Electronic time tracking: system types, costs and GDPR

Is electronic time tracking legal?

Yes. In the UK, the Working Time Regulations 1998 let employers keep working time records "in such manner and format as the employer reasonably thinks fit". In Ireland, the 2001 Records Regulations explicitly accept electronic clock-in systems alongside the paper Form OWT1. In the EU, the Court of Justice (case C-55/18, 2019) requires an objective, reliable and accessible system for measuring daily working time, and leaves the form to each country.

Three practical points follow:

• The format is free. Paper, spreadsheet, time clock terminal or app – all are valid if the record is accurate.
• Real times beat totals. A sheet with "8" in every box proves little; start and end times do.
• You must be able to produce it. For an electronic system, that means an export an inspector, HMRC or a tribunal can read.

Retention periods differ: 2 years for UK working time records, 6 years for UK holiday and minimum wage records, 3 years in Ireland. Details in our guide to working time records in the UK and Ireland.

Types of electronic time tracking systems

For small businesses with several locations, QR + GPS on the phone covers most situations without devices and without biometric data. See QR code time clock and GPS time clock for the details.

Biometrics and GDPR: why fingerprint clocks are a problem

Fingerprints and face templates used to identify a person are special category data under Article 9 of the GDPR (and the UK GDPR). Processing them is prohibited unless an exception applies, and employee consent is rarely valid because of the imbalance of power between employer and employee. Processing biometric data on a large scale typically also requires a data protection impact assessment (DPIA) under Article 35.

Regulators enforce this. In the UK, the ICO ordered Serco Leisure in February 2024 to stop using facial recognition and fingerprint scanning to monitor the attendance of more than 2,000 employees at 38 leisure facilities. Serco had not shown the processing was necessary or proportionate when less intrusive methods, such as ID cards or fobs, were available, and staff were not offered a clear alternative. Similar decisions have been taken by data protection authorities in other EU countries.

Not every biometric system is automatically unlawful, but you must be able to show it is necessary and proportionate, offer an alternative to staff who object, and document your assessment. If you already run a fingerprint clock, talk to your data protection adviser.

There is an alternative that avoids the risk: Face ID or the fingerprint on the employee's own phone, used through passkeys. The check happens on the phone and QRtimetrack only receives the confirmation – no fingerprints or face templates are stored by the employer. GPS and selfies are personal data too: QRtimetrack reads location only at clock-in and clock-out, deletes selfies after 30 days, hosts data in the EU and gives you a DPIA template.

What an electronic time tracking system costs over 3 years

Terminals are bought once; apps are paid monthly. Compare the total over 3 years for your number of sites. Example for 20 employees:

A single cheap terminal at one site can cost less on paper. The picture changes when you add new sites (one device each), the monthly work of turning raw punches into a timesheet, the GDPR paperwork for biometrics, and downtime when a reader breaks. For a detailed comparison, see time clock vs app.

Checklist: choosing an electronic time tracking system

1. How many sites, and do they change? Fixed premises allow a terminal; construction, cleaning or field teams need a phone-based system.
2. How does it stop buddy punching? Look for several checks: rotating codes, GPS zone, one phone per employee, flags on suspicious punches.
3. Does it store biometric data? If yes, you need a legal basis, a DPIA and an alternative.
4. Does it work offline? Essential on sites, in basements and warehouses.
5. What do you get at month end? Start and end per day, breaks, overtime, totals – without manual work.
6. Can employees see and confirm their hours? Fewer payroll disputes.
7. Are corrections logged? Who changed what, when and why.
8. Where is data hosted? Preferably in the EU/UK.
9. What's the 3-year cost for all your sites?
10. Can you test it free with your own people?

Switching from paper in one day

1. Create the account and locations, with the GPS radius and work schedule for each.
2. Print the QR codes and put them at eye level at each entrance – or set up an entrance tablet with PIN, printed badges or personal rotating codes.
3. Send activation links. Employees add the app to their home screen; no app store needed.
4. Inform employees in writing what is collected and why, and update your privacy notice.
5. Do a test clock-in and check the dashboard.
6. Optionally keep paper in parallel for one month to compare.

Want a ready-made entrance point? The special offer bundles a Samsung Galaxy Tab A9+ tablet, 3 months of QRtimetrack free and a step-by-step guide (you set it up in about 10 minutes) for €299 outside Romania – limited stock of 100 systems. Still on paper for now? Use the free timesheet template.

Try electronic time tracking free for 7 days

Frequently asked questions