Recording working time is mandatory, and it generates personal data. This guide explains the legal basis for time tracking, how employers protect their employees' data, what applies to location and sick notes, how long the data is kept and when the works council has a say. At the end, there is a checklist for the rollout.
As soon as a business records working hours, it processes personal data within the meaning of the General Data Protection Regulation (GDPR). This includes start, end and duration of daily working time, breaks, overtime and absences such as vacation or illness, as well as login data for the app and, where applicable, the work location. All of this information can be attributed to a specific person and is therefore subject to data protection.
That doesn't make time tracking problematic. It just means that the employer, as the controller, has to meet a few obligations: a legal basis, data minimization, protection against unauthorized access, deletion periods and transparency toward employees.
As a rule, no consent is needed for mandatory recording. Employers are obliged to keep records: in general since the decision of the Federal Labor Court (BAG) of 13 Sep 2022, for overtime under § 16 (2) of the Working Hours Act (ArbZG), and in certain sectors and for mini-jobbers under § 17 of the Minimum Wage Act (MiLoG). More on this in our guide: Time-tracking obligation.
The legal basis is therefore Art. 6(1)(c) GDPR (compliance with a legal obligation), and additionally point (b) for payroll (performance of the employment contract). § 26 BDSG (German Federal Data Protection Act), which used to be cited most often, has only limited validity as a separate legal basis since a judgment of the European Court of Justice of 30 March 2023 (C-34/21). Consent would be tricky in an employment relationship anyway, because it has to be voluntary. It is only an option for additional features that go beyond the obligation, such as a voluntary profile photo.
This is the most common practical question, and the answer consists of a few concrete measures. Art. 32 GDPR requires technical and organizational measures appropriate to the risk. For time tracking, this means:
Only what is actually necessary for time tracking may be recorded. Real-time location tracking, secret surveillance or covert tracking of behavior have no place here and are not permitted.
Purpose limitation also applies. Data collected for time tracking serves working time and payroll, not covert monitoring of performance or behavior. If an evaluation is to serve another purpose, it needs its own legal basis and must be known to employees.
Many time-tracking apps can use location. Under data protection law, the distinction is crucial:
In any case, employees must know in advance whether and when their location is checked. If there is a works council, the feature belongs in the works agreement.
Health information is a special category of personal data under Art. 9 GDPR and enjoys special protection. For time tracking, the fact of incapacity for work with its start and end is enough. The reason for the illness is not shown on the employer's copy of the sick note anyway and does not belong in the app.
In the schedule, colleagues should only see “absent”, not “sick”. Who sees which type of absence is governed by the permissions concept. Information from occupational reintegration management (BEM) is similarly sensitive and is kept separately and only for authorized persons, as described in the Integration management guide.
Working time data may only be stored for as long as necessary or required by law. The most important retention periods:
Once the relevant period has expired, the data must be deleted. In practice, a simple deletion policy helps: daily values after two to three years, monthly values processed in payroll after the tax retention period, data on former employees after all periods have expired. This is not legal advice; please have your specific case checked.
If a business uses time-tracking software, the provider processes the personnel data on behalf of the employer. For this, Art. 28 GDPR requires a Data Processing Agreement (DPA). It sets out which data is processed for which purpose, which technical and organizational measures apply, which subprocessors are used and that the provider does not use the data for its own purposes.
What businesses should look out for: the DPA is in place before real data is entered. The subprocessors are named along with their location. And it is clear how the data will be returned or deleted when the contract ends.
If there is a works council, it has a right of co-determination under § 87 (1) No. 6 of the Works Constitution Act (BetrVG) when electronic time tracking is introduced, because the software is technically capable of monitoring behavior or performance. Following the Federal Labor Court decision, it no longer has any say on whether time is tracked, but it does on how. A works agreement that defines functions, access rights, reports and deletion periods is customary. More on this in our guide: Scheduling and the works council.
Under Art. 13 GDPR, employees must be informed when the system is introduced. A short information sheet is usually enough and answers: What data is recorded? For what purpose? Who has access? Which provider processes it and where? How long is it stored? What rights are there?
These rights include access to one's own data, rectification of incorrect entries and erasure once the retention periods have expired. A time-tracking system in which each person can see their own times, time account and vacation balance at any time largely meets the need for information in everyday life on its own.
In Presio, each person sees only their own times, their time account and their vacation. Team leads see their area, and personnel files remain reserved for management. Clocking in is done with a personal login, in the browser or on the kiosk tablet with a personal PIN. Corrections go through requests with approval. With the setting “Clock in only at the work location”, Presio checks at clock-in whether someone is at the stored location. There is no location tracking during working hours. Self-reporting sick via the app can be switched off per company or team. The app's data is stored in a data center in the EU. Presio concludes a data processing agreement with its customers, and the subprocessors are listed in the privacy policy.
Yes. Recording is permitted if only the necessary data is processed, there is a legal basis, the data is protected, a data processing agreement with the provider is in place and employees have been informed. An app is often more data-efficient than paper lists hanging openly in the break room.
No, not for mandatory recording. It is based on Art. 6(1)(c) GDPR because the employer is legally obliged to keep records. Consent is only an option for voluntary additional features.
With individual logins for each person, a roles and permissions concept, logged corrections, encrypted transfer, a provider with a data processing agreement, a deletion policy and by doing without data that nobody needs, such as diagnoses or continuous location tracking.
A one-off check when clocking in and out is generally justifiable if there is an objective reason and employees have been informed. Continuous location tracking during working hours is not necessary for time tracking and is generally not permitted.
No, your own times and time account are only visible to you and to authorized persons such as your team lead. In the schedule, colleagues see who is scheduled or absent when, but not the reason for the absence.
No. For time tracking, the incapacity for work and its period are enough. The reason for the illness is health data under Art. 9 GDPR and is not needed for time tracking.
Records under § 16 (2) of the Working Hours Act (ArbZG) and § 17 of the Minimum Wage Act (MiLoG): at least two years. Payroll- and tax-relevant documents: six to ten years. After that, the data must be deleted. This is not legal advice; please have your specific case checked.
Not on whether it happens, because the obligation to keep records exists anyway. But on how: with electronic time tracking, the works council has a right of co-determination under § 87 (1) No. 6 BetrVG, usually set out in a works agreement.
Sign up, create your team, get started - try Presio free and with no obligation, no credit card needed.
Start your free trial