BTP · GDPR

Construction — GDPR: worksites, time-tracking and subcontracting

The construction sector processes employee and subcontractor data, including badge access, time-tracking and sometimes geolocation. GDPR requires proportionality, transparency and security of data flows within cascading subcontracting arrangements. This guide details these processing activities and a tailored roadmap.

DPO / CISO team — Data Comply One Updated on 15 June 2026

In brief

  • Regulation: GDPR.
  • General contractors, subcontractors, prime contractors, and equipment lessors are all concerned.
  • Proportion the scoring.
  • Governing geolocation.
  • Securing subcontracting.
  • Fines of up to €20M or 4% of global turnover.

Regulatory deadlines

The key dates of this regulation.

May 2018

Entry into application

In force

What does GDPR cover?

GDPR applies to data relating to employees, subcontractors and job sites. Badge access, time tracking and geolocation must be proportionate and disclosed; employee geolocation is subject to particularly strict rules. Cascading subcontracting multiplies the data flows that need to be secured.

Each processing activity requires its own legal basis and retention period.

Is the 'Construction' sector affected?

General contractors, subcontractors, prime contractors and equipment lessors are all concerned. The subcontracting chain involves numerous data exchanges (employees, certificates).

Service providers (fleet management software, vehicle telematics) are data processors.

Detailed obligations

Proportioning the tracking

Governing badge and time-tracking systems: purpose, information, retention periods.

Govern geolocation

Proportionate geolocation of equipment and staff, with appropriate notification.

Securing subcontracting

Clarify roles and secure cascading data exchanges.

Secure and limit

Data security and appropriate retention periods.

Inform

Informing employees and subcontractors of their rights.

Sanctions & risks

Fines of up to €20M or 4% of global turnover. Disproportionate geolocation of staff is a recurring ground for sanctions.

Common mistakes in the sector

  • 1Permanent geolocation. Continuously monitoring staff without justification.
  • 2Unregulated subcontracting. Exchanging data without clarifying roles.
  • 3Uninformed time-tracking. Deploying time-tracking without informing employees.
  • 4Excessive retention. Retain data beyond what is necessary.

Practical case

A company was continuously geolocating its staff via equipment and exchanging employee data with subcontractors without any framework. The remediation proportions the geolocation, informs employees, and secures subcontracting data flows.

Compliance roadmap

  1. 1

    Map. Map scoring, geolocation and subcontracting.

  2. 2

    Right-size. Frame badge systems and geolocation.

  3. 3

    Secure. Subcontracting flows.

  4. 4

    Durations. Define by purpose.

  5. 5

    Inform. Update privacy notices.

Frequently asked questions

Only in a proportionate and informed manner; continuous monitoring of individuals is excluded.

Back to the BTP guide

Take action on GDPR

Free assessment or a chat with an expert dedicated to btp.

Start my free assessment Talk to an expert

They already trust us

See how organisations in the btp sector secured their compliance with DCO.

See testimonials