Mandatory digital time tracking: how to comply without the hassle
The Royal Decree regulating digital time tracking has still not been published in the BOE. We explain what companies are already required to do, what is still pending and how to prepare.
Updated as of 12 August 2026. The Royal Decree regulating digital time tracking has still not been published in the BOE. Here we distinguish precisely between what you are already required to do and what is still being processed, with links to the official sources.
TL;DR
Digital time tracking is the system through which a company documents each employee's daily working hours using traceable and tamper-proof electronic means that can be accessed remotely by the Labour Inspectorate. Whether it becomes mandatory depends on a Royal Decree that, as of August 2026, has still not been published in the BOE. However, this is the part that most companies misunderstand and that can prove most costly: recording working hours has already been mandatory since 2019, regardless of whether the format is digital or not. What is still pending approval is how working hours must be recorded, not whether they must be recorded. And failing to do so is a serious infringement, with fines of up to €7,500.
What does the law require today, and since when?
The obligation stems from Royal Decree-Law 8/2019 of 8 March, on urgent measures for social protection and the fight against job insecurity in relation to working time, published in the BOE on 12 March 2019 and in force since the following day. This legislation added paragraph 9 to Article 34 of the Workers' Statute, which remains in force today.
The wording is brief and quite demanding. The company must guarantee "a daily record of working time, which must include the specific start and end times of each employee's working day". It is worth focusing on two words: daily and specific. A weekly calculation or a general declaration that the contractual schedule is being observed is not enough; the time at which each person starts and finishes work must be recorded every day.
The same legislation also establishes a retention requirement: "The company shall retain the records referred to in this provision for four years and they shall remain available to employees, their legal representatives and the Labour and Social Security Inspectorate." Four years of records, accessible to three different parties. In practice, this is where most companies fail: they keep records, but do not retain them in a way that allows them to produce them when requested.
What must the record contain and who decides how it is organised?
Paragraph 9 of Article 34 contains a second paragraph that is quoted far less often than the first, yet resolves many of the practical questions. It states: "Through collective bargaining or a company agreement or, failing that, by decision of the employer following consultation with the employees' legal representatives within the company, this working-time record shall be organised and documented."
This sentence establishes an order of precedence that should be respected. If the applicable collective bargaining agreement regulates how the record is organised, the agreement takes precedence. If it does not, but there is a company agreement, that agreement takes precedence. Only in the absence of both may the company decide on the system itself, subject to a requirement that is frequently overlooked: prior consultation with the employees' legal representatives, where they exist. Implementing a clocking-in system unilaterally, where there is legal employee representation and without consulting it, is a procedural defect that can legitimately be challenged, however good the software chosen may be.
As for the minimum content, the law requires the specific start and end times of each person's working day, every day. Whether breaks —coffee, lunch, occasional absences— must also be recorded is not expressly stipulated by the provision, so the honest answer is that it depends: if the collective bargaining agreement or company agreement requires it, they must be recorded, and in practice it is usually advisable to record significant interruptions that do not count as effective working time. This is exactly the kind of decision that should be established in that agreement rather than improvised, because it determines whether the record reflects effective working time or mere presence.
What exactly is digital time tracking and how is it different?
What Royal Decree-Law 8/2019 does not specify is the format in which working-time records must be kept. This lack of definition is deliberate and has allowed paper sign-in sheets, spreadsheets, mobile applications, turnstiles and biometric systems to coexist over the years. All of these are currently valid, provided that they comply with the content and retention requirements.
The digital time-tracking system being prepared by the Ministry of Labour removes this freedom of format. According to the text currently being processed, records would have to be kept electronically and meet three requirements: traceable (making it possible to reconstruct who recorded what and when), tamper-proof (so that records cannot subsequently be altered without leaving a trace) and remotely accessible to the Labour Inspectorate, without inspectors having to visit the company in person.
That third requirement changes the rules of the game more than any other, and it is worth understanding it properly. Today, the Inspectorate has to request the records and the company has some time to gather and provide them. With remote access, verification becomes immediate and continuous. This is not merely a procedural difference: it is a difference in exposure. A record that is currently "put in order" when a request arrives would have to be permanently in order.
What stage has the Royal Decree reached?
This is where precision is important, because a great deal of contradictory information is circulating and many software providers have an incentive to present as imminent something that is not. The Royal Decree has not been published in the BOE and, therefore, its obligations are not enforceable.
The process has been complicated. The Council of State issued an unfavourable opinion on 23 March 2026, raising substantive objections: it questioned the project's economic report —which estimated the average cost at around €55 per employee per year—, pointed out that some of the proposed obligations would require legislation with the force of law rather than secondary legislation, and expressed reservations about its compatibility with data protection legislation. These are not minor drafting concerns: they go to the very legal architecture of the text.
Following that opinion, on 24 July 2026 the Ministries of Labour and Economy agreed to postpone approval until September 2026 in order to redraft the text and incorporate the objections. It is reasonable to expect that, when it is finally approved, it will include an adaptation period —the possibility of different deadlines has been discussed, with shorter periods for large companies and more generous ones for SMEs—, but we emphasise that this has not yet been established and any specific date you read today is a forecast, not an official deadline.
What happens if you do not record working hours?
This is the part that usually changes priorities. Failing to record working hours is not a minor formal breach: the Law on Infringements and Sanctions in the Social Order expressly classifies it. Article 7.5 classifies as a serious infringement "the breach of legal or agreed rules and limits concerning working hours, night work, overtime, supplementary hours, rest periods, holidays, leave, working-time records and, in general, working time".
Note that "working-time records" are explicitly included in the list. There is no need for interpretation or to fit the conduct by analogy into another category: it is literally stated there.
The penalties for serious infringements are set out in Article 40.1.b) of the same law, in the wording in force since 1 October 2021: fines of €751 to €1,500 at the minimum level, €1,501 to €3,750 at the intermediate level and €3,751 to €7,500 at the maximum level. The specific level depends on the circumstances assessed by the Inspectorate.
| Today (August 2026) | With the Royal Decree approved | |
|---|---|---|
| Do working hours have to be recorded? | Yes, since March 2019 | Yes |
| Format | Flexible: paper, spreadsheet or software | Electronic only |
| Technical requirements | Content and retention | Traceable, tamper-proof and interoperable |
| Inspectorate access | Upon prior request | Remote and direct |
| Retention | 4 years | 4 years |
| Non-compliance | Serious infringement, up to €7,500 | Serious infringement |
Can I clock in using a fingerprint or facial recognition?
If there is one section of this article that deserves particularly careful reading, it is this one, because it affects companies that believe they are complying exceptionally well when in fact they may be in the opposite situation. Many organisations installed fingerprint readers believing they were the most rigorous option: you cannot lend your finger to a colleague, they cannot be manipulated, and they appear indisputable. The problem is that this reasoning comes from an employment perspective, whereas a different set of regulations governs this issue.
On 23 November 2023, the Spanish Data Protection Agency published its guidance on attendance monitoring using biometric systems, and its position is strict. Fingerprints and facial recognition are biometric data that constitute a special category under Article 9 of the General Data Protection Regulation, meaning that their processing is prohibited unless one of the specified exceptions applies. The AEPD classifies their use for identification or authentication as high-risk processing.
There are two points that most companies are unaware of. First: according to the Agency's criteria, employee consent does not remove the prohibition, because in an employment context there is an imbalance between the party processing the data and the person providing it, which prevents that consent from being considered genuinely freely given. Second: relying on the exception under Article 9.2.b) of the GDPR would require a provision with the force of law specifically authorising the use of biometric data for that purpose, and the AEPD has stated that Spanish legislation does not contain sufficiently specific authorisation for time tracking. The practical consequence is that using fingerprints or facial recognition to clock in is currently problematic. And this is not theoretical: the Agency has already imposed penalties for biometric monitoring. If your company uses this type of system, the conversation with your adviser and your data protection officer is urgent, and it is independent of the entire debate surrounding digital time tracking.
How is overtime recorded?
Working-time recording does not exist in isolation: it is the evidence underpinning the entire monitoring of working time, particularly overtime. Article 35.5 of the Workers' Statute establishes this directly: for the purposes of calculating overtime, each employee's working day must be recorded day by day and totalled for the period established for payment of remuneration, with a copy of the summary provided to the employee in the corresponding statement.
There are two separate obligations hidden in that sentence. One is the daily record, which overlaps with Article 34.9. The other, which is complied with far less often, is the periodic calculation of totals and the provision of a copy of the summary to the employee together with their payslip. In other words, it is not enough for the company to hold the data: it must provide it back to each person periodically so that they can check their hours.
It is worth emphasising something that is often misunderstood: this obligation is not triggered only when overtime is actually worked. The courts have held that the recording obligation under Article 35.5 applies regardless of whether overtime is ultimately performed, precisely because the record is the tool that makes it possible to determine whether or not it has been worked. A company that argues that it does not keep records because nobody on its workforce works overtime has the reasoning backwards: without records, there is no way to prove that claim either to the Inspectorate or before a court, and that lack of evidence tends to work against the company.
How are working hours recorded in hybrid work or from a business centre?
We receive this question very frequently, because a significant proportion of the companies that work with us have teams split between the office, home and travel. The short answer is that the obligation does not depend on location. It is the employee's working day that must be recorded, wherever they work: at the office, at home, at a client's premises or in a meeting room rented by the hour.
That immediately rules out a solution that is still sometimes seen: a clocking-in system tied exclusively to physical entry into the building. A turnstile at reception records access to the premises, not the working day, and excludes anyone who does not pass through the building that day. For hybrid workforces, working hours must be capable of being recorded wherever each person happens to be, which naturally pushes companies towards digital solutions even though they are not yet mandatory.
At Centro de Negocios Ibercenter, we have been working with companies in Madrid for more than thirty years and we want to be clear about our role: we provide the workspace and services —private offices at Velázquez 157, AZCA and Gran Vía 6, meeting rooms by the hour, reception and business address services—, not the time-tracking system or employment-law criteria. Recording your workforce's working hours is your company's responsibility and its design should be validated by your employment adviser. This article is for information purposes and does not replace professional advice.
What are the most common mistakes?
After years of seeing how companies of all sizes that use our locations deal with this issue, there are a handful of mistakes that recur with striking regularity. The most common is a record completed retrospectively: sheets filled in on Friday with the theoretical schedule for the entire week, or at the end of the month before payroll is closed. That document proves nothing, because it does not reflect what happened but what was supposed to happen, and any contradiction with other evidence —emails sent, access records, work reports— undermines it.
The second is a record that exists but is neither retained nor capable of being produced. Four years is a long time, and when software, providers or responsible staff change, it is common for old records to remain in a system that nobody can access anymore or on a computer that has since been replaced. The obligation is not merely to generate the data: it is to retain it and keep it available to employees, their legal representatives and the Inspectorate throughout that entire period.
The third, and the most silent, is a system that is maintained impeccably for office staff but does not exist for everyone else: salespeople who travel, technicians who go directly to clients' homes, people working remotely, middle and senior managers who are assumed not to "clock in". The obligation applies to the entire employed workforce, and these roles with less clearly defined working hours are precisely the ones that generate the most disputes later, because they are the ones most likely to accumulate unrecorded excess working time. We would add a fourth, more subtle mistake: failing to agree or consult on the system with the employees' legal representatives where such representation exists. A record that is correct in terms of its content can still be open to challenge if the system was implemented without following that step.
How can you prepare without overspending?
Our underlying recommendation is simple: separate what is urgent from what has been announced. What is urgent is compliance with the obligation that has been in force since 2019, because that is what can be penalised today. What has been announced is the digital format, which will come with its own adaptation period and for which the final technical requirements are still unknown.
In practice, that means starting with an honest review of your current situation: are the working hours of every person recorded every day, with a specific start and end time? Are the records retained for four years? Could you produce records from three years ago if you were asked for them tomorrow? If the answer to any of these questions is no, that is where the real risk lies, and it does not depend on any future Royal Decree.
When it comes to purchasing software, prudence suggests not rushing. The text has already changed several times and the Council of State's opinion requires it to be redrafted, so the final technical requirements may differ from those currently being advertised by some providers. If your existing system complies with current legislation, you have room to wait until the regulation is published and then make an informed choice. If it does not comply, the problem exists today and should be resolved now, whatever tool is used.
Frequently asked questions about digital time tracking
Is digital time tracking already mandatory?
No. The Royal Decree that would make it mandatory has not been published in the BOE as of August 2026, and following the unfavourable opinion issued by the Council of State in March, its approval was postponed until September. What is mandatory, and has been since March 2019, is recording each employee's daily working hours, using the format chosen by the company.
Can I continue using paper or a spreadsheet?
Yes, for now, provided that the record includes the specific start and end time of each person's working day every day, is retained for four years and remains available to employees, their legal representatives and the Inspectorate. Once the Royal Decree is approved, those formats would cease to be valid, presumably following an adaptation period.
Do remote workers also have to clock in?
Yes. The recording obligation applies to the employee rather than the place where they perform their work, so it applies equally to remote work, hybrid work and anyone working from a business centre or at clients' premises. A system that only records physical access to a building excludes these employees and does not fulfil the obligation.
What penalty can be imposed for failing to keep working-time records?
It is a serious infringement under Article 7.5 of the Law on Infringements and Sanctions in the Social Order, which expressly mentions working-time records. Fines for serious infringements range from €751 to €7,500, depending on the level determined by the Labour Inspectorate.
If you are organising your team's work between the office, home and occasional meetings, at Ibercenter we can help with the workspace side: private offices, meeting rooms by the hour and reception and business address services at three Madrid locations. To design and validate your time-tracking system, rely on your employment adviser: they are the right professional to advise on your specific circumstances.
