Working time records: what the law actually requires (and what it does not)

“Do we have to install a time clock?” No. But the opposite belief, that you can skip time records altogether, is just as wrong, and far riskier.

Between the two sits a precise legal framework, routinely misrepresented by anyone with a badge reader to sell. Here is what the texts actually say.

The European obligation

On 14 May 2019, the Grand Chamber of the Court of Justice of the European Union handed down CCOO v Deutsche Bank SAE (case C-55/18). It held that Member States must require employers to set up an objective, reliable and accessible system measuring the daily working time of each worker.

The reasoning explains everything that follows: without reliable measurement, it is “excessively difficult, if not impossible in practice” for workers to enforce their rights to rest and to maximum working hours. The Court expressly rejected the argument that labour inspectorate powers could fill the gap.

One point on scope: the ruling addresses Member States, not your company directly. It does not, by itself, create an obligation enforceable between an employee and a private employer. But it shapes how national courts read their own legislation.

How it plays out in practice: the French example

France is a useful worked example, because its rule predates the ruling and stays narrower than people assume. Article L3171-2 of the Labour Code provides that where not all employees in a department, workshop or team follow the same collective schedule, the employer must keep the records needed to track working time, compensatory rest accrued, and rest actually taken.

Two things get missed:

• The trigger is the absence of a single collective schedule. A whole team on a posted nine-to-five, no exceptions, falls under a lighter regime. Individualised hours, shift work, on-call duty or part-time all switch on the individual-record requirement.
• The duty covers three things, not one: hours worked, but also compensatory rest accrued and actually taken. Plenty of companies count hours and track no rest at all.

What the law does not require: any particular tool

This is where sales pitches take liberties. No text mandates a time clock, a badge reader, a mobile app or a piece of software. The law demands a record; it does not say what to keep it with.

A properly maintained spreadsheet is legally acceptable. What matters is reliability: an automated recording system must be dependable and tamper-proof. A file that can be rewritten after the fact without leaving a trace will not count for much on the day you need to prove something.

The real risk is not the fine: it is the burden of proof

Penalties get waved around, but set against the cost of litigation the fine for missing records is modest. The serious exposure lies elsewhere.

In overtime disputes, the employee puts forward evidence supporting the claim and the employer must produce its own; the court forms its view on both, ordering any useful investigative measure. An employer with nothing to produce ends up contesting an estimate it cannot refute. Courts draw the obvious conclusion.

Put differently: time records exist less to monitor staff than to let you defend yourself.

The data protection side

The moment you record named schedules, you process personal data. The French data protection authority has set clear markers, and they travel well across the EU under the GDPR:

• Retention: working-time records should not be kept more than five years after the employee leaves.
• Access logs: logging data from an access-control device should disappear far sooner: around three months.
• Biometrics: treated as a disproportionate means of checking working hours.
• Badge readers with photo capture: several employers were formally put on notice for excessive collection, on the view that ordinary badge clocks suffice absent specific, well-evidenced circumstances.

What to take away

• Individual records become mandatory as soon as a single collective schedule no longer covers everyone.
• They must cover hours worked and compensatory rest, accrued and taken.
• No tool is imposed, but the system must be reliable and not silently editable.
• Their primary function is evidential: they are what lets you answer a claim.
• Five years maximum after departure, and no biometrics.

If your teams do not all share the same hours, the question is not whether to keep records, but how to keep them without losing every Friday afternoon to it. A shared schedule, where everyone sees their own slots and absences and rest sit in the same place as tasks, solves much of this upstream: the record becomes a by-product of how you organise, rather than a separate chore.

That is exactly what planning software like SOPlanning is for. User and rights management ensures each person sees only what concerns them, and the feature list sets out what is covered, module by module.

Try SOPlanning free for 30 days, no credit card, with your real schedules.

This article sets out a general framework and is not legal advice. For a specific situation, refer to the legislation in force and, where needed, to qualified counsel.