GDPR compliant time tracking: what employers must get right

Recording working time means processing personal data about your team. Hours, start and end times and project codes all point to an identifiable person, so UK GDPR and EU GDPR apply. Getting this right is not difficult, but it does require deliberate choices about what you collect, why, how long you keep it and where it lives.

Fines for serious breaches can reach £17.5 million or 4% of global annual turnover in the UK, and €20 million or 4% in the EU, whichever is higher (Article 83 GDPR). A clear, minimal setup is the simplest protection.

What "GDPR compliant time tracking" requires

A GDPR compliant setup meets six conditions: a lawful basis for each purpose, data minimisation, storage limits, a processor contract, transparency towards employees, and secure storage with working data-subject rights. The sections below cover each one.

Lawful basis for employee time records

Legal obligation is the usual anchor

In the UK, the Working Time Regulations 1998 require employers to keep records that show compliance with the 48-hour average weekly limit for workers covered by it. These records must be kept for at least two years. In the EU, the Court of Justice ruling in case C-55/18 (CCOO, 14 May 2019) held that Member States must require employers to have an objective, reliable and accessible system for measuring each worker's daily working time. In Germany, the same duty appears in §16 ArbZG.

Where a legal obligation requires the processing, Article 6(1)(c) GDPR is the natural lawful basis. It covers the core time record and little else.

Why consent rarely works

Consent under Article 7 must be freely given, and it can be withdrawn. In employment, the power imbalance usually means employees cannot refuse without fear of consequences. The ICO and the EDPB both caution against relying on consent for routine workplace processing. For time recording, a legal obligation is the more solid footing.

Contract and legitimate interests

Calculating pay often rests on the employment contract under Article 6(1)(b). Some uses go beyond what the law requires, such as project profitability analysis. Legitimate interests under Article 6(1)(f) may cover these, but only after a documented balancing test that considers employees' reasonable expectations. Keep such uses separate from the core record.

Data minimisation: collect only what the record needs

Article 5(1)(c) limits processing to what is adequate, relevant and necessary for the purpose. For timekeeping, this is the practical test:

Monitoring data is the common trap. Activity tracking is hard to justify under the minimisation principle, and it usually requires a data protection impact assessment. zeitfair deliberately does not do it. The product records time entries, not screen activity or location.

Reporting should also stay at team or project level. Aggregated hours for a project tell you what you need without scoring individuals.

Retention: how long to keep time records

Article 5(1)(e) requires that personal data is kept no longer than necessary. For time records, the minimum periods come from employment and tax rules, not from a software setting.

Set a deletion schedule when you configure the tool. Delete records once the minimum period has passed and no other obligation applies. If a dispute is likely, keep the relevant records for longer, and document why. Audit logs should follow the same logic: keep them as long as you need to show accountability, and no longer.

Data processing agreement and subprocessors

When a provider processes employee data for you, Article 28 GDPR requires a written contract. A compliant data processing agreement (DPA) should cover:

• Processing only on your documented instructions
• Confidentiality for staff with access
• Security measures under Article 32
• A list of subprocessors, and notice before any change
• Help with data subject requests and breach notification
• Deletion or return of data at the end of the contract
• Audit rights or evidence of compliance

zeitfair provides its DPA online in the account, so it can be signed without paper. Review the subprocessor section before you sign, rather than after.

AI subprocessors and automated features

Many time tools now add AI features, and each one can introduce a new subprocessor. Before you buy, ask every vendor:

• Is any AI model provider a subprocessor, and is it named in the DPA?
• Where is processing carried out, and in which countries?
• Is your data used to train models, including the vendor's or a third party's?
• How long are prompts, outputs and logs kept?
• Can you opt out of AI features for employee data?

If a vendor cannot answer these questions in writing, treat that as a risk. Automated decisions about individuals also raise Article 22 issues, so keep any AI output advisory, not decisive.

Data subject rights

Employees have rights over their time data, and your process must handle them:

• Access (Article 15): a copy of the data you hold about them
• Rectification (Article 16): correction of wrong entries, with a visible audit trail
• Erasure (Article 17): deletion once the retention period has ended
• Portability (Article 20): an export in a usable format
• Objection (Article 21): where the basis is legitimate interests

You generally have one month to respond (Article 12(3)). Self-service access to their own entries, plus export and deletion tools, keeps this manageable. Log each request and your response.

Where data is stored

Data location matters for both security and transfers. zeitfair stores data in the EU (Frankfurt). If you are in the UK, transfers to the EEA are covered by UK adequacy rules, but any transfer outside the UK and EEA needs a valid mechanism such as the IDTA or the UK Addendum. Ask every vendor for the storage location of its data and of each subprocessor's data.

Transparency and the works council

Employees must know what is recorded, why, who can see it, and how long it is kept. A short privacy notice that explains the time record covers this. Put it in onboarding and keep it updated.

For German operations, a works council has co-determination rights over technical systems that can monitor behaviour or performance (§87(1) no. 6 BetrVG). A works agreement (Betriebsvereinbarung) should set the purpose, the data fields, access rights and deletion periods. A transparent setup usually makes that agreement easier to reach.

GDPR checklist for time tracking

1. Document the lawful basis for each purpose.
2. Limit fields to start, end, breaks, project and corrections.
3. Turn off or avoid any location or activity monitoring.
4. Set retention periods and a deletion routine.
5. Sign the DPA and review the subprocessor list.
6. Answer access and erasure requests within one month.
7. Tell employees what is recorded, and why.

This page is general information, not legal advice. For decisions about your own obligations, speak to your data protection officer or a qualified adviser.