A fleet manager can generate enormous amounts of data without ever thinking about how long it should be kept. GPS systems record vehicle location and trip history, dashcams create video, fuel-monitoring systems generate tank-level records and driver-monitoring platforms can store safety events. Over time, a business may end up holding months or years of detailed information about vehicles, drivers, customers and routes. For Kenyan fleet operators, the question is no longer simply whether this data is useful, but how long fleet data should actually be retained.

There is no single rule that says every company must keep GPS records for exactly 30 days, six months or one year. Kenya’s Data Protection Act follows a broader principle: personal data should only be kept for as long as it is reasonably necessary for the purpose for which it was collected, unless another lawful reason justifies longer retention. The Act specifically places limits on retaining personal data beyond what is necessary.

That principle becomes especially important in transport because GPS location and video can amount to personal data when they relate to identifiable drivers, employees, passengers or customers. The Office of the Data Protection Commissioner lists location information, photographs, audio and video recordings among examples of personal data. A fleet business should therefore avoid treating every tracking record as information that can simply be stored forever.

The ODPC’s 2026 guidance for Kenya’s transport sector makes this particularly clear. It specifically identifies GPS tracking, fleet-management systems, dashboard cameras and other digital transport tools as technologies that process increasing volumes of personal data. It also warns that surveillance tools such as dashcams and vehicle trackers can become excessive monitoring if organisations do not establish clear policies for access, retention and use.

For a fleet manager, the first step is therefore to ask why each category of information is being collected. GPS trip history may be needed for dispatch, route analysis, vehicle-security investigations, customer complaints or mileage verification. Dashcam footage may be needed for accident investigations, driver coaching or insurance claims. Fuel records may support cost analysis and suspected fuel-loss investigations. Each category can have a different useful life.

Consider ordinary dashcam footage where nothing unusual happened. A company may have little operational reason to keep thousands of hours of routine road video indefinitely. Storage costs increase, the amount of personal information held grows and the risk associated with unauthorised access becomes larger. A shorter routine retention period may therefore make more sense, provided the business preserves important footage when an incident occurs.

This is why some businesses design their internal policy around automatic deletion after a defined period. For example, routine dashcam footage may be overwritten after a relatively short operational window, while footage connected to an accident, complaint, insurance claim or disciplinary investigation is preserved separately until the matter is concluded. The exact duration should reflect the organisation’s actual business need, applicable legal obligations and risk profile rather than copying an arbitrary number from another company.

The same logic applies to GPS trip records, although the useful period may be longer. A business may want several months of trip history because fleet managers compare route performance, mileage, customer visits, utilisation and driver behaviour over time. Historical information can also be useful when a customer raises a dispute several weeks after a delivery. Keeping only seven days of trip data may therefore be too short for many commercial fleets.

On the other hand, retaining ten years of detailed employee movement simply because the tracking platform allows it may be difficult to justify if the information no longer serves an active business purpose. The ODPC’s transport guidance states that transport operators should develop a retention policy setting clear periods for each category of personal data, regularly audit what they hold and delete or anonymise information that is no longer needed.

This is an important distinction because different fleet records should not automatically receive the same retention period. Dashcam video is storage intensive and potentially more privacy-sensitive than a monthly vehicle-utilisation summary. A company might legitimately keep aggregated mileage trends longer than identifiable driver-facing video. Good retention policies separate these categories instead of applying one blanket rule to everything.

Fuel-monitoring data provides a useful example. Detailed tank readings may help investigate suspected drainage, reconcile refuelling and compare consumption patterns. Once those records have been used for operational analysis, the company may decide that longer-term reporting only requires summarised consumption figures rather than every individual sensor reading. Aggregation can preserve business value while reducing the amount of detailed data retained.

Driver-behaviour information requires similar care. Speeding alerts, harsh braking, distraction events and dashcam clips may be useful for safety coaching. But retaining every historical incident indefinitely can create a permanent profile of an employee that may no longer be relevant. Businesses should decide how long driver-performance records are genuinely needed for training, performance management, insurance or legal purposes.

The same applies to driver-facing camera footage. This type of recording deserves particular attention because it continuously observes employees inside the vehicle. A company should be able to explain why it is recording, who can see the footage, how long it is kept and under what circumstances it is reviewed. The ODPC’s transport guidance emphasises transparency and specifically says drivers and other data subjects should be informed about the use of their personal data.

Retention becomes even more important when fleet technology is used for disciplinary decisions. Suppose an employee receives a warning because of repeated speeding events. If the company retains those records for a particular employment-management purpose, it should define how long they remain relevant. Once the lawful and operational purpose has expired, continued indefinite retention may no longer be justified.

Businesses should also distinguish between routine records and incident records. A normal journey may be subject to the company’s standard retention policy. A journey connected to an accident, theft, customer claim or legal dispute may need to be preserved longer because the information could become evidence. Kenya’s Data Protection Act allows longer retention where it is reasonably necessary for a lawful purpose or required or authorised by law.

This means a good system should support a form of legal or investigation hold. If an accident occurs today, relevant dashcam footage should not simply disappear next week because the normal automatic-deletion period expires. The company should identify and preserve the necessary records while still allowing unrelated data to follow the normal retention schedule.

Accident investigations are a particularly strong reason for clear procedures. A fleet manager may need dashcam footage, GPS speed data, route history, ignition events and driver information. If the company’s systems automatically overwrite footage before management realises it is relevant, valuable evidence can be lost. Retention therefore needs to be coordinated with incident-reporting procedures.

Insurance claims can create similar requirements. An insurer may ask for records weeks or months after an incident. Fleet operators should understand the typical claims process for their vehicles and design retention periods that give the business a reasonable opportunity to preserve relevant information. Again, this does not mean storing every journey forever.

Customer disputes can justify their own retention window. Delivery businesses may receive complaints several days or weeks after a shipment. GPS arrival times, stop duration and route history can help investigate those disputes. The company’s policy should therefore reflect how long customers normally have to raise delivery issues and how long the business needs supporting evidence.

Maintenance information may have a longer useful life than ordinary GPS coordinates. Mileage history, engine-hour trends and service records can help identify long-term vehicle-performance patterns. Even here, the company may not need detailed second-by-second location history once the useful maintenance indicators have been summarised.

This introduces an important strategy: retain the information you need, not necessarily the raw data forever. A fleet may calculate monthly mileage, utilisation, fuel efficiency and maintenance indicators, store those summaries for long-term analysis and allow detailed raw location records to expire earlier. This can reduce storage and privacy risk while preserving management insight.

Anonymisation can also play a role. Kenya’s ODPC advises organisations to delete or anonymise personal data once it is no longer needed in identifiable form. A business interested in analysing long-term fleet trends may not always need to know which individual employee drove every journey years earlier.

For example, a company analysing five years of route efficiency may only need aggregate information showing average journey times, distance and fuel consumption. If driver identity is no longer relevant, the data can potentially be anonymised or otherwise separated from identifiable employee information depending on the use case and technical design.

Access control is equally important because retention risk increases with time. The longer data remains stored, the longer there is an opportunity for unauthorised access, misuse or breach. The ODPC’s transport guidance recommends limiting access to staff who actually need the information, using secure login controls and ensuring third-party providers maintain adequate safeguards.

A dispatcher may need current vehicle locations but have no reason to view old driver-facing dashcam clips. A safety manager may need incident footage but not payroll information. Senior management may require monthly reports rather than detailed employee movement. Retention and access should therefore be designed together.

Third-party fleet platforms deserve attention as well. A business may assume that deleting information from its own computer is enough, while the tracking provider still holds historical records in cloud systems or backups. Contracts with telematics providers should make clear how long data is stored, how deletion works and what happens when the service ends.

The ODPC’s guidance also expects organisations to keep appropriate agreements with data processors and ensure third parties handling personal data meet suitable security standards. For fleet operators, that means understanding the relationship between the business, its GPS provider, cloud platform, dashcam provider and any other party processing fleet information.

Cross-border hosting can add another consideration. Some fleet platforms store information on servers outside Kenya. Businesses should know where data is processed and whether appropriate safeguards apply. Retention policy should therefore cover not only the period of storage but also the systems and locations in which information exists.

Fleet managers should also think about backups. Deleting a record from the live dashboard does not necessarily mean it disappears instantly from every backup system. A proper data-retention process should consider backup cycles and technical deletion procedures so expired information is not silently retained indefinitely in another environment.

The ODPC’s broader guidance on recorded media encourages organisations to implement clear retention policies, conduct regular audits and use automated deletion where appropriate, while keeping evidence that deletion occurred. This principle translates well to fleet systems because manual deletion is difficult to manage once thousands of records are being created every day.

Automation can reduce human error. A system might automatically remove ordinary footage after the approved period while retaining clips that have been flagged as part of an investigation. Historical GPS records could follow another schedule, while long-term fleet summaries are kept separately. The exact structure should match the business’s operations.

A retention policy should also identify who is responsible for deciding when information can be deleted. Leaving the decision entirely to drivers, dispatchers or individual fleet managers can create inconsistency. The business should define responsibility at organisational level and ensure the system follows that policy consistently.

Staff training helps because employees need to know that preserving data “just in case” is not always good practice. People often fear deleting information because it might someday become useful. But indefinite accumulation creates its own risks. A defined retention schedule gives staff confidence that information is kept long enough for legitimate needs without becoming permanent by default.

There is also a financial argument for better retention. Dashcam video can require significant cloud and local storage, particularly in fleets operating several cameras per vehicle. Businesses paying for unnecessary years of footage may increase operating costs without receiving equivalent value. A sensible retention policy can therefore reduce both privacy risk and storage expense.

GPS history uses less storage than video but can accumulate across hundreds of vehicles. Large fleets should therefore periodically review whether old high-resolution data is still useful. Perhaps detailed second-by-second data is needed for only a limited period, after which monthly summaries are sufficient.

Thirty days, six months or one year can all be reasonable in certain situations, but none should be adopted blindly. A 30-day window may be adequate for routine dashcam footage in one fleet yet far too short for another business where complaints and insurance matters commonly arise later. Six months of detailed GPS history may be useful for seasonal analysis, while another organisation may be able to work with three months.

The key is being able to explain the decision. A business should be able to say, for example, that routine dashcam footage is retained for a defined period because that period covers the normal incident-reporting window, while flagged accident footage is kept longer for insurance and legal purposes. GPS trip history may be kept for another period because it supports delivery investigations and fleet reporting.

This is far stronger than saying, “We keep everything forever because the system has space.”

A practical fleet-retention policy can therefore classify information into categories such as live GPS location, historical trip data, geofence events, driver-behaviour records, fuel-monitoring data, routine dashcam footage, incident footage and maintenance summaries. Each category receives a purpose, access rule and retention period.

The policy should also explain what happens at the end of that period. Information may be securely deleted, anonymised or converted into an aggregate record. The ODPC specifically recommends maintaining records of retention and disposal so organisations can demonstrate that personal data was deleted according to policy.

This requirement reflects a broader principle of accountability. It is not enough to create a data-protection document and leave it in a folder. The organisation should be able to demonstrate how the policy actually operates. Kenya’s transport-sector guidance recommends maintaining a data map showing what personal information is collected, why it is collected, how long it is retained and the lawful basis relied upon.

For a fleet business, such a data map could show that GPS coordinates are collected for security and operational management, driver-facing video for defined safety purposes and fuel data for cost control. Each type of information would then have an associated retention and disposal rule.

Employee transparency should accompany the policy. Drivers should know that company vehicles are tracked, whether video is being recorded and how long the relevant information is normally retained. The ODPC guidance says transport operators should inform data subjects about how long their information will be retained.

This communication can also help reduce mistrust around fleet technology. Employees may be more comfortable with monitoring when the company explains that footage is not stored permanently and only authorised personnel can access it for defined purposes. Clear boundaries can make telematics feel more like an operational tool and less like unlimited surveillance.

Retention should be reviewed periodically because business needs change. A company operating five vehicles today may grow to fifty. New dashcams may create more video, new customers may impose contractual requirements and changes in insurance or regulation may affect how long certain records need to be preserved.

A good policy is therefore not permanent. The organisation should review whether the original retention periods still make sense and whether the data being collected is still necessary. ODPC’s transport guidance encourages regular audits of personal information to identify data that should be deleted.

Finatrack Global Ltd provides GPS tracking, AI dashcam, fuel monitoring and fleet-management solutions for Kenyan businesses that require better visibility over vehicle operations. Finatrack’s wired GPS tracker is available at KES 15,000, while the AI Dashcam is available at KES 35,000, with other fleet solutions configured according to the customer’s operational requirements.

Businesses using connected fleet systems should not focus only on how much information the technology can collect. They should also decide how long that information remains useful, who is allowed to access it and what happens when the purpose for keeping it ends. For professional installation and enquiries, call or WhatsApp 0723 645 810 or visit www.finatrack.co.ke.

The right answer to whether a fleet should keep its data for 30 days, six months or longer is therefore not one universal number. It depends on the type of data, the business purpose, insurance or legal requirements, investigation timelines and whether continued retention remains reasonably necessary. The strongest fleet-data strategy is one that preserves evidence when the business genuinely needs it, removes information when it no longer serves a legitimate purpose and can clearly explain why each retention period exists.