DPIA Example (2026): Fleet Telematics and an AI Driver Score

This page shows selected extracts from an unfinished data protection impact assessment (DPIA) for a common situation: an employer fitting telematics to its vans, with a weekly driver score produced by a machine-learning model. The company, the supplier and the people are fictional. The text was produced by our DPIA tool on 8 November 2026 from a test scenario, then shortened for this page; the names of real cloud and support providers in the scenario have been replaced with generic descriptions. It is shown as the tool produced it, including its gaps, so the commentary between the extracts explains what each part does and why.

The scenario

A parcel delivery company in Limerick plans to fit a supplier's telematics platform to all 140 of its vans from 1 December 2026, to coincide with new electric vehicle leases. The platform records each van's location every 30 seconds while the ignition is on, together with braking, acceleration, cornering, idle time and charging, and produces a weekly Driver Efficiency Score from 0 to 100. The company wants to use the score in quarterly reviews and a new bonus scheme: the bottom 10% of drivers would get a coaching plan, and anyone scoring below 40 for two months running would be referred to a formal performance meeting. Most drivers take their van home overnight. Two vans were fitted the week before as a trial, and the drivers have not been told.

Screening

Result: a DPIA is required.

Processing already running: two vans at the Limerick depot were fitted in the week before 8 November 2026 as a trial, and they are already sending data to the supplier. This DPIA is being carried out on 8 November 2026, after that processing began. It does not cure the period before it.

Criteria met from the European data protection regulators' guidelines on DPIAs (WP248 rev.01): systematic monitoring, because van location is recorded every 30 seconds while the ignition is on, together with driving behaviour; evaluation or scoring, because of the weekly Driver Efficiency Score; data concerning vulnerable data subjects, because the people affected are employees and there is an imbalance of power between them and their employer; matching or combining datasets, because HR records are combined with telematics data; innovative use of new technological solutions, because a machine-learning score will be used in staff reviews and bonuses.

Ireland: the Data Protection Commission's list of processing that needs a DPIA makes a DPIA mandatory where a documented screening indicates that the processing is likely to result in a high risk. The items that appear to be engaged are item 4 (systematically monitoring, tracking or observing individuals' location or behaviour), item 3 (use of profiling or algorithmic means that results in legal or similarly significant effects, which depends on how the score is used) and item 9 (combining datasets where the linking is used for profiling or behavioural analysis). This screening indicates a likely high risk.

The screening does two things worth copying. It records why each criterion is met, in terms of this processing, rather than ticking boxes; and it deals with the trial as processing that is already running, stating plainly that a DPIA carried out afterwards does not cure the period before it.

Description of the processing (extract)

The company decides how this information is used, which makes it the controller. The supplier handles the data for the company as its processor, under a data processing agreement countersigned in late October 2026.

Purposes stated by the company: to cut energy costs; to plan charging; to improve driving standards after three insurance claims this year; to work out what drivers are owed for charging at home; and to use each driver's weekly score in quarterly reviews and a new bonus scheme.

People affected: about 160 drivers. Most take their van home overnight, and about a third charge it at home. The vehicle use policy allows limited personal use of up to 30 km a day.

Where the data goes: it is hosted by a cloud provider in Singapore, with model training infrastructure and support ticketing provided by companies in the United States. The supplier may use "aggregated and de-identified" data to train its models, acting as a separate controller of that data, unless the company opts out in writing.

What drivers have been told: the current employee privacy notice (March 2023) and the vehicle use policy both say the company does not monitor vehicles.

The description separates what the documents say from what the company has confirmed, and it flags the facts that drive the risks: home use of the vans, the supplier's right to train on the data, and a privacy notice that says the opposite of what is planned.

Lawful basis (extract)

Chosen basis, not yet confirmed: the person completing this assessment chose legitimate interests (Article 6(1)(f) GDPR), subject to confirmation by the company's HR manager. Until the HR manager confirms it, the lawful basis is not established.

The interest, why the processing is necessary for it, and the weighing against drivers' interests and reasonable expectations will be recorded separately for each use: energy cost and charging planning; driving standards and coaching; home-charging reimbursement; and use of the score in reviews, bonuses and formal performance action.

Consent was considered unsuitable because staff may not feel free to refuse their employer.

A single legitimate-interests statement covering every purpose would not survive scrutiny here, because the weighing for planning charging is very different from the weighing for using a score in pay decisions. The draft therefore sets up a separate assessment for each use.

Risk register (extract)

Risk to individuals	Source	Likelihood	Severity	Before	After
Drivers of the two trial vans lose privacy: their home location and private trips have been recorded and stored	Trial running; GPS every 30 seconds while the ignition is on; vans taken home; private mode off; 24-month default retention	Probable	Significant	High	High
Once live, drivers' evenings, home location and private trips are recorded	Planned rollout; most vans taken home; personal use allowed; home-charging detection	Probable	Significant	High	Medium
Drivers are unaware of the tracking and cannot exercise their rights	Trial drivers not told; privacy notice says there is no vehicle monitoring	Probable	Significant	High	High
Drivers lose bonus or face formal action because of an inaccurate or biased score	Machine-learning score used for bonuses and performance meetings; human review not decided; no accuracy or bias testing known	Possible	Severe	High	High
Drivers' data is accessed abroad without adequate protection	Hosting in Singapore; US sub-processors; transfer clause details not provided; no transfer impact assessment known	Possible	Significant	Medium	Medium
Drivers' data is used to train the supplier's models	Default settings unchanged; the supplier's de-identification claim not confirmed	Possible	Significant	Medium	Medium

Three features of the register matter. Each risk is described as a harm to drivers, not to the company. Three risks stay high after measures, because the measures for them are only recommendations or have not been confirmed in effect: the first risk, about the trial, stays high until the pause and the deletion of the off-duty data are confirmed. Two risks, about transfers and model training, are medium before and after, because the recommended steps have not been taken. The second risk is shown as medium after measures only as an expected score, conditional on the company implementing its decisions to track only during working hours and to switch off home-charging detection; how those will be set up, and who will do it, were still unresolved when the draft was produced.

AI systems (extract)

The company is established in Ireland and uses the score under its authority, so it is a deployer under the AI Act. Systems "intended to be used ... to monitor and evaluate the performance and behaviour of persons in such relationships" are listed as high-risk (Annex III, point 4), and a listed system "shall always be considered to be high-risk where the AI system performs profiling of natural persons" (Article 6(3)). The Driver Efficiency Score is therefore likely to be a high-risk AI system. The high-risk rules for these systems apply from 2 December 2027.

If a decision with legal or similarly significant effects, for example on pay or formal performance action, were based solely on automated processing, Article 22 GDPR would apply. The company needs to decide, and record, meaningful human review before any such use.

This example was produced before the tool was updated, on 9 November 2026, to record the transitional rule in Article 111(2) of the AI Act. For a high-risk system already placed on the market or put into service before 2 December 2027, the Act applies to its operators only if the system is subject to significant changes in its design from then on, without prejudice to the prohibited practices in Article 5; providers and deployers of high-risk systems intended to be used by public authorities must comply by 2 August 2030 in any event, which does not affect this private employer. A current version of this section would record when the system was first used and whether its design is expected to change.

Outcome and actions (extract)

Status: Draft: points to resolve before approval. This document is not an approved DPIA. No processing has been approved, and the decision on going live is not yet taken. Proposal: that go-live, including any restart of the trial and any use of the Driver Efficiency Score, does not take place before the points below are resolved and the controller's decisions recorded.

Decisions recorded on 8 November 2026: pause tracking on the two trial vans now; tell the two trial drivers in person on Monday 9 November; ask the supplier to delete the off-duty location data already collected and confirm in writing; keep the existing expense forms for home charging and switch off home-charging detection; once live, track vans only during working hours; legitimate interests chosen as the lawful basis, subject to the HR manager's confirmation.

Residual risk: three risks are currently high. Prior consultation with the Data Protection Commission remains to be decided once the measures are settled. If any residual risk remains high after the measures the company confirms, the company must consult the Data Protection Commission before the processing.

The full draft then lists fifteen points to resolve before approval. A few already have someone named (the HR manager is to confirm the lawful basis); for most, the owner was still to be assigned. They include confirming the trial pause and deletion, confirming the lawful basis, deciding on human review of the score, obtaining accuracy and bias evidence from the supplier, professional advice on the automated-decision position and the AI Act duties, an owner for AI literacy measures, updating the privacy notice and telling all drivers in writing, the transfer documents and a transfer impact assessment, a decision on opting out of model training, and shorter retention periods.

What this example shows

A DPIA that ends with open points is not a failure. It is an accurate record of where the organisation stands, with the decisions it has taken and the work still to do, and it is far more useful to the people who have to act on it than a document that declares everything compliant. The document also keeps a line between what the company decided and what is only recommended, and the residual scores should be read with that line in mind: a lower score that depends on a decision not yet implemented is an expectation, not a result.

Our guide to writing a DPIA for an AI system explains each step in this example, and our guide to DPIAs in Ireland covers the Data Protection Commission's list.

Our DPIA tool takes you through your own assessment in a conversation and drafts the document as you answer. It is free to complete.