refuse a legitimate request. Document your response in case of future disputes.

What happens if I have a data breach affecting driver information?

You must notify the Information Regulator and affected drivers as soon as reasonably possible. Document the breach, its cause, and the remedial steps you have taken. Failure to notify can result in additional penalties on top of the original breach consequences.

Can clients require me to share individual driver data?

You can share aggregated fleet performance data without driver consent. Sharing identifiable individual driver data requires either driver consent or a contractual basis that drivers were informed about during onboarding. Review client contracts to ensure data sharing clauses are POPIA compliant.