Time Tracking (fichaje) in Remote Work: How to Comply Withou

Remote work has transformed the way many Spanish SMEs operate, offering flexibility and new opportunities. However, this modality also poses significant challenges, especially regarding compliance with time tracking (registro horario) regulations and the protection of your employees' privacy. As an SME manager or owner, it is essential that you understand how to balance both obligations to avoid sanctions and foster an environment of trust. It's not just about complying with the law, but doing so in an ethical and respectful manner.

The Time Tracking (Registro Horario) Obligation in Remote Work: An Unavoidable Framework

Since the approval of Real Decreto-ley 8/2019, of March 8, the obligation to record the working day is a reality for all companies in Spain, regardless of the work modality. This regulation, which modified the article 34.9 of the Estatuto de los Trabajadores (Spanish Workers' Statute), clearly establishes that the company must guarantee the daily record of the working day, which will include the specific start and end times of each worker's working day, without prejudice to flexible working hours.

The subsequent Ley 10/2021, de 9 de julio, de remote work (trabajo a distancia), consolidated and specified the legal framework for remote work, but did not exempt companies from this obligation. In fact, the law emphasizes the importance of guaranteeing the right to digital disconnection and the privacy of remote workers, while maintaining the need to record their working day. This means that, even if your team works from home, in a hybrid model, or even on the road, you must continue to record their working hours with the same diligence as if they were in the office.

The objective of this regulation is twofold: on the one hand, to protect workers by ensuring compliance with working hour limits, control of overtime, and the right to disconnection; on the other, to provide the Spanish Labour Inspectorate (Inspección de Trabajo y Seguridad Social - ITSS) with the necessary tools to verify compliance. Failure to comply with this obligation can lead to significant sanctions, as we will see later.

The AEPD and Privacy Limits: Where is the Red Line?

This is where the Agencia Española de Protección de Datos (Spanish Data Protection Agency - AEPD) comes into play. The AEPD has been very clear in establishing the limits of what a company can or cannot do when monitoring the working day of its remote workers. The fundamental principle is proportionality: control measures must be necessary for the intended purpose and must not invade the employee's privacy beyond what is strictly essential.

Measures Prohibited by the AEPD

The AEPD has issued several opinions and guidelines establishing which practices are unacceptable due to their invasive and disproportionate nature:

Use of activated webcams or constant video recordings: You cannot require your employees to keep their webcam on throughout their working day or to record their activity on video. This is considered a direct intrusion into their privacy and the personal space of their home.
Periodic or random screenshots: Installing software that takes screenshots regularly or without prior notice is a prohibited practice. The AEPD considers that monitoring the worker's screen in this way is disproportionate and not justified for mere time tracking.
Constant and unjustified geolocation: While location recording at the start and end of the working day may be admissible in certain cases (especially for sales representatives or field technicians), continuous geolocation throughout the remote worker's working day is an excessive measure. The remote worker's home is their private space and cannot be subject to monitoring.
Spyware (keyloggers, keystroke monitoring, etc.): Any tool that records keyboard activity, mouse movements, or application usage intrusively and without a very solid and specific justification (which is not time tracking) will be considered illegal.

These practices are not only contrary to the Ley Orgánica de Protección de Datos Personales y garantía de los derechos digitales (Spanish Organic Law on Personal Data Protection and Guarantee of Digital Rights - LOPDGDD), but also generate distrust and a hostile work environment.

Permitted and Recommended Measures

So, how can you record the working day of your remote workers without invading their privacy? The key lies in the voluntariness and control by the employee themselves.

Web or mobile application time tracking (fichaje) systems: The most common and accepted solution is time tracking software that allows the employee to record their start, end, and breaks of the working day through an application on their computer or mobile phone. The employee is the one who activates and deactivates the record, which respects their autonomy and privacy.
IP address logging: Some systems allow logging the IP address from which time tracking is performed. This can be useful to verify that time tracking is done from the agreed workplace (e.g., the employee's home), but always as complementary data and not as a constant monitoring tool.
Clear information and consent: It is essential to inform your employees about the time tracking system you use, how it works, what data is collected, and for what purpose. Transparency is key.

Common Errors and Punishable Practices: Avoid Risks

Lack of knowledge of the regulations or an erroneous interpretation of them can lead your SME to incur errors that result in a sanction.

Examples of Errors You Must Avoid:

Requiring webcam activation: As already mentioned, asking an employee to keep their webcam on throughout the working day is a violation of their right to privacy and data protection.
Constant computer monitoring: Using programs that take screenshots periodically, record every keystroke, or exhaustively control the applications used, goes beyond what is necessary for time tracking and can be considered an illegitimate intrusion.
Indiscriminate geolocation: If your employee works remotely from their home, you have no justification for constantly geolocating them. Geolocation is only admissible in very specific cases (for example, for sales representatives on the road during their active working day and with a justified and explicit purpose, such as route control or attendance at points of sale, and always informing the employee).
Lack of information to the employee: Failing to adequately inform your remote workers about the time tracking system, the data collected, and their rights, is a breach of data protection regulations.

Associated Sanctions

Sanctions for non-compliance with time tracking or data protection regulations can be high. These fines are established in the Ley de Infracciones y Sanciones en el Orden Social (Spanish Statute of Labour Infractions and Sanctions - LISOS), approved by Real Decreto Legislativo 5/2000.

Non-compliance with time tracking (Art. 7.5 LISOS):
- Minor: Minor formal defects in the record that do not prevent verification of the working day (isolated errors, punctual delays in delivery). Fines range from 70 € to 750 €. ⚠️ Important: the failure to keep a record is classified as a serious infraction (art. 7.5 LISOS), not minor.
- Serious (art. 7.5 LISOS): Failure to record the working day, failure to keep records for four years, or failure to make them available to workers or their representatives. This is the most common scenario. Fines range from 751 € to 7.500 €.
- Very Serious: For infractions of special gravity. Fines can range from 7.501 € to 225.018 €.
Non-compliance with data protection regulations (GDPR and LOPDGDD):
- These sanctions are imposed by the AEPD and can be much higher, depending on the severity and nature of the infraction. They can reach 20 million euros or 4% of the company's global annual turnover, whichever is greater. Invading employees' privacy with cameras or spyware would fall into this category.

It is crucial to understand that the ITSS and the AEPD act in a coordinated manner and, often, a labour inspection can lead to an AEPD investigation if privacy violations are detected.

Practical Solutions for Compliance Without Invasion

Technology is your ally to comply with regulations respectfully. Good time tracking software allows you to manage the recording of your remote workers' working day simply, legally, and efficiently.

Adequate Time Tracking (Fichaje) Systems

A robust online time tracking system should offer:

Web and/or mobile app time tracking (fichaje): Allows employees to record their entry, exit, and breaks from any device (computer, tablet, smartphone), with them activating the action.
Incident logging: Possibility to justify forgotten time tracking or errors.
Accessible reports: Both for the company (for management and the ITSS) and for the employee themselves (to verify their working day).
Data security and protection: Compliance with GDPR in the processing and storage of information.
Flexibility: Adaptation to different schedules and work modalities.

Practical Application Cases

Let's see how this translates into different SME scenarios:

1. 100% Remote Company

If your SME operates entirely remotely, time tracking becomes an act of employee responsibility.

Implement a web/app time tracking software: Each employee accesses their profile and records their daily working day.
Foster self-management and trust: Although the system records, the key is for the employee to be aware of their responsibility.
Establish clear policies: Define availability schedules, rest periods, and the right to digital disconnection. Recording breaks is essential to ensure that rest times are respected.

2. Hybrid Company (2 days home / 3 office)

For hybrid models, you need a system that adapts to both environments.

Unified system: Use the same time tracking software, but allow different methods depending on the location.
In-office time tracking: This can be by fingerprint, card, facial recognition, or, if you prefer to maintain consistency, through the same web/mobile app they use at home.
At-home time tracking: Exclusively via web/mobile app, respecting the privacy of the home.
Clear information: Make sure employees know how and where they should time track each day, according to their modality.

3. Sales Representatives on the Road or Field Technicians

This is a particular case where mobility is key, but privacy remains a priority.

Mobile time tracking at the start and end of the working day: Allows your sales representatives to time track their entry and exit from their working day from their smartphone, recording the location at that moment. This is admissible because it marks the start and end of their work activity, not constant monitoring.
No continuous geolocation: Avoid real-time tracking throughout the working day. If you need to optimize routes or verify visits, use specific route management tools or CRM that record visit points, but not constant and passive employee monitoring.
Informed consent: It is crucial that field employees are fully aware of geolocation functionalities and that these are justified by the needs of their job.

The Contractual Clause and Internal Policy: Transparency and Legal Certainty

To protect your SME and ensure the trust of your employees, transparency is your best tool.

Recommended Contractual Clause

When formalizing the remote work contract or an addendum to an existing contract, it is highly recommended to include a specific clause on time tracking and the use of digital tools. This clause should inform the employee about:

The recording obligation: Recalling the applicable regulations (Art. 34.9 ET, Ley 10/2021).
The recording method: Specifying the software or application that will be used for time tracking.
The purpose of the recording: Explaining that data is collected for legal compliance, working day and overtime control, and to guarantee the right to disconnection.
The data collected: Indicating what type of data is recorded (entry/exit time, breaks, connection IP if applicable, etc.).
Employee rights: Informing about their rights of access, rectification, erasure, restriction of processing, data portability, and objection (ARCO rights expanded by the GDPR).
Prohibition of invasive measures: You can even explicitly include that webcams, screenshots, or constant geolocation will not be used for time tracking.

Internal Policy on Tool Usage and Digital Disconnection

Supplement the contractual clause with a more detailed internal policy that addresses:

Rules for using time tracking tools: How to act in case of forgotten time tracking, incidents, etc.
Right to digital disconnection: Establish rest periods, weekends, and holidays as inviolable for work communications, except in justified urgent cases. This policy is mandatory for companies with remote workers, according to Ley 10/2021.
Use of company equipment: Rules on the use of hardware and software provided by the company.

Clear and proactive communication with your employees not only protects you legally but also builds a relationship of mutual trust, essential for the success of remote work.

Frequently Asked Questions (FAQ)

Can I ask my remote workers to activate their webcam in meetings?

Yes, you can ask your remote workers to activate their webcam to participate in virtual meetings, provided it is a specific request justified by the dynamic of the meeting (for example, to facilitate non-verbal communication or interaction). However, you cannot force them to keep it on throughout the working day or use it as a time tracking or activity monitoring tool. The key is the purpose and duration: for a specific meeting, it is reasonable; for constant monitoring, it is not.

Is it legal to use software that records keyboard or mouse activity?

No, it is not legal for time tracking. The AEPD and jurisprudence have been very clear on this. The use of software that records keystrokes, mouse movements, or screenshots constantly or periodically is considered a disproportionate and invasive measure of the worker's privacy. These tools go beyond what is necessary to record the working day and can be subject to significant sanctions by the AEPD.

What happens if an employee forgets to time track (fichar)?

It is a common situation, especially in remote work. The important thing is to have an established protocol. Your time tracking software should allow the employee to report the oversight and justify it. As a company, you must have a procedure to validate these incidents (for example, through a request to the supervisor or an email). The fundamental thing is that the final record reflects the actual working day, even with corrections. Failure to record is considered non-compliance, so it is better to correct it than to leave it unrecorded.

Can I geolocate my sales representatives who work remotely?

You can geolocate your sales representatives or field technicians during their active working day and only at the start and end of the day, or at specific visit points, provided this measure is necessary for service management and you have previously informed the employee. However, you cannot geolocate them constantly or passively throughout their entire working day, much less outside of it. The objective is not personal tracking, but the management of specific work activity on the road. For remote workers operating from a fixed address, geolocation is generally inadmissible.

Do I have to give my employees access to their time tracking records?

Yes, absolutely yes. Article 34.9 of the Estatuto de los Trabajadores (Spanish Workers' Statute) establishes that the company must keep records for four years and make them available to workers, their legal representatives, and the Spanish Labour Inspectorate (Inspección de Trabajo y Seguridad Social). This means that each employee has the right to access their own time tracking record at any time to verify their hours worked. Good time tracking software facilitates this access simply and transparently.

Ensuring compliance with time tracking in remote work without invading your employees' privacy is a delicate balance, but perfectly achievable with the right tools and knowledge. Investing in a time tracking system that respects regulations and the privacy of your workers is not only a legal obligation but an investment in the trust and well-being of your team.

Are you concerned about not complying with regulations and want to know what sanctions you are exposed to? Use our sanction calculator for non-compliance with time tracking to assess your situation.

This guide compiles public regulations. It does not substitute legal advice.

Time Tracking (fichaje) in Remote Work: How to Comply Without Invading Privacy