GPS Location Tracking

Location tracking is the most legally sensitive capability in workforce software and the one most likely to generate a formal complaint if configured carelessly. It is also genuinely valuable for field operations, where the alternative is a paper timesheet and a great deal of trust.

The defensible uses are narrow and share one property — the location answers an operational question rather than satisfying curiosity:

• Site attendance verification — confirming a shift started at the job it was billed to, which is the single largest source of payroll leakage in field work
• Job attribution — allocating hours to the right client or cost centre automatically rather than from recollection at the end of the week
• Dispatch and routing — sending the nearest available technician to an urgent call
• Lone worker safety — knowing where someone is when they miss a check-in, which in some sectors is a duty of care rather than a preference
• Travel time and mileage — substantiating reimbursement without manual logs

The indefensible use is continuous surveillance of a person's whereabouts. Tracking outside working hours, tracking on a personal device between shifts, or retaining a detailed movement history with no operational purpose will fail under scrutiny in most jurisdictions and will damage trust in all of them.

This is the most consequential configuration decision, and most organisations make it by accident rather than deliberately.

Continuous tracking records a position every few seconds or minutes, producing a complete movement trail. It drains battery, generates a large volume of sensitive data, and answers almost no question that event sampling does not.

Event sampling records a position only at meaningful moments — clock-in, clock-out, geofence entry and exit, job start and completion. It is materially lighter on battery, produces far less sensitive data, and answers every legitimate operational question listed above.

Track Nexus samples at events by default. The rare genuine exception is lone worker safety, where a periodic position during a shift is a duty-of-care requirement rather than a monitoring one — and that should be configured explicitly for the roles that need it, with the reason documented, rather than enabled globally because it was available.

The privacy dividend is not merely presentational. Data you never collect cannot be breached, subpoenaed, or requested under an access right. For automated site boundaries, see geofencing time tracking.

GPS is less precise than most people assume, and building policy on an unrealistic accuracy assumption is a reliable way to generate disputes with your own field staff.

• Open sky — accuracy in the range of a few metres, which is fine for site-level verification
• Urban environments — signal reflection off buildings routinely degrades this substantially, and a worker genuinely standing on site can read as being across the street
• Indoors and underground — GPS may be unavailable entirely, with the device falling back to network positioning that can be off by hundreds of metres
• Device variation — older and budget handsets are meaningfully less accurate than recent flagships, which matters when staff use their own phones

The operational consequence is that geofence radii should be generous, and a location exception should open a question rather than trigger a sanction. A geofence tight enough to catch someone clocking in from the car park is also tight enough to flag dozens of people who are exactly where they should be, and each false positive costs more credibility than the occasional real exception is worth.

Where verification genuinely matters, pair location with identity rather than tightening the radius — facial recognition attendance confirms who clocked in, which is the question a tight geofence is usually a poor proxy for.

Location is treated as sensitive personal data in most privacy regimes, with obligations beyond those applying to ordinary activity data. This is orientation rather than legal advice.

• United States — no single federal rule, but several states restrict GPS tracking of employees, and California's CPRA gives access and deletion rights over precise geolocation specifically. Tracking a personal vehicle outside working hours is the clearest exposure.
• India — the DPDP Act, 2023 requires notice, consent and purpose limitation. Location collected for attendance cannot be quietly repurposed for something else without addressing consent again.
• Australia — the Privacy Act treats location as personal information; NSW and the ACT surveillance legislation requires written notice at least 14 days before tracking begins, and covert tracking generally requires judicial authorisation.
• Singapore — the PDPA applies, with notification duties and a reasonableness test on the business purpose.
• UAE — Federal Decree-Law No. 45 of 2021 sets the baseline, with DIFC and ADGM operating separate and generally stricter regimes.

Three configuration choices carry most of the compliance weight in practice: track only between clock-in and clock-out, sample at events rather than continuously, and set a short retention period for coordinate-level detail while keeping aggregate attendance for payroll and statutory records. Our guide to employee monitoring laws by country covers the wider picture, and mobile time tracking explains the offline behaviour that determines whether field data is trustworthy at all.