Time Records as Personal Data

Time records are personal data about identified individuals, and in aggregate they describe someone's daily pattern of life in considerable detail.

General orientation, not legal advice.

What the record contains

When someone starts and stops, every day, which reveals commuting patterns, caring responsibilities and health absences by inference.

Where, if the system captures location.

What they worked on, which for some roles is sensitive in itself.

Deviations: late starts, long days, weekend work.

Over a year this is a detailed behavioural record, which is worth recognising even though each individual entry looks innocuous.

Lawful basis

Legal obligation covers the core recording duty where one exists, and it covers only what the duty requires.

Contract covers what is necessary to pay someone.

Legitimate interests may cover billing and project costing, with a documented balancing test.

Consent is a weak basis in employment because it cannot be freely refused, which matters most for anything beyond the core record.

Different purposes may rest on different bases, and they should be written down separately rather than as one blanket justification.

Minimisation in practice

Collect what the purpose requires and no more.

Duration and project code serve billing and costing. Application logs do not.

Location serves a site-based clock-in. Continuous location does not.

Narrative on a time entry serves a client query. A detailed activity description does not, and in some professions it creates its own confidentiality problem.

The minimisation test is concrete here: for each field, name the purpose it serves. Fields that survive without an answer are the ones to remove.

Access

Workers can generally request the data held about them, and for time records this is simple to satisfy and frequently requested in disputes.

Better: give routine access. Where the recording duty applies, accessibility is part of the standard rather than a response to a request.

A worker who can see their own record corrects it, which improves the data and is the cheapest quality control available.

Retention

Driven by the longest applicable obligation, which for pay and working time records is usually years.

Different components may have different periods. The statutory record of hours is not the same as a productivity report derived from it.

Derived analyses should have shorter periods than the underlying record, and frequently have none at all.

Enforce by deletion, verified, including backups.

Access control

Managers see their own team, not the organisation.

Payroll sees what payroll needs.

Nobody browses. Access to another person's detailed record should require a reason and be logged.

Review the log, which is also what protects managers from an accusation.

The assessment

Where the system does more than record duration — location, activity, automatic capture — an impact assessment is likely required and is certainly advisable.

Record the proportionality reasoning: what less intrusive option was considered, and why it was rejected. For time tracking the less intrusive option is almost always "record duration only", which makes the reasoning short and the rejection hard.

The field-by-field test

Minimisation made concrete, and it takes one pass through the form.

For every field collected, name the purpose it serves.

Duration: pay, billing, costing.

Project code: billing, costing.

Location: a site-based clock-in check.

Application log: nothing in the four purposes.

Fields that survive without an answer are the ones to remove, and the exercise is usually shorter than expected because most systems collect a handful of things for good reasons and several for none.

Access by role, reviewed

Who can see a named person's record, and how that is kept narrow.

Managers see their own team, as exceptions and aggregates.

Payroll sees what payroll needs.

Nobody browses. Detailed individual access requires a reason and is logged.

Review permissions quarterly, which reliably finds people who changed role and kept access.

Report the review, including a clean result, because a control nobody sees being exercised is assumed not to exist.

Check the difficult case

Use employee PC activity tracking to frame one representative test for this issue. The useful evidence is not the marketing description itself but the record created when a worker corrects an entry, a manager reviews it and an administrator exports it.