How to automate time and attendance records

You automate attendance records with three pieces: clocking that takes one tap (a button on the phone, a card, a PIN on a tablet), a store that keeps every mark with the person and a date and time stamped by the system, and a monthly report that generates itself and stays filed for four years. That covers what Spanish law requires under article 34.9 of the Workers' Statute, and it stops anyone from chasing people at month end.

What sinks attendance records is not the law, it's friction. I've seen a team of fifteen running a shared spreadsheet that got filled in on the 30th from memory. That isn't a record, it's a reconstruction. If clocking in takes more than three seconds, people forget; if the report has to be built by hand, it gets built late and badly.

What exactly does Spanish law require?

Since 12 May 2019, every company must record each day the start and end time of every worker, including part-time contracts and remote work. Records are kept for four years and must be available to staff, their representatives and the Labour Inspectorate. There is no size exemption: it binds a company of three exactly as it binds one of three hundred.

Failing to record is a serious offence. Fines start in the hundreds of euros and reach several thousand per workplace, and inspectors usually ask for the records of specific months, not a summary. That's where it shows whether the system was really capturing marks or whether someone filled them in afterwards.

The law imposes no technology. It says what must be recorded and for how long, not with what. Signed paper is legal. It just won't warn you when someone has gone two days without clocking in, or hand you the month's summary as a PDF.

How do you automate it, step by step?

Six steps. The first two are decisions, not software:

1. Decide where each person clocks in. A warehouse, home, a van, a client's site. The place decides the system: if half the team is out, a terminal by the door is useless.
2. Choose a one-tap method. A button on the phone, a card against a reader, a PIN on a tablet by the entrance. Three seconds is the ceiling.
3. Store who, when and from where. The server stamps the time, not each person's phone. That's the difference between a trustworthy record and a list of good intentions.
4. Define who corrects and with what trail. People forget. The manager corrects, but the previous value, the author and the timestamp are kept. Without a trail, the record defends nobody.
5. Automate the monthly report and the alerts. On the 1st, a per-person PDF summary: hours worked, overtime, absences. Plus an alert to the manager when someone has gone two days without a mark.
6. Keep four years and test the restore. Automatic backups, and once, actually restore one. A backup that has never been restored isn't a backup, it's an assumption.

Step five is the one that changes life for the admin team. A monthly summary that comes out on its own turns half a day of counting into a ten-minute review.

Which clocking system should you choose?

It depends on where people are and how many there are. Compared by what actually matters:

For most small businesses I see, the combination that works is a phone app for whoever moves and a tablet at the door for whoever doesn't. Two ways to clock in, one record behind them.

What does data protection say about fingerprints and location?

These are the two places where a company gets into trouble without noticing. Fingerprints and faces are biometric data, a special category under the GDPR. The Spanish data protection authority has made clear that plain attendance control rarely has a sufficient legal basis or meets proportionality: there are less intrusive means that achieve the same thing. Employee consent doesn't save it either, because consent in an employment relationship isn't considered freely given.

Location is similar with a nuance. Recording the point at the moment of clocking is defensible if there's a real reason, for instance checking that people clock in on the assigned site, and it's disclosed in writing. Following the position all day is no longer attendance recording: it's continuous monitoring, and it's disproportionate. Store the point, not the trail.

Whatever the system, you must inform staff in writing of what is recorded, why and for how long it's kept, and enter it in the record of processing activities. Two pages that avoid most of the trouble.

How much does it cost and how long does it take?

There are two routes. A subscription tool runs at roughly two to five euros per person per month, goes live in an afternoon and covers the standard case. For twenty people that's around seven or eight hundred euros a year, and that ends the decision: if your case is ordinary, pick one and stop thinking about it.

Custom development makes sense when clocking has to talk to what you already run: hours landing straight in the payroll system, time charged to the project or site the person was on, shifts coming from the rota the supervisor already keeps. There a generic tool forces you to export, reconcile and re-upload every month. That kind of build usually takes a few weeks of work and pays for itself in the admin hours it stops eating.

The sum I use to decide: if counting and reconciling the month takes someone more than half a day, that's about six hours a month, seventy-two hours a year. Any quote gets measured against that.

When is it NOT worth automating?

• When there are three of you on fixed hours. A well-kept sheet complies and costs nothing. Automating here is buying yourself a maintenance problem.
• When the real problem isn't the record. If what hurts is that nobody knows how many hours go into each project, you need time allocation, not a clock-in button. Different things, solved differently.
• When it's meant for surveillance. A system installed to catch someone ends with the team against it and with faked marks. The record exists to comply and to know, not to chase.
• When the schedules are still changing. If you're mid-way through a shift or agreement change, wait for it to settle. Automating rules that will change in two months means building it twice.

What mistakes do people usually make?

Almost all of them are design mistakes, not tool mistakes.

• Asking for too much at each mark. Start, end, break, reason for the break, project. Within a week half the team stops logging breaks. Begin with start and end; the rest later, and only if needed.
• Letting the device stamp the time. If the mark comes from the phone's clock, the record can be altered by changing the phone's time. The server stamps it.
• Allowing corrections without a trail. A record that can be edited with no history proves nothing. Correcting must be possible, but leaving the before and the after.
• Not flagging the gaps. Without an automatic alert, forgotten marks surface on the 30th, when nobody can reconstruct what happened on the 9th.
• Forgetting to delete after four years. The duty is to keep for four years, not to keep forever. Past that, the data has to go.

Frequently asked questions

Is time and attendance recording mandatory in Spain?

Yes. Since May 2019 every company must record the daily start and end time of each worker, whatever its size or sector, and keep those records for four years, available to staff, their representatives and the Labour Inspectorate. Not recording is a serious offence, with fines starting in the hundreds of euros and rising to several thousand per workplace.

Is a spreadsheet enough for attendance records?

Legally it can be, if it holds start and end times per person and day and is kept signed or validated. In practice it fails in two places: it gets filled in from memory at month end, and anyone can change a cell without leaving a trace. Under five people it usually holds up; beyond that it costs more to maintain than to automate.

Can staff clock in with a fingerprint or face recognition?

That is the most problematic option. Fingerprints and faces are biometric data, a special category under the GDPR, and the Spanish data protection authority holds that plain attendance control rarely has a sufficient legal basis or meets proportionality. Unless the case is very well justified and backed by an impact assessment, a card, a PIN or an app is safer.

Can I geolocate my team through the clocking app?

You can record the location at the moment of clocking if there is a real reason, such as checking that people clock in on the assigned site, and you inform them in writing. What you cannot do is follow their position all day: that stops being attendance recording and becomes continuous monitoring, disproportionate and punishable. Store the point, not the trail.