Working Time Records Data Privacy: Who Can See What, and What to Ask Before Buying

7 min read
HR manager configuring role-based permissions and data privacy controls on a web-based time tracking dashboard
Fotó: Yan Krukau (Pexels)

Working time records data privacy is an everyday operational problem: a single misconfigured permission or an unvetted vendor can expose sensitive absence reasons, personal schedules, and dispute histories to the wrong colleagues.

Where Working Time Records Data Privacy Breaks Down in Shared Files

In a sixty-person company, the first privacy breach rarely comes from an outside attacker. It happens on the second day of the month during payroll closing. A project manager asks the office coordinator for an attendance export to reconcile billable client hours. The coordinator exports a raw spreadsheet and emails it across the department.

Within minutes, an unencrypted file sits in multiple download folders. Alongside task hours, the sheet displays clock-in timestamps, medical leave classifications, and notes explaining why an employee arrived late after a doctor appointment. Team members now know who took sick child leave, who is managing a recurring medical condition, and whose overtime hours were flagged for correction. Nobody intended to violate privacy. This is simply what happens when organizations manage attendance through shared spreadsheets, shared folders, or tools that lack granular permissions.

Under the GDPR principle of data minimisation (Article 5(1)(c)) and national employment provisions such as Section 10 of the Hungarian Labor Code (Act I of 2012, Mt.), an employer may only process personal data that is directly relevant to establishing, performing, or terminating an employment relationship. When a manager who only needs billable hours receives medical absence classifications and daily timestamp logs, the company breaches data minimisation.

For organizations transitioning away from manual files, our analysis of the limits of monthly attendance sheets in Excel details how spreadsheet controls deteriorate as headcount expands.

Who Needs Access to Working-Time Data?

Managing working time records data privacy requires segmenting visibility by operational necessity rather than corporate hierarchy. A departmental executive does not require every badge swipe, and an operational team lead does not need access to payroll tax deductions.

Access should be structured around specific operational roles:

  1. The Individual Employee: Under CJEU case law (such as C-55/18), the time-recording system must be accessible to workers so they can verify their recorded working time. Providing staff with direct visibility over their own daily entries, leave balances, and overtime totals supports transparency and allows employees to identify and resolve recording mistakes early in the pay period.
  1. The Direct Line Manager: Operational supervisors require attendance data to coordinate shift rosters, monitor daily coverage, and approve leave requests. Access should remain strictly purpose-dependent. A supervisor needs to know whether a team member is present or on certified medical absence to reassign tasks. Diagnostic codes, medical certificates, and underlying health details are not necessary for operational task assignment and should be restricted to authorized HR personnel.
  1. The Project Lead or Client Manager: When tracking time against customer deliverables, project managers require visibility over hours allocated to specific tasks or project codes. Front-door badge swipes, total contractual hours, or broader leave histories are rarely necessary for project billing and budget tracking. In its Guidelines 01/2025 on pseudonymisation (adopted on January 16, 2025 as a public consultation version), the European Data Protection Board (EDPB) examines how technical measures such as pseudonymisation and aggregation can mitigate data protection risks. While the guidelines do not prescribe specific organizational boundaries for project managers, separating identified personal data from operational metrics helps organizations limit unnecessary exposure across operational roles.
  1. Internal HR and Payroll: The internal HR coordinator serves as the operational checkpoint. This role requires validated monthly summaries, overtime multipliers, statutory leave balances, and absence categories to reconcile records before passing final totals to payroll.
  1. The External Accountant: External payroll bureaus and accountants calculate wages and taxes based on consolidated monthly figures: regular hours worked, overtime bands, statutory sick leave days, and applicable bonuses. While no specific statutory rule explicitly bars external accountants from viewing daily logs, providing raw, second-by-second timestamps, GPS coordinates, or task comments exceeds what is strictly necessary for payroll computation, conflicting with general data minimisation principles.

Compliance Limits and Data Protection Under European Law

Procurement teams often assume that meeting statutory time-recording mandates requires continuous employee surveillance. European jurisprudence and regulatory frameworks demand reliable verification, not pervasive monitoring.

In C-55/18 (CCOO v Deutsche Bank, 2019), the Court of Justice of the European Union (CJEU) held that Member States must require employers to establish an objective, reliable, and accessible system measuring daily working time. Under national implementations such as Section 134 of the Hungarian Labor Code, employers must record regular hours, overtime, standby, on-call duty, and leave on a current, daily basis, showing exact start and end times.

Recording obligations do not override privacy protections. In Case C-34/21 (Hauptpersonalrat, 2023), the CJEU clarified that national rules on employee data adopted under Article 88 of the GDPR are valid only if they provide genuine, specific safeguards for human dignity, legitimate interests, and fundamental rights. In the absence of such specific national safeguards, general GDPR provisions apply directly, including the legitimate interest test and data minimisation.

Article 29 Working Party Opinion 2/2017 (endorsed by the EDPB) reinforces this separation. The opinion treats routine time and attendance recording and physical building access control as distinct processing operations subject to proportionality and subsidiarity. Employers cannot justify continuous tracking under the banner of simple attendance management. Under Section 11/A of the Hungarian Labor Code, monitoring is strictly limited to work-related conduct, and the introduction of any technical monitoring tool requires advance written notification to employees.

Recent European legislative developments add further compliance parameters:

  • The Digital Omnibus on AI (Omnibus VII), approved by the European Parliament on June 16, 2026 and by the Council on June 29, 2026, postponed obligations for Annex III high-risk AI systems in employment (including AI used for worker monitoring, task allocation, and performance evaluation) from August 2, 2026 to December 2, 2027. However, transparency obligations under Article 50 still apply from August 2026, requiring employers to consider how AI-driven transparency rules intersect with workplace systems.
  • Directive (EU) 2024/2831 on platform work must be transposed by Member States by December 2, 2026. Articles 7, 9, 10, and 11 establish restrictions on automated monitoring systems, mandating human oversight and algorithmic transparency. While this directive specifically targets platform work, transposition steps in Hungary have not been confirmed from official Hungarian sources.
  • National digital recording initiatives are progressing at different speeds. In Germany, while the Federal Labour Court (BAG) affirmed the general obligation to record working time in September 2022 (1 ABR 22/22), the Federal Ministry of Labour and Social Affairs (BMAS) draft bill of June 18, 2026, which would mandate electronic time recording, has not yet been adopted as a government bill. In Spain, industry and vendor reports have discussed a proposed royal decree introducing digital, tamper-proof time records with remote access for the labour inspectorate (ITSS). However, as of September 9, 2026, this measure had not been passed by the Council of Ministers or published in the official state gazette (BOE), meaning it remains a planned initiative rather than enacted law.

Biometric Attendance Systems and the Principle of Proportionality

Hardware vendors frequently market fingerprint terminals and facial recognition scanners as fraud-proof solutions for attendance tracking. For routine workplace attendance, biometric terminals present significant legal and regulatory risks.

Under Section 11 of the Hungarian Labor Code, biometric data may only be processed when strictly necessary to prevent unauthorized access to physical assets or data that would pose a substantial risk. Routine attendance recording does not satisfy this statutory condition.

Regulatory guidance reinforces this boundary. In its comprehensive workplace data processing guidance of November 15, 2016, the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) concluded that fingerprint-based time recording is generally not a proportionate monitoring method, limiting biometric access control to exceptional, high-risk environments such as specialized laboratories. While this restriction reflects Hungarian statutory provisions and regulatory interpretation rather than a uniform international ban, European supervisory guidance (such as Article 29 Working Party Opinion 2/2017) similarly emphasizes strict proportionality and subsidiarity before introducing biometric identifiers. Standard alternatives, including PIN codes, RFID proximity badges, or web-based logging, record presence effectively without capturing permanent physiological identifiers.

Retention Benchmarks for Attendance Records

A common misconception among administrative teams is that attendance sheets should be kept indefinitely or archived under a single uniform timetable.

Section 134 of the Hungarian Labor Code sets no statutory retention period for working-time records. Instead, retention benchmarks in Hungarian legal practice are derived from separate statutory limitation periods:

Record CategoryGoverning Limitation PeriodOperational Retention Benchmark (Hungarian Legal Interpretation)
Daily working time records (start and end times, overtime, standby, leave)General labour-law limitation period (Mt. Section 286)At least 3 years
Attendance summaries used for payroll calculationTax-assessment limitation periodUntil the applicable tax-assessment limitation period ends (generally 5 years)
Attendance reconciliations treated as accounting vouchersStatutory accounting documentation rules8 years

Regarding long-term archiving, Hungarian legal commentators noted that from January 1, 2025, the previous administrative expectation of retaining employment-related documents until the worker reaches retirement age plus five years no longer applies to newly created employment documents. However, because this change could not be confirmed at the specific statutory paragraph level, employers should consult legal counsel regarding legacy documentation.

As highlighted in the NAIH's 2016 guidance, employers must establish explicit retention periods linked directly to processing purposes. Indefinite storage of granular attendance data creates unnecessary data protection exposure once statutory claim and audit windows have closed.

Technical and Privacy Questions to Ask Software Vendors

Evaluating a time-tracking platform requires examining its data architecture as carefully as its user interface. Before selecting software, decision-makers should verify five foundational technical capabilities:

  • Role-Based Visibility Controls: Can user permissions be restricted by team, shift, or project, preventing supervisors from viewing attendance data for employees outside their direct operational scope?
  • Absence Category Masking: Can the system record an absence as certified medical leave without requiring or displaying diagnostic details to operational managers?
  • Audit Logging: Does the platform maintain an audit log of manual adjustments to recorded hours, noting who made the change and when?
  • Structured Summary Exports: Can the software generate consolidated monthly summaries for external payroll accountants without granting external users access to raw daily logs?
  • Multi-Tenant Data Separation: Does the vendor enforce strict logical separation between tenant databases to prevent cross-organization data exposure?

For organizations operating in Hungary or managing local teams, SimpliTime, developed by DVP Systems Kft., is designed around these workflow boundaries. Built for companies from small teams to organisations with thousands of employees, the web-based time tracking and leave management platform uses a multi-tenant architecture with role-based permissions, audit logging, and export logs. Supervisors can manage shift schedules, approve leave requests via a team calendar, and review discrepancy reports, while administrators oversee overtime multipliers and monthly closing workflows. Rather than replacing payroll software or your external accountant, the system generates structured monthly summaries and export logs tailored for payroll data handover.

Adopting a dedicated platform with defined access roles can help reduce monthly HR administration, typically leads to fewer payroll errors and back-and-forth queries, and can replace the spreadsheets historically used for attendance and leave tracking. Organizations can assess these capabilities through a 60-day trial with no credit card requirement and no automatic billing, with package options available on the SimpliTime pricing page (net of VAT).

Sources

Frequently asked questions

Can team supervisors see the medical reasons behind employee sick leave?
In practice, access to health data should be restricted based on operational necessity. Under data minimisation principles (such as GDPR Article 5(1)(c) and Hungarian Labor Code Section 10), line supervisors only need operational absence status and expected duration to organize workflow and shift coverage. Diagnostic codes and medical certificates are not necessary for daily operational supervision and should remain restricted to authorized HR or payroll personnel.
Are biometric fingerprint scanners legal for routine employee time tracking?
Under Hungarian law (Labor Code Section 11) and the NAIH's November 2016 workplace guidance, processing biometric data is restricted to exceptional situations where it is necessary to prevent severe risks to assets or data, such as securing high-risk research laboratories. Routine attendance tracking does not meet this statutory threshold. While national rules vary across jurisdictions, European data protection guidance similarly treats biometric attendance recording as generally disproportionate when less intrusive identification methods are available.
How long should our company retain daily working time records?
No single statutory retention period governs working-time records. In Hungarian legal practice, retention benchmarks are derived from related limitation periods: at least 3 years based on the general labour-law limitation period (Mt. Section 286), through the end of the tax-assessment limitation period (typically 5 years) where records substantiate payroll calculations, and 8 years where records count as accounting vouchers. Additionally, legal commentators note that the former administrative rule requiring retention until retirement age plus 5 years ceased to apply to newly created employment documents as of January 1, 2025, though its statutory paragraph basis remains unconfirmed.
Does European law mandate an electronic time-tracking software system?
The CJEU ruling in C-55/18 requires an objective, reliable, and accessible system measuring daily working time, but it does not prescribe a specific technical format or mandate electronic software at the EU level. Certain Member States are considering or implementing digital requirements: for instance, Germany's BMAS draft bill would require electronic recording, though it has not yet become law. Regardless of format, employers must demonstrate that their chosen system is reliable, tamper-evident, and accessible to workers.
Can an external payroll accountant have full access to our time-tracking software?
While no specific statutory rule explicitly prohibits giving an external accountant system access, doing so typically conflicts with the data minimisation principle. External payroll providers generally only require validated summary totals (such as total regular hours, overtime multipliers, and leave categories) to calculate remuneration. Providing access to granular daily logs, badge timestamps, or project comments exposes personal data beyond what is necessary for payroll computation.

Evaluate how structured role-based permissions and export workflows fit your operational requirements. Start a 60-day free trial of SimpliTime with no credit card, or review pricing tiers on our website.

SimpliTime · Free trial