GDPR and clock-in apps in the UK and EU

European employers are expected to record working time. In 2019 the Court of Justice of the European Union held, in a case brought against Deutsche Bank by the Spanish union CCOO, that member states must require employers to set up an objective, reliable and accessible system for measuring each worker’s daily working time. A clock-in app is an obvious way to do it. But location data, photos and attendance records are personal data, so the app has to be used in a way the GDPR, or the UK GDPR, allows.

Here are the questions to work through before rolling one out.

1. What is your lawful basis?

Consent is rarely the right basis in employment, because the imbalance of power between employer and employee means consent is seldom freely given. The bases that usually fit are:

• Legal obligation, for recording working time where national law requires it.
• Contract, for paying people correctly for the hours they worked.
• Legitimate interests, for confirming people are on site, supported by a written assessment that weighs your interest against the staff’s privacy.

Write down which basis covers each purpose. It shapes everything else, including what you tell staff.

2. Collect the minimum

Data minimisation is where clock-in apps most often go wrong. Continuous tracking during a shift is hard to justify when the purpose is to confirm attendance. A position read at clock-in and clock-out, compared with the site, answers the question without following anyone around. The same goes for photos: optional, taken only at clock-in or clock-out, and visible only to people who need them.

Be careful with biometrics. A photo is only biometric data under the GDPR when it’s processed to identify someone, for example by face matching. Face recognition at clock-in is special category data and needs an Article 9 condition, which is rarely available for attendance. A photo a manager can look at, without automated matching, avoids that.

3. Tell people clearly

Staff must be told, before monitoring begins, what you collect and why. A good privacy notice for a clock-in app covers:

• When the location is read and when it isn’t.
• Whether photos, signatures or checklists are collected, and when.
• The purposes, and the lawful basis for each.
• Who can see the records: their manager and the administrators, not colleagues.
• How long each record is kept.
• Their rights, and who to contact to use them.

4. Do a DPIA

Systematic monitoring of employees is a common trigger for a data protection impact assessment under Article 35. The UK Information Commissioner’s Office guidance on monitoring workers, published in 2023, expects one for most monitoring of this kind. A DPIA for a clock-in app is not a large document: describe the processing, show why it’s necessary and proportionate, list the risks to staff, and record what reduces them, such as reading location only at clock-in and limiting who sees photos.

In Germany, also involve the works council early. Technical systems that can monitor employees’ behaviour or performance are subject to its co-determination rights, and an app introduced without agreement can be stopped.

5. Decide how long to keep it

Keep records for as long as you need them and no longer. Working time records have their own minimums: in the UK, the Working Time Regulations require records to be kept for two years, and payroll records are kept for at least three years after the end of the tax year they relate to. Location readings and photos are usually needed for a shorter time than the hours themselves. Set a period for each, write it in the notice, and stick to it.

6. Check where the data goes

If your provider stores data outside the UK or the EEA, that is a restricted transfer. Countries without an adequacy decision, Australia among them, need an appropriate safeguard such as the EU standard contractual clauses or, for the UK, the international data transfer agreement or the UK addendum, together with an assessment of the risks of the transfer. Ask your provider where the data is hosted and what the contract says.

7. Make rights easy to exercise

Staff can ask for a copy of their records, for corrections, and in some cases for erasure. Choose a system that can export a person’s shifts, clock-ins and hours without a project, and decide who handles the requests.

How TDS Workforce Management fits

TDS Workforce Management reads the phone’s position at clock-in and clock-out, and otherwise only if someone who has allowed it leaves the site mid-shift (no route tracking), makes photos optional, limits who sees them by role, uses no face recognition and no tracking cookies, and exports every list to Excel or CSV. A site kiosk uses a personal PIN, stored only as a hash, rather than anyone’s location; its screen shows the first names and initials of who is rostered there that day, so put it where only staff can see it. Your organisation is the controller and Tech Direct Support the processor. The service is hosted in Sydney, so the transfer safeguards are set out in the customer agreement. The privacy policy has the detail.