Time registration with fingerprint

Time registration

All companies are required to record the daily working hours of their employees. Specifically, the daily record of working hours must include the specific start and end times of each employee's workday, without prejudice to any flexibility that may exist in the company [ET, art. 34.9].

The company must keep the time records for four years, and these must be available to employees, their legal representatives, and the Labor and Social Security Inspectorate.

As of today, if the collective agreement or an agreement with the workers' representatives does not specify how the working hours should be recorded, the company is free to use the format it deems appropriate [ET, art. 34.9]. In practice:

• Many companies still use a manual clocking system in which each worker records and signs by hand on a paper the time they enter and leave work each day. Since the law does not specify how the time registration should be guaranteed, the courts consider that a manually filled document is valid.

• Other companies use telematic systems, such as an application installed on a mobile phone. This mechanism is valid if the mobile phone is company property, or if the worker has given their consent to use their private mobile phone.

Throughout 2026, it is expected that the law will be amended and that the obligation to use electronic systems for time registration will come into effect.

Electronic registration

The future regulation of time registration will represent an important change for companies. The Government's objective is to eliminate unreliable records, reduce unreported overtime, and facilitate control by the Labor Inspectorate. To this end, the main novelty is that the registration must be digitally mandatory.

The main novelties of this new system are as follows:

• With traceability. The time registration must guarantee the traceability of any modifications made. That is to say, the reform aims to prevent subsequent manipulations or unjustified changes in the time records. For this purpose, all modifications made and the person who made them must be recorded.

• More mandatory content. Currently, many companies only record the time of entry and exit. With the reform, the registration must include, among other aspects, the exact start and end times; breaks that are not considered effective working time; the type of workday (full or part-time); the consideration of overtime and complementary hours, etc.

The reform strengthens the rights of access to the workday register. For example:

• Workers will have immediate and permanent access to their records.

• The Labor Inspection will be able to access the workday register immediately, even remotely.

Likewise, companies must have a specific internal protocol regarding the workday register. This protocol must regulate the clocking system, the procedure for making modifications, the management of technical incidents, the mechanisms for review and control, as well as the training to be provided to workers on this matter.

Fingerprint

Some companies have implemented fingerprint systems based on the legal obligation to register the workday. However, the courts and the Spanish Data Protection Agency consider that the use of these systems must be restrictive. Thus, the use of biometrics for monitoring workers' hours is considered disproportionate if less intrusive means exist. For these purposes:

• According to the General Data Protection Regulation (GDPR), biometric data aimed at uniquely identifying a person are special categories of data. This means that their processing is prohibited unless a specific exception applies.

• Some companies argued that the law [ET, art. 34.9] requires the registration of the workday and that this legal authorization allows the use of fingerprints. However, the Spanish Data Protection Agency considers that this general rule only provides for one objective (to register the workday), but does not authorize the processing of biometric data to achieve it.

In short, since there is no specific law in Spain that specifies this possibility in the labor field, the worker's consent is not considered a sufficient basis on its own, due to the power imbalance in the employment relationship.

The peculiarity of this data is that it is unique, permanent, and linked to the body itself. Unlike a password, it cannot be changed in the event of a security breach, which increases the risk to the employee's privacy.

For a biometric system to be lawful, it must pass what the courts refer to as the triple test of proportionality. That is:

• Suitability. Is a fingerprint system capable of achieving the objective of registering the daily work hours of workers?

• Necessity. Is such a system essential? This should not be confused with mere utility or convenience. If there is a less intrusive measure (such as cards, codes, or apps installed on mobile phones) with equal effectiveness, biometrics are not necessary.

• Proportionality. Do more benefits than harms to workers' privacy arise?

The National Court ratified a sanction against a company that required the use of fingerprints to access changing rooms and restrooms. It was deemed an unnecessary measure as alternatives such as keys or buttons exist, and disproportionate due to the high frequency of access to those intimate areas [AN 11-02-2026].

According to the courts, the triple proportionality test mentioned above is indeed surpassed (and therefore, biometrics are allowed) in environments of special danger or critical infrastructure. For example:

• Healthcare centers. A court endorsed the use of fingerprints in a hospital to prevent fraud in registration and ensure security in sensitive areas of medications, as it is an essential service [JS A Coruña 24-07-2025].

• Public safety. The use by the Security Forces and Corps to protect their buildings is considered legitimate under specific national security regulations.