Working-time records: how long to keep them, who may see them

“How long do I have to keep working-time records?” is a question with no single number as its answer — and most answers online are wrong because they give one. The period follows from several statutes at once, and the longest always governs.

Access works the same way. Four different parties can demand it, each on its own legal basis and each with its own scope.

The periods, separated by legal basis

Germany

The statutory retention duties say two years. The limitation period for wage claims runs for three. An employer deleting after exactly two years faces a claim in the third year with nothing to answer it. That is why three years has settled in as the practical floor.

Austria

§ 26 AZG states no period. The federal business service portal gives one year for general working-time records, 24 months for drivers and two years for the register of young workers; where averaging is used, the year runs from the end of the averaging period.

That period is not, however, the one a business can plan around. Working-time records underpin payroll and are therefore relevant to taxation — § 132 BAO requires seven years. Social insurance audits reaching back several years come on top.

What this means in practice

Two numbers for two countries: three years in Germany, seven in Austria. An employer with staff in both sensibly keeps seven — one period is easier to administer than two, and the longer one carries the shorter.

The longer period is not a data protection problem so long as it rests on a statutory retention duty. But it is also a ceiling: once it expires, the data must be deleted. A time-tracking system still holding 2014 data because nobody ever cleared it out breaches the storage limitation principle.

Who may demand access

The employee

Austria. § 26(8) AZG entitles every employee to demand a free copy of their records once a month. With flexitime, § 26(2) requires a copy on request at the end of the flexitime period, or otherwise access.

§ 26(9) has a consequence many employers miss: if the business refuses to provide the copy, forfeiture periods are suspended. Delaying keeps open the very window in which claims can still be brought. There is no scenario in which refusing pays off for the employer.

Germany. There is no equivalent working-time-law entitlement, but Article 15 GDPR applies: working-time data is personal data, and the right of access includes a copy of the data processed. In practice this reaches the same result by another route — with the difference that the right of access is not limited to once a month.

The works council

§ 80(2) BetrVG requires the employer to inform the works council and, on request, to provide at any time the documents necessary for it to perform its functions. Working-time records fall within that where the council is monitoring compliance with the Working Time Act.

The limit lies in the word “necessary”. The council can ask for records in order to check working-time rules — not for any analysis for any purpose. Under the same provision, inspection of the lists of gross wages and salaries belongs expressly to the works committee, not to every member.

In Austria the works council has comparable monitoring rights under the Labour Relations Act.

The authority

Austria: § 26(6) AZG — the labour inspectorate is given access on request, with no advance notice.

Germany: the occupational safety authorities of the Länder and, in the MiLoG sectors, the customs authority's undeclared-work unit. The MiLoG inspection is the most common in practice, and it asks precisely for start, end and duration within the seven-day deadline.

The tax auditor

Through payroll, working-time records form part of the documents relevant to taxation. In Austria that is the reason for the seven years in § 132 BAO; in Germany the route runs through the payroll tax audit.

Where it goes wrong in practice

The record is not where the inspection happens. § 26(1) AZG says “at the establishment”. A folder at the tax adviser's office that first has to be requested does not satisfy that. A web application does, as long as it can be opened at the business.

The departed employee. Their right of access does not end with the employment relationship, and this is exactly the situation in which the request arrives — often alongside a claim for unpaid overtime. Deleting accounts on exit deletes your own defence.

No deletion concept. Retention periods cut both ways. Without a rule that deletes once the period expires, a duty to retain turns into indefinite storage, and that is not covered.

The copy is treated as a negotiating point. In Austria this suspends forfeiture periods; in Germany the one-month deadline in Article 12(3) GDPR is running. In both cases delay worsens your own position.