Data protection and time tracking: what an employer may do

Recording working time means processing employees' personal data. That is not a side issue; it is why introducing time tracking regularly causes more debate than implementing it, and why the question “is the employer even allowed to do this?” comes up so often.

The short answer: not only allowed — required. The longer answer is about the limits.

The legal basis — and why it is not consent

Processing needs a legal basis under Article 6(1) GDPR. For working-time records that is point (c): compliance with a legal obligation. The obligation is the recording duty itself — § 26 AZG in Austria, § 3(2) no. 1 ArbSchG as interpreted by the Federal Labour Court in Germany, together with § 16(2) ArbZG and § 17 MiLoG.

In Germany § 26(1) BDSG applies alongside, permitting the processing of employee data where necessary for the performance of the employment relationship.

Consent is the wrong route here, and that matters more than it sounds. Consent is revocable. If an employee revokes it, the employer would have to stop processing — and thereby breach a statutory duty. There is also the question of whether consent in an employment relationship is freely given at all, given the imbalance of power.

An employer basing time tracking on consent therefore has not merely a needlessly weak basis, but one that collapses in exactly the situation where it is tested.

The three principles it fails on

Article 5(1) GDPR contains the rules against which time tracking is measured in practice.

Purpose limitation. The data is collected to comply with working-time rules and to run payroll. An employer who then analyses it to appraise performance is processing it for a different purpose and needs a separate basis. A ranking of “who arrives latest” built from clock-in data is precisely this case.

Data minimisation. Collect what the purpose requires: start, end, breaks. Not location, not desk presence in five-minute intervals, not keystroke activity. Austria's § 26(3) AZG shows the principle inside working-time law itself: for someone who determines their own time and place, the daily total suffices — collecting more would not be necessary.

Storage limitation. Once the retention period expires, delete. A retention duty is a floor and a ceiling at the same time; it does not justify holding data indefinitely.

The line to conduct and performance monitoring

This is where the real conflict lies. Time tracking that records start and end is unproblematic. The same software also capturing location, application usage or idle periods is a different thing: a monitoring measure that needs its own justification and, in Germany, is subject to works council co-determination under § 87(1) no. 6 BetrVG.

Three cases where businesses cross the line without meaning to:

• GPS on clock-in. Common, to stop people clocking in from the sofa. It collects movement data, needs its own basis and usually a works agreement. For the recording duty, location is irrelevant.
• Screenshots or activity measurement in project-time software. Not necessary for the working-time record, and in Germany not deployable without co-determination.
• The reason for absence in plain text. “Sick” is an absence type and is fine. The diagnosis is health data under Article 9 GDPR and cannot be justified in a time-tracking system.

Works agreement: when it is needed and what belongs in it

In Germany, introducing technical equipment capable of monitoring conduct or performance requires co-determination under § 87(1) no. 6 BetrVG. “Capable” is enough — it does not matter whether the employer intends to monitor. Electronic time tracking falls within it. Where a works council exists, the agreement is therefore not optional.

It is also an opportunity: § 26(4) BDSG expressly recognises collective agreements as a legal basis for processing employee data, subject to Article 88(2) GDPR. A good works agreement creates legal certainty rather than costing it.

Sensible contents:

• which data is collected — an exhaustive list, not examples
• for what purpose, and expressly for what purpose not (no performance appraisal)
• who may access what: the employee their own, the manager the team's, payroll what it needs
• retention period and deletion
• how corrections work: who may change an entry, and whether the change stays traceable
• what happens when something shows up — the procedure if the record reveals a rest-period breach

In Austria comparable approval requirements arise under the Labour Relations Act; in addition, § 26(5) AZG allows simplifications for breaks expressly only by works agreement.

The obligations people forget

Access. Article 15 GDPR — a copy of the data processed on request, in principle within one month under Article 12(3). In Austria the free-standing entitlement in § 26(8) AZG applies on top.

Record of processing activities. Time tracking is its own processing activity and belongs in the record under Article 30 GDPR.

Processing on behalf. Where time tracking runs as software as a service, the provider is a processor. Without a contract under Article 28 GDPR the processing is not lawful — however good the product is.

Impact assessment. Plain time tracking does not normally require a data protection impact assessment under Article 35 GDPR. Add systematic monitoring elements — location, activity measurement — and that assessment changes.

The misconception that lasts longest

It is often argued that time tracking is an intrusion employees should be spared, and that trust-based working time is the more privacy-friendly option.

That has it backwards. By the wording of § 26(1) AZG the record serves the monitoring of compliance with employee protection rules — it is an instrument in the employee's favour. This was exactly the CJEU's reasoning in 2019 for why it must be mandatory: without measurement, a worker cannot enforce the limits on their own working hours.

An employer who does not record is not protecting data. They are removing the employee's evidence.