Is GPS Tracking Your Employees Legal in Switzerland? What revFADP Really Requires

Almost every Swiss business owner asks the same question before installing fleet or asset tracking: is this even legal? Here is what Swiss law actually requires, under Article 328b of the Code of Obligations, Article 26 of the Employment Act Ordinance, and the revised Federal Act on Data Protection (revFADP). And here is what a compliant rollout looks like in practice.

For most Swiss SMEs, the hesitation is not about the technology. It is about the conversation that has to happen first. Owners picture a difficult meeting. A workforce that feels watched. A step backwards in trust built over years.

That concern is fair, and Swiss law reflects it directly. GPS tracking of employees is legal in Switzerland. But only within a specific, fairly narrow set of conditions. Once you understand those conditions, a legal grey area becomes a straightforward operational decision.

What Swiss law actually requires

Three legal sources apply together. Each one narrows what an employer can do.

• Article 328b of the Code of Obligations limits data processing to what relates to a job. That means an employee's suitability for the role, or what the employment contract requires. Vehicle and asset location during working hours fits here. Where an employee goes on personal time does not.
• Article 26 of Ordinance 3 to the Employment Act bans systems built to continuously watch employee behaviour or performance. Tracking a vehicle's location and hours worked is not the same thing. A system designed to score or judge a person is. That distinction matters legally, not just practically.
• revFADP, in force since September 2023, requires three things before any tracking system goes live: a documented legal basis, data minimisation, and a clear privacy notice. It also applies one core principle: proportionality. If a lighter method gets the same result, the law expects you to use it.

Put together, these three sources are less restrictive than they first sound. Say you run a Swiss SME. You track company vehicles and equipment during working hours. The goal is to prove hours, protect assets, and coordinate teams across sites. In that case, your legal basis is usually straightforward. The real requirement is not to avoid tracking. It is to scope it correctly, document it, and keep business use separate from private use.

Do you need a full impact assessment?

Article 22 of revFADP adds one more question to answer before rollout: could this processing create a high risk to someone's personality or fundamental rights? If yes, you need a formal Data Protection Impact Assessment, or DPIA, before you start.

Most Swiss SMEs tracking company vehicles will not cross that threshold. If tracking stays limited to working hours, scoped to job needs, and paired with a private-use toggle, the risk stays low.

The picture changes with scale or intent. A very large fleet, a system built to continuously score driver behaviour, or tracking combined with other sensitive data can push a project into "high risk" territory. In that case, Article 23 requires you to consult the FDPIC, the Federal Data Protection and Information Commissioner, before going ahead.

Even for smaller rollouts, it is worth writing one short note explaining why you concluded the risk was low. That paragraph becomes your defence if anyone ever asks.

What happens when a company skips this step

The FDPIC investigates data protection complaints in Switzerland. It can open an inquiry, issue binding orders such as a demand to stop processing, and refer serious cases to the cantonal prosecution authorities. What it cannot do is issue a fine itself.

That power sits with the cantonal prosecutors. Under revFADP, wilful violations carry a criminal fine of up to CHF 250,000. The fine targets the individual responsible for the breach, typically the owner or director who signed off on the rollout, not the company. Only intentional violations are fined this way. If a company genuinely cannot identify who was responsible, it can instead face a fine of up to CHF 50,000 itself, though this is the exception rather than the rule.

In practice, trouble rarely comes from companies using GPS tracking for real operational reasons. It comes from companies that installed it quietly, skipped the documentation, or never separated business use from private use. The legal risk sits almost entirely in how you roll it out, not in the tracking itself.

A practical checklist before you switch anything on

Any Swiss employer considering fleet or asset tracking can work through the same five steps:

• Write down the legal basis in plain terms: job performance or contract necessity, nothing broader.
• Separate business and private use, so personal time is never recorded.
• Hold an information session before installation. Then collect a signed acknowledgment from each employee.
• Limit access to tracking data to the people who actually need it, and log every access.
• Our data is hosted in Germany, a country on the whitelist of approved jurisdictions for data hosting, in line with the classification of data stored in LF360°.

None of this requires a lawyer to execute. But for larger or more complex fleets, a quick legal review is worth the hour.

Built compliant from the start

Logifleet builds these requirements into the platform itself, not as an add-on. A native business/private toggle lets employees stop tracking with one tap during personal trips, so private trips are never revealed. Production data sits in Germany, at an ISO 27001-certified facility, in line with our data protection commitments. Every account access is logged and visible to administrators. And instead of leaving you to draft your own employee notice from scratch, Logifleet gives you a consent letter template to use before rollout.

More than 700 Swiss companies, managing over 15,000 vehicles and employees between them, already run on this setup. For teams that want the technical detail behind it, a full Technical and Organisational Measures document is available on request from support@logifleet.ch.

The pattern holds at any company size. Rollouts that lead with transparency rarely run into resistance later. The legal requirement and the practical path to employee buy-in turn out to be almost the same thing.

Talk to us about a compliant tracking rollout for your fleet.

Frequently asked questions

Is GPS tracking of employees legal in Switzerland? Yes. Swiss law allows GPS tracking of employees during working hours. It must relate to job performance or the employment contract (Article 328b CO). It must avoid continuous behavioural surveillance (Article 26, Ordinance 3 to the Employment Act). And it must follow the proportionality principle under revFADP.

Do I need employee consent to track company vehicles? Not always. Most employers rely on job necessity or legitimate business interest instead of consent. That said, informing employees clearly before rollout, and collecting a signed acknowledgment, builds trust. It also gives you a documented record if the approach is ever questioned.

What is revFADP and how does it affect fleet tracking? revFADP is Switzerland's revised Federal Act on Data Protection. It has been in force since 1 September 2023. Location data from a GPS tracker counts as personal data under the act. That means any tracking system needs a documented legal basis, data minimisation, and a privacy notice before you switch it on.

Does GPS fleet tracking require a formal Data Protection Impact Assessment? Only if the processing is likely to create a high risk to personality or fundamental rights (Article 22 FADP). Standard fleet tracking, scoped to job-related use, with a private-mode toggle and limited access, usually sits below that threshold for a typical Swiss SME. Larger fleets, continuous behavioural scoring, or combining tracking with other sensitive data raise the risk, and the case for a DPIA.

Can employers track where an employee drives outside working hours? No. Personal use of a company vehicle falls outside what an employer can process under Article 328b CO. A business/private toggle, which stops recording location during personal use, is the standard way Swiss companies keep this separation clean.

Can the FDPIC fine my company directly? No. The FDPIC can investigate, issue binding orders, and refer serious cases to the cantonal prosecution authorities, but it has no power to impose fines itself. Criminal fines of up to CHF 250,000 are decided by cantonal prosecutors, and only for intentional violations.

What are the penalties for non-compliant employee tracking in Switzerland? Wilful violations under revFADP can bring fines of up to CHF 250,000. That fine is usually imposed on the individual responsible for the breach, not on the company as a whole, unless that individual genuinely cannot be identified.

References

1. https://www.edoeb.admin.ch/en/data-processing-by-the-employer
2. https://www.edoeb.admin.ch/en/monitoring-systems-in-the-workplace
3. https://iclg.com/practice-areas/cybersecurity-laws-and-regulations/switzerland/
4. https://www.ey.com/en_ch/insights/law/a-new-era-for-data-protection-in-switzerland-are-you-ready
5. https://www.lexology.com/library/detail.aspx?g=08b266e9-007d-42b0-b948-292cdd8f5d49
6. https://www.employee-monitoring.net/compliance/employee-monitoring-laws-switzerland
7. https://www.edoeb.admin.ch/dam/en/sd-web/TGyUMXOckOkg/merkblatt_dsfa.pdf
8. https://www.edoeb.admin.ch/en/criminal-law
   

This article summarises general legal principles for informational purposes and is not legal advice. For a specific rollout, loop in your legal counsel or data protection advisor.