Required ELD events include driver, vehicle, duty-status, time and location data.
Optional dispatch or fleet products may add other operational fields, so fleets should inventory each field instead of treating every data stream as a required ELD record.
What this means for your fleet
Create a data map that names each field, whether it is required ELD data or an optional product field, its purpose, recipient, retention period, and access or deletion process. Treat integrations and downloaded reports as separate copies with their own controls.
Build a field-level ELD data map
| Data group | Typical authorized purpose | Control to document |
|---|---|---|
| Driver identity and duty record | HOS recordkeeping and review | Driver/safety access, edit history, retention, export recipients |
| Vehicle position and movement | Required ELD events or separately purchased fleet operations | Purpose boundary, precision, history, geofence users, after-hours access |
| Optional fleet-product fields | Separately contracted operational workflows | Field inventory, read/write rights, retention, integration copies, legal hold |
| Downloaded files | Inspection, audit, payroll, tax, or support | Named recipient, encrypted storage, deletion date, revocation test |
Tell drivers who can see each type of data, why it is used, how long it is kept, and where to request access or a correction. Test whether you can revoke a former administrator’s access and block a lost phone.
What to check
| Check | How to verify |
|---|---|
| 1. Inventory collected data | List each collected field, source device, purpose, system destination, retention period, owner, and deletion path. |
| 2. Define purpose and lawful use | Map every use to the fleet policy and applicable obligation; flag secondary uses for legal or privacy review. |
| 3. Limit role access | Export roles and permissions, test a least-privilege account, remove access, and retain the revocation result. |
| 4. Review integrations and exports | Map each integration and export recipient. Record the data fields, transfer frequency, account or credential identifier, contract owner, and shutdown test. Do not copy passwords, API keys, or tokens into the worksheet. |
| 5. Publish an incident and driver-request process | Keep the incident route, driver access/request route, response owner, target times, sample exercise, and corrective actions. |
Common failure modes
- Using location data for undisclosed purposes.
- Unrestricted supervisor access.
- Keeping exported copies longer than needed after all retention requirements and holds have ended.
Limits and exceptions
Use this guide to plan your checks; it does not determine whether a legal exception applies, certify a record, or guarantee compliance, safety, savings, or audit results. Preserve original ELD records and edit history. Use the current rules to determine applicability and the manual for your installed device for operating instructions.
Sources and review date
Reviewed August 10, 2026. Check the latest rules and product information before changing your procedures or signing a contract.
- FMCSA ELD technical questions — Federal Motor Carrier Safety Administration.
- 49 CFR Part 395: hours of service and ELD requirements — Office of the Federal Register and U.S. Government Publishing Office.
- Small-business cybersecurity quick-start guidance — National Institute of Standards and Technology.
- Factor ELD products, plans, and support — Factor ELD.