A live map shows where every crew is, all the time. That is exactly what it is for, and it is also what makes it personal data processing. GPS data privacy and rally raid organization are not at odds, though: separate the public map from private telemetry, inform competitors before the start, set a retention period, and you have covered the essentials under the GDPR. Here is what to plan, item by item. This article offers practical guidance, not legal advice: for edge cases, your usual counsel remains the right door.
A crew's position is personal data
The GDPR defines personal data as any information relating to an identifiable person, and explicitly lists location data among the possible identifiers. A single GPS point says nothing; tied to a race number, itself linked to an entry list with names and licenses, it describes the movements of a specific person, minute by minute, for a week. It is a textbook case of personal data.
Two common assumptions fall away here. Replacing the name with a race number does not take you out of the GDPR: as long as the organization holds the mapping table, the data can still be traced back to a person. And racing outside Europe changes nothing: the regulation applies to processing carried out in the context of the activities of an organizer established in the Union, whether or not the processing takes place on European soil. A Moroccan raid organized from France is therefore still covered.
What your tracking setup actually collects
Before asking what you are allowed to do, know what you collect. A complete tracking setup produces more than dots on a map:
- Timestamped positions, transmitted by the beacon at a regular rate, which form each vehicle's complete track;
- Speeds, computed or measured, especially in speed control zones;
- Statuses and alerts: SOS, assistance request, prolonged stop, low battery;
- Identification data: names, race number, vehicle, emergency contacts collected at entry.
The medical forms many events require at entry fall under a special category of data with stricter rules: keep them away from the tracking system and restrict access to the race doctor. The rest of this article deals with the GPS data itself.
Public map, private telemetry: the two uses of GPS data
The most useful question is not "can we publish?" but "who needs to see what?". It naturally splits the setup into two processing operations, with two distinct purposes.
The public map exists to bring the race to families, sponsors and the public: that is the whole point of rally raid live tracking, and part of what crews sign up for. To do that job it only needs the current position, the race number, the crew name and the standings. It does not need instantaneous speeds, safety alerts or the fine-grained history of stops: showing those publicly would run against the data minimization principle, and incidentally make poor viewing for the crew stopped with a breakdown.
The full telemetry (complete tracks, speeds, SOS alerts, the race log) serves safety and race direction. It stays with race control, accessible only to the people who need it. That is how the RaidLine features are split: a public map shareable by link on one side, restricted-access race control tools on the other, with neither exposing the other's data.
Informing competitors before the start
The GDPR requires informing people at the moment their data is collected: who processes the data, for which purposes, who has access, how long it is kept, and which rights people can exercise (access, rectification, erasure, and a complaint to the supervisory authority, the CNIL in France). Nothing insurmountable: in practice, a dedicated clause in the supplementary regulations and a clear paragraph in the entry pack cover it, provided they are written in plain language rather than jargon.
Announce explicitly that positions will be published during the race and whether a replay will stay online after the finish: a competitor who enters knowing this will not discover their track online by surprise. State also that the tracking provider processes the data on the organization's behalf, and pin that down in your contract with them. These documents belong in the same folder as your safety obligations: after an incident, the GPS tracks you keep are among the elements that establish what the organization knew and did, as covered in our article on organizer liability.
Keeping GPS data after the race: what the GDPR requires
The GDPR sets no retention period: it lays down a principle, do not keep data in identifiable form longer than necessary for the stated purposes. It is up to the organizer to define retention periods, announce them and stick to them. The simplest approach is to reason per use:
- Standings and protests. The tracks serve as evidence to settle a protest or a waypoint check: keep them at least until the protest deadlines have passed and the final standings are published.
- Public replay. Leaving the map available for a few weeks after the finish extends the life of the event for crews and sponsors. Give that window an end date and close it on the day.
- Statistics and preparing future editions. Actual distances, average passage times, frequent stopping zones: all of this can be computed on aggregated or anonymized data, which leaves the GDPR's scope once the link to individuals is genuinely broken.
Once those deadlines pass, delete or anonymize. Keeping named tracks around "just in case", with no purpose attached, is precisely what the storage limitation principle forbids, however well secured the data is.
The habits to build as an organizer
- Inventory what you collect. Positions, speeds, alerts, identities, contacts: the list fits on one page and drives everything else.
- Separate the public map from private telemetry. The public sees the race, race control sees the safety picture. Check that your platform genuinely enforces that access split.
- Write the information clause. Purposes, public publication, retention periods, rights: in the supplementary regulations and the entry pack, before collection.
- Frame your provider. They process data on your behalf: the contract must say what they do with it, where, and what remains of it after the event.
- Set retention periods and keep them. Protests, replay, anonymized archives: one deadline per use, and actual deletion on the planned date.
- Be ready to answer. A competitor may ask for their track or its erasure after the event: know who answers and how to extract one person's data.
None of this requires in-house counsel: it is an afternoon's work before the first edition, then a yearly review. And it complements what federations already require on the safety side, detailed in our article on rally raid GPS tracking regulations.
Live tracking that separates public and race control
RaidLine provides the public map shareable by link and the restricted-access race control tools, white-label: everyone sees what they need to see, nothing more. Demo on request.
Request a demoFrequently asked questions
Is a competitor's GPS position personal data?
Yes. The GDPR explicitly lists location data among the identifiers that make a person identifiable. A single GPS point says nothing, but tied to a race number and an entry list, it describes the movements of a specific person. Swapping the name for a number is not enough to escape the GDPR as long as the organization keeps the mapping.
Can you publish crew positions on a public map?
Yes, provided you announce it before the race, in the regulations and at entry, and keep the public map to what spectators actually need: position, race number, crew name, standings. Speeds, safety alerts and the fine-grained history stay with race control.
How long should GPS tracks be kept after the race?
The GDPR sets no fixed period: it requires that data not be kept longer than necessary for the stated purpose. In practice you define a period per use (protests and final standings, a time-limited public replay), announce it to competitors, then delete or anonymize once the deadline passes.
Does the GDPR apply if the race takes place outside Europe?
Yes, as soon as the organizer is established in the European Union: the regulation applies to processing carried out in the context of its activities, whether or not the processing takes place in the Union. A raid run in Morocco by a French organizer is still covered.