# LGPD compliance with location data

> Understand how to ensure LGPD compliance when collecting location data for reimbursement.

**Author:** Marina Costa — Brazilian Tax & Compliance Specialist  
**Published:** 2025-08-28  
**Updated:** 2025-08-28  
**URL:** https://quilometragem.com/blog/lgpd-compliance-with-location-data

**TL;DR:** Understand how to ensure LGPD compliance when collecting location data for reimbursement.

- Understand how to ensure LGPD compliance when collecting location data for reimbursement.
- The General Data Protection Law (LGPD) establishes strict rules about collecting and using personal data, including location information.
- Companies must obtain explicit consent from employees before collecting GPS data.
- Quilometragem implements clear consent terms that explain exactly what data will be collected and how it will be used.

The General Data Protection Law (LGPD) establishes strict rules about collecting and using personal data, including location information.[^lgpd-anpd-20]

Companies must obtain explicit consent from employees before collecting GPS data. Quilometragem implements clear consent terms that explain exactly what data will be collected and how it will be used.

Location data must be securely stored, using encryption both in transit and at rest. Access must be restricted only to authorized people.

Employees have the right to access their data, request correction, and even delete it when there's no longer retention necessity. Implement clear processes to meet these requests.

Maintain record of all data processing operations (audit logs). In case of inspection, you'll need to demonstrate compliance with all LGPD principles.

## Frequently asked questions

### Is location data personal data under LGPD?

Yes, location data linked to an identified person is personal data and requires legal basis, specific purpose and compatible protection measures.

### Is explicit consent required to track?

For reimbursement purposes, the legal basis can be contract execution; even so, the company must clearly inform the processing via privacy notice.

### How long can the data be retained?

Keep for the period required for tax purposes (five years in Brazil) and dispose of or anonymize after that per documented policy.

## Sources

- [LGPD — Lei nº 13.709/2018](https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm) — Presidência da República (2026-04-28)
- [ANPD — Orientações sobre tratamento de dados](https://www.gov.br/anpd/pt-br) — Autoridade Nacional de Proteção de Dados (2026-04-28)