Login
Privacy records · Free Excel template

Record of processing activities for GPS tracker and camera data

One register for the personal data your GPS trackers, driver-monitoring cameras and MDVRs create. Seven starter rows name the usual data. Purpose, legal basis, retention and transfers stay empty for you and your adviser.

Get the English file (.xlsx)Arabic version
Free: enter your name and e-mail and we send you the file. Works in Excel, Microsoft 365, Google Sheets and LibreOffice Calc. No macros.
  • 7 starter rows, 60 in total
  • Nothing is decided for you
  • Check column for empty fields
Needs legal review before use

A record of processing touches privacy and data law that differs by country and by activity. Ask your legal adviser to review the filled register, the legal basis for each row and every retention period before you rely on it. The template does not say that any law, rule or guideline is met. The example rows only show the format.

What's inside

Eight sheets: a register, a recipients list and a summary

You fill the Register and Recipients sheets. The Summary, the review dates and the Check column are calculated.

  1. 01

    Start here

    Who keeps the record, the review settings, six steps and the color key.

  2. 02

    Register

    27 columns, 60 rows. Seven are started for you. Check, next review and review status are calculated.

  3. 03

    Example

    Three made-up rows, one with a half-empty row so you can see the Check column work. Not counted.

  4. 04

    Recipients

    Providers, platforms, insurers, customers and authorities, with contract and country.

  5. 05

    Summary

    12 counts and a table by category, for example rows with no retention period.

  6. 06

    Review log

    One line per change or review, with the role that did it.

  7. 07

    Lists

    The drop-down lists. Edit them to your own words.

  8. 08

    Sources

    Where the field names come from, the official sources and the date they were checked.

The Check column

CompleteConfirm basisMissing 7

Review status

CurrentDue soonOverdueNot reviewed
One row, filled

How a finished row reads

The Example sheet holds three made-up rows. This is the first one.

Example row: vehicle location tracking (made-up values)
FieldExample
ActivityVehicle location tracking
CategoryLocation and trips (GPS)
Whose dataDrivers
Data itemsPosition, speed, heading, time, ignition
PurposeDispatch, safety and proof of service for customers
Legal basisTo be confirmed with counsel
RecipientsTracking platform provider
Sent abroad?No
Keep for180 days example only, set your own
Security measuresNamed logins, two-step sign-in, access log
Notice given?Yes
Last reviewed2026-09-01
Review statusCurrent (next review 2027-09-01)
CheckConfirm basis

The legal basis and the 180 days are example text. Your law and your facts decide yours.

What is a record of processing activities, and why should a fleet keep one?

A record of processing activities lists, in one place, what personal data you handle, why, where it goes, how long you keep it and who can see it. Many privacy rules ask organizations to keep something like it, or to produce it when a regulator or a customer asks. Whether yours does depends on your country, your size and what you do. Ask your adviser. The record is also useful on its own: it shows which camera clips nobody needs any more and which providers have no contract.

A fleet is a good case for a record because the data is easy to overlook. A tracker gives a position every few seconds. A driver-monitoring camera makes event clips of a face. Both are tied to a named driver, so both are personal data about people who work for you.

What personal data does a fleet system create?

  • Location and trips. Position, speed, heading, trip start and end, ignition.
  • Driver identity. Name, employee number, license number, card or RFID ID, sometimes a photo.
  • Driver behavior events. Fatigue and distraction alerts from DSM, forward-collision and lane alerts from ADAS, with time and place.
  • Video and audio. MDVR recordings, event clips and snapshots, audio if you switch it on.
  • Device and SIM identifiers. IMEI, ICCID, phone number and the plate they are tied to.
  • Portal accounts. The names, roles and login history of your own staff and your customers' staff.

The Register starts with one row for each of these. Rename, split or delete them to match what you really collect.

How to fill the register

  1. Start with the starter rows. Change the activity names to match your own systems. Add a row when the same data is used for a second purpose.
  2. Write the purpose in one plain sentence. If you cannot, the activity may be several activities. Split it.
  3. Pick the legal basis only with your adviser. The cell starts as "To be confirmed with counsel" in the Example sheet. The Check column keeps reminding you until you choose one.
  4. Follow the data. Where does it come from, which system holds it, in which country, who receives it, and does it leave the country?
  5. Set a retention period you can really keep. A number of days and the way it is deleted. An automatic rule is easier to keep than a monthly clean-up.
  6. Name a responsible role, not a person. People change jobs. Roles stay. Then enter the review date.
Ask your providers three things

Which data does the device or platform record, in which country is it stored, and for how long? Put the answers in the Register and the Recipients sheet. If a provider cannot answer, write that down too.

Four columns people leave out

  • Retention. Without a number of days nobody deletes anything. The Summary counts rows with no retention period.
  • Transfers. Cloud platforms often store data in another country. The column asks "yes, no or unsure". Unsure is a fine answer, and it is counted so you follow it up.
  • Notice. People should be told what you collect. The column asks whether they have been told fully, partly or not.
  • Processor contract. A provider that handles data for you is usually a processor. The Recipients sheet flags a processor without a contract.

Limits

This is a spreadsheet, not legal advice. It keeps what you type, counts what is empty and reminds you of review dates. It does not read your platform or your contracts, and it does not decide the legal basis, the retention period or whether a transfer is allowed. Starter text and example rows are prompts, not recommendations.

Sources and when they were checked

The field names follow common record-of-processing practice. Three official sources were read on 2026-11-03. Each is also on the Sources sheet.

  • EU GDPR, Article 30, records of processing activities (EUR-Lex): eur-lex.europa.eu. Used as a field list only.
  • SDAIA, Rules for Appointing a Personal Data Protection Officer (Saudi Arabia, official text, Art. 5): dgp.sdaia.gov.sa. It names location tracking and surveillance cameras as examples of regular and systematic monitoring.
  • Implementing Regulation of the Personal Data Protection Law, Article 33, records of processing activities (Umm Al-Qura Gazette, official text): uqn.gov.sa. Records are kept for the duration of processing and five years after it ends.

Source and date checked: 2026-11-03. Rules change, and your country may have others, so open the current text before you rely on it.

Related Tracom solution

Know which data your Tracom devices create

The record is only as good as your answers about the devices. Tracom makes the devices and the SCMS portal, and can tell you what each one records and where it is kept.

  • SCMS portal. Users and roles in one place, which makes the access column easier to fill.
  • Tracom ST100 and M1N. Ask us which data each device records, so that the Register matches what is really collected.
  • Questions on storage. Where data is stored and for how long are provider questions. We answer for our own platform.
Questions

Record questions, answered

Not sure what to put in a column? Talk to Tracom about the devices, and to your adviser about the law.

Do we have to keep a record like this?

It depends on your country, your size and what you do. Some rules require a record, some exempt small organizations, and some ask for it on request. This template does not decide that. Ask your legal adviser, and use the register either way: it shows what you hold.

Why are purpose, legal basis, retention and transfers empty?

Tracom cannot know your facts or your law. We pre-fill only the categories and the usual data items. The rest are yours. The Check column counts what is still empty so nothing is forgotten.

Can I use it for systems other than tracking and video?

Yes. Add rows for payroll links, fuel cards, access control or anything else, and choose "Other" as the category. The columns are not specific to telematics.

Does it replace an impact assessment (DPIA)?

No. The register only notes whether an assessment is done, not needed, not done or unsure. Our DPIA worksheet is a separate template. Ask counsel when one is needed.

How many rows does it hold?

60 rows in the Register and 25 in Recipients. Copy the last row down to add more, or keep one file per country or site.

What is Tracom's role here?

Tracom makes the devices. This record is a neutral template for your own files. It is not a legal service, and it does not read your accounts.

Next step

Fitting cameras and trackers for a large fleet?

Tell us the models and how many. We will tell you what each device records, so the register starts from the facts.

Contact Us Get the register
Related tools and templates

Keep going on privacy records

Get the report

Enter your details and we will email you the file.

Use your real name so the file arrives addressed to you. Don't worry, we won't flood you with emails or calls.

Tracom uses your details to send what you requested and may contact you about it. See our privacy notice for your rights and how to delete your data.

Tracom is an advanced GPS tracking device designed to enhance fleet visibility, safety, and efficiency through real-time data, intelligent alerts, and remote monitoring.

Device

Help

Facebook Youtube Linkedin Instagram X-twitter

Copyright © 2026 SAFEE

Scroll to Top