Is time tracking permitted under the GDPR?

Yes, time tracking is permitted under the GDPR – provided it rests on a legal basis and is implemented in a data protection compliant way.

Which data may be stored when tracking time?

Storing relevant working time data such as start and end times is permitted. Sensitive data, such as movement profiles or biometric features, is only permitted with consent.

Do I have to obtain consent for time tracking?

As a rule, no. Recording takes place on a statutory basis or in order to carry out the employment relationship – consent is usually not required.

Time Tracking and GDPR: What Employers Must Get Right

Why data protection matters so much in time tracking

For some years now the rule has been: employers must document their employees' working hours. That is what the European Court of Justice (2019) and later the Federal Labour Court (Bundesarbeitsgericht, 2022) ruled .

The aim: transparency and fairness. Working hours must not "disappear", and overtime has to be documented in a traceable way – to protect employees and employers alike.

But: working hours are personal data - and therefore fall under the General Data Protection Regulation (GDPR). That means certain rules have to be observed when tracking time.

On what legal basis may I record working hours?

There are two central legal bases employers can rely on:

Statutory obligation to record working time

As an employer you are legally obliged to record working hours - for example because of the German Working Hours Act (Arbeitszeitgesetz, ArbZG). That is a clear legal basis.

2. Necessity within the employment relationship (Section 26 BDSG)

Under the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG) you may process data if it is necessary in order to carry out the employment relationship. Time tracking is part of that - for example for payroll or as proof of overtime.

Important: As a rule you do not need separate consent from your employees – the obligation follows from the law.

What does GDPR compliant time tracking mean?

The GDPR sets clear requirements for handling personal data. For time tracking that means:

Data minimisation: Recording the start and end time is enough - there is no need to record how often someone walks to the coffee machine.
Transparency: Employees must know which data is recorded and what it is used for.
Data security: The data must not lie around openly or be visible to unauthorised people.
Purpose limitation: The data may only be used for the purpose it was collected for - for example for payroll.

A digital system such as clockin helps you meet these requirements automatically – with no extra effort.

Meet the GDPR easily with clockin

With clockin you get a system that lets you record working hours in a legally compliant and GDPR compliant way. Working hours are stored securely, access rights are clearly defined, and employees can see at any time what happens with their data.

That builds trust – on both sides.

Learn more about clockin here

Retention periods: how long may working time data be stored?

The GDPR requires that data is not stored for longer than necessary. The exact period depends on the respective purpose:

Payroll and continued pay

Minimum retention period: 6 years

If working time data is used for payroll or to calculate premium pay, it counts as part of the payroll records. These have to be kept for six years.

This applies for example to:

hourly wages
premium pay for night work and additional hours
periods of sickness with continued pay

German Minimum Wage Act (Mindestlohngesetz, MiLoG)

Minimum retention period: 2 years

Under the Minimum Wage Act (Section 17 MiLoG) employers must keep the start, end and duration of daily working time for certain employees for two years - above all for:

employees in marginal employment (mini-jobs)
industries covered by the German Act to Combat Illicit Employment (Schwarzarbeitsbekämpfungsgesetz), e.g. construction, cleaning, care

Documentation obligations towards employees

Recommended period: 3 years

Under the German Civil Code (Bürgerliches Gesetzbuch, BGB) employees can still bring claims up to three years after the employment relationship ends (e.g. unpaid overtime). It therefore makes sense to keep the corresponding time tracking data for at least three years.

From a data protection perspective

Only as long as necessary

Under the GDPR the principle of storage limitation applies (Article 5(1)). That means: you may not store data for longer than required - so not “forever”, but only for the purposes and periods named above.

Important: as soon as you no longer need the data, you have to delete or anonymise it.

What applies when introducing a time tracking system in businesses with a works council?

If there is a works council, it must be involved in the introduction of a time tracking system – under the German Works Constitution Act (Betriebsverfassungsgesetz).

It is best to set out time tracking in a works agreement. This states, for example:

which data is recorded
how long it is stored
who has access
what happens to the data when someone leaves the company

That creates clarity - for both sides.

Biometric time tracking - permitted or not?

Some systems work with fingerprints or facial recognition. This data counts as particularly sensitive and may only be used with explicit consent.

In many cases, though, simple digital recording via app, terminal or QR code is entirely sufficient - and easier in data protection terms.

Conclusion: time tracking and data protection - a good fit

Working time tracking is not at odds with data protection - if it is implemented properly. With the right system and clear rules you meet the GDPR almost as a by-product.

For businesses that means: more transparency, legal certainty and less paperwork.

For employees: clarity about their working hours and fair treatment of their time.