Is tracking security guards legal in the UK?

Compliance Published 23 February 2026 · 9 min read

Short answer: yes, tracking security officers during their shifts is lawful in the UK, and it is standard practice across the industry. But "lawful" comes with conditions, and getting them wrong causes more trouble internally than it ever does with a regulator.

This is general information about common practice, not legal advice. Your obligations depend on your specific circumstances, and you should take your own advice before rolling anything out.

What the law actually requires

The relevant framework is the UK GDPR and the Data Protection Act 2018, with the ICO's employment practices guidance sitting on top of it. In plain terms, four things have to be true.

1. You need a lawful basis

For monitoring staff, most employers rely on legitimate interests. Consent is generally inappropriate in an employment relationship, because an officer who fears for their job cannot freely refuse.

Legitimate interests requires you to be able to show a three-part test: there is a real business purpose, the monitoring is necessary to achieve it, and it does not override the individual's rights. Write that down. A page is enough, and it is what you would produce if you were ever challenged.

2. It has to be proportionate

This is where employers get into difficulty. Collecting location during a booked shift, to manage patrol coverage and officer safety, is straightforwardly proportionate. Collecting location 24 hours a day is not, and no amount of paperwork makes it so.

The single most useful control here is technical: use a system that only tracks while an officer is clocked on. It turns a difficult argument into a simple statement of fact.

3. You must be transparent

Staff must know what is collected, why, who can see it, how long it is kept and what their rights are. Covert monitoring of employees is only justifiable in genuinely exceptional circumstances — suspected serious criminality, with a documented decision — and is not something to attempt without proper advice.

In practice, transparency means:

• A clear section in the staff handbook or a standalone monitoring policy.
• A line in your employee privacy notice.
• Mention of it at induction, and at rollout for existing staff.
• Ideally, a signed acknowledgement — not as a consent, but as evidence you told them.

4. Data minimisation and retention

Collect what you need and keep it for as long as you need it. Two years of minute-by-minute location history for every officer is very hard to justify. Set a retention period, write it down, and configure the system to honour it.

Do you need a DPIA?

A Data Protection Impact Assessment is required where processing is likely to result in a high risk to individuals, and systematic monitoring of employees is specifically called out by the ICO as a likely trigger. For most security companies rolling out guard tracking, doing one is the sensible and defensible choice.

It does not need to be elaborate: what you are doing, why, what data, who sees it, what the risks to staff are, and what you have done to reduce them (shift-only tracking, access controls, retention limits). Two or three pages.

The part that actually goes wrong

In our experience the regulator is rarely the problem. The problem is a rollout handled badly, which produces resentment, a grievance, and officers who leave their phones in the gatehouse.

What works:

• Tell people before you switch it on, not after. Discovering they are tracked is what causes the damage.
• Lead with the safety features. SOS alerts and check-in timers protect officers working alone at night. That is genuinely the strongest part of the case, and it is true.
• Be explicit about the boundary. "It records location while you are clocked on and nothing when you are not." Say it plainly, repeatedly, and in writing.
• Explain who can see it. Officers assume everyone can. Tell them it is the control room and their manager.
• Do not use it for petty enforcement. If the first thing you do is discipline someone for a nine-minute break, you have taught your workforce exactly what the system is for.

A workable rollout sequence

1. Write your legitimate interests assessment and a short DPIA.
2. Draft or update the monitoring policy and employee privacy notice.
3. Brief supervisors first, so they can answer questions on the ground.
4. Announce it to all staff with the reasoning, the boundary and the safety features up front.
5. Give notice — two to four weeks is reasonable — before it goes live.
6. Run one site as a pilot and let those officers report back to the rest.
7. Review after three months: is what you are collecting still necessary?

Your clients will start asking anyway

Worth noting: the commercial pressure now runs in the same direction as the compliance one. Tender questionnaires increasingly ask about real-time monitoring, lone worker provision and audit trails. Companies that have done this properly — with the policy, the assessment and the evidence — answer those questions in a paragraph. Companies that have not, do not win the work.

How tracking works in SMS-Patrol · Lone worker features · Our privacy policy