VIMS EHSVIMS EHS

Lone Worker · GDPR

Locating Lone Workers and GDPR — Safety Without Surveillance

Locating a worker is processing personal data, so it needs a clear purpose, a legal basis and a scope limited to the minimum necessary. In lone-worker protection the purpose is fast help in an emergency — not productivity control or tracking outside work.

A worker who feels tracked will switch the app off. A worker who understands that location is used only to rescue them will use it.

  • GDPR
  • GPS
  • Monitoring
  • Privacy
  • Lone Worker

Published: 2026-10-19 · Updated: 2026-10-19 · 9 min read · Varilo deployment team

VIMS EHS — Gloved hand holding a smartphone with a privacy shield icon, a control room with a single red incident marker on a plant map behind
Gloved hand holding a smartphone with a privacy shield icon, a control room with a single red incident marker on a plant map behind

1. Legal basis and GDPR principles

The Polish Labour Code (Art. 22³ § 4) allows forms of monitoring other than CCTV and email where necessary, among others, for worker safety — provided the purpose, scope and method are set out in work rules or a notice and workers are informed at least two weeks before launch. Other EU countries have comparable rules.

GDPR adds purpose limitation, data minimisation and storage limitation (Art. 5). In practice: collect as much location as needed to provide help, and only when needed. Consider a DPIA or at least a documented risk analysis.

VIMS EHS diagram: worker GPS location during a protection session, location sharing on SOS, session end, GDPR data minimisation and retention
VIMS — illustrative protection-session diagram, not an app screen (labels in Polish). Location may be processed during an active session; sharing, access and retention are defined in the data protection procedure.

2. 24/7 tracking is a mistake

Constant location of all workers all day breaches data minimisation, creates resistance and is rarely needed. Workers must not be located outside working time, and safety data must not be used for productivity assessment unless that purpose was declared.

3. The protection session model

In VIMS Lone Worker, background location runs only during an active protection session started and ended by the worker. Outside a session the app does not collect location. Before first use the worker sees the purpose and scope of data and grants the system permissions.

Location and zone are shared with authorised people primarily in the context of an alarm. Indoors, where GPS can be inaccurate, a QR/NFC scan provides context — you know which zone the worker checked in at, without continuous tracking.

4. Implementation checklist

Define the purpose (lone-worker safety), scope (who, when, what data), retention period and who has access. Update work rules or the notice, inform workers in advance, update the privacy notice and the record of processing. Train dispatchers on access rules.

5. Glossary: location data, data minimisation, DPIA, protection session

Worker location data (GPS, Wi-Fi, zone from a QR/NFC point) is personal data under the GDPR. Processing needs a legal basis (usually Article 6(1)(c) or (f) linked to the duty of safety) and must respect data minimisation and purpose limitation.

Employee monitoring under Articles 22² and 22³ of the Polish Labour Code requires the purpose, scope and method to be set out in work regulations or a notice, with workers informed in advance. A DPIA (data protection impact assessment, Article 35 GDPR) is recommended and often required for systematic monitoring of employees.

A protection session is a time-limited period in which the app processes location solely for safety — started and ended by the worker. The retention period defines how long alarm and location history is kept; it should follow from the purpose (e.g. documenting incidents), not convenience.

Key takeaways

  • Locating workers is permissible when it serves safety and is limited to the minimum.
  • Work rules or a notice and advance information to workers are required.
  • Worker-started protection sessions instead of 24/7 tracking.
  • QR/NFC points provide zone context without continuous monitoring.

Related modules

Lone Worker — protection for people working alone

Lone worker protection — for people who work alone and in the field

A technician at a client site, a maintenance worker on the night shift, a driver on the road, an inspector inside a tank. If something goes wrong, there is nobody to call for help. This module shortens the time before someone finds out.

Explore the VIMS EHS module: Lone Worker — protection for working alone

QR / NFC access points

QR / NFC Access Points — everything about a zone in one scan, no login

A worker scans a code or taps a tag and instantly sees what applies to their zone: chemicals, instructions, LOTO, risks and a reporting form.

Explore the VIMS EHS module: Zero-login QR/NFC access points

Frequently asked questions

Does the employer need worker consent for location?

The basis is usually a legal provision and the duty to ensure safety, not GDPR consent. The phone's operating system still requires location permissions.

Does VIMS locate workers after their shift?

No. Background location runs only during an active protection session started by the worker.

Where is the data stored?

In EU-region infrastructure, in line with the VIMS privacy policy and data processing agreement.

Is worker location tracking 'monitoring' under labour law?

It can be, so the purpose, scope and method of processing location should be set out in work regulations or a notice and communicated to workers before rollout.

Is a DPIA required before rollout?

For systematic monitoring of employees a data protection impact assessment is often required. Even when optional, it structures risks and safeguards.

How long should location history be kept?

Only as long as the purpose requires. Session data without incidents can be deleted quickly; alarm-related data is kept as incident records under the retention policy.

Protect people, don't track them

Try VIMS Lone Worker with protection sessions and clear information for employees.

Book a demo Knowledge base