Guide · Attendance control
Attendance control at work in Spain: what it is, what the law requires and how to do it
Knowing who is working and when they start and finish. We explain how it differs from time tracking, the legal duty behind it, and today's attendance systems: phone app, NFC bases, terminals and biometrics.
Updated 17 October 2026 · Official sources at the end of the page
14-day free trial. Payment method required; nothing is charged during the trial. Then €1/user/month + VAT.
In short
- Attendance control records who is at work and when they start and finish. In Spain, its mandatory form is the daily working-time record in article 34.9 of the Workers' Statute[1].
- The record must show the exact start and end time of each working day, be kept for four years and be available to workers, their representatives and the Labour Inspectorate[1].
- Common systems: phone app, NFC bases or cards, PIN or card terminals and biometric readers (fingerprint or face).
- Spain's data protection authority (AEPD) considers biometric attendance control high-risk processing[3]; phone or NFC systems avoid that problem.
- If you use geolocation, the law requires you to inform staff beforehand, expressly, clearly and unambiguously[2].
What is attendance control?
Attendance control is how a company knows who is working and when: what time each person starts, takes breaks and finishes. It used to mean turnstiles, cards and time clocks at the entrance; today most people clock in from their phone or by tapping it on an NFC base.
In Spain, «control de presencia», «fichaje» and «control horario» are used almost interchangeably, because all three serve the same legal duty: the daily working-time record. The difference is focus: attendance control looks at who is in and when (arrivals, departures, who is absent today), while time tracking focuses on hours: time worked, overtime, balances and schedules.
Is attendance control mandatory? What the law says
The law does not use the term «attendance control», but it does require every employer to guarantee a daily record of working time for each worker. This is article 34.9 of the Workers' Statute, introduced by Royal Decree-law 8/2019 and applicable since 12 May 2019 (two months after its publication in the BOE)[1][4]. The current text reads (our translation):
«The company shall guarantee the daily recording of working time, which must include the specific start and end time of each worker's working day […]. The company shall keep the records […] for four years and they shall remain available to the workers, their legal representatives and the Labour and Social Security Inspectorate.»[1]
How the record is organised and documented is set by collective bargaining or a company agreement or, failing that, by the employer after consulting the workers' legal representatives[1]. For the full legal detail (fines, part-time work, overtime and the reform in progress), see our guide to Spain's time-recording law.
Attendance control systems compared
Any system works if it covers the essentials: a daily record, each person's start and end time, four-year retention and access for those entitled to see it. These are the usual options:
| System | How it works | Hardware | Data protection |
|---|---|---|---|
| Phone app | Each person clocks in from their phone with their own account, optionally with location checks. | None | No biometric data. If geolocation is used, staff must be informed beforehand[2]. |
| NFC base or card | The worker taps their phone on a base fixed at the workplace. | NFC base (low cost) | No biometric data. Shows the clock-in happened on site. |
| PIN or card terminal | A device at the entrance where each person types a code or swipes a card. | Wall terminal | No biometric data; PINs and cards can be shared. |
| Fingerprint or face recognition | A reader identifies the person by a physical trait. | Biometric terminal | Special-category data (GDPR art. 9). The AEPD considers it high-risk[3]. |
Phone app
- How it works:
- Each person clocks in from their phone with their own account, optionally with location checks.
- Hardware:
- None
- Data protection:
- No biometric data. If geolocation is used, staff must be informed beforehand[2].
NFC base or card
- How it works:
- The worker taps their phone on a base fixed at the workplace.
- Hardware:
- NFC base (low cost)
- Data protection:
- No biometric data. Shows the clock-in happened on site.
PIN or card terminal
- How it works:
- A device at the entrance where each person types a code or swipes a card.
- Hardware:
- Wall terminal
- Data protection:
- No biometric data; PINs and cards can be shared.
Fingerprint or face recognition
- How it works:
- A reader identifies the person by a physical trait.
- Hardware:
- Biometric terminal
- Data protection:
- Special-category data (GDPR art. 9). The AEPD considers it high-risk[3].
For most SMEs, the best mix is a phone app for mobile or remote staff and an NFC base on site for those who prefer to clock in at the door. If you are considering a fingerprint clock, read our guide to clocking in without fingerprints first.
What about fingerprint or face-recognition attendance?
Biometric data used to identify a person is a special category of personal data under the GDPR. In November 2023 the AEPD published a guide on biometric attendance control concluding that it is «high-risk processing», that in the workplace the worker's consent cannot lift the ban on processing this data, and that a data protection impact assessment must be passed before starting[3]. We cover it in detail, including AEPD decisions, in clocking in without fingerprints.
Phone-based attendance and geolocation
Phone-based attendance is the fastest to roll out: no terminals to buy, and it works for offices, building sites, deliveries or remote work. If you also want to check where people clock in from, Organic Law 3/2018 allows employers to process geolocation data for the monitoring functions in article 20.3 of the Workers' Statute, but requires them to inform workers beforehand, expressly, clearly and unambiguously (and their representatives, where applicable) about these devices and their rights[2].
If you are looking for a tool to clock in from the phone, see our clock-in app.
How to choose an attendance control system
- Meets the daily-record rule: start and end time of each working day, per person, kept for four years[1].
- Individual credentials: every clock-in is tied to a specific person, not to an anonymous shared device.
- Corrections with a trail: mistakes and missed clock-outs are fixed without deleting the original entry, recording who changed what.
- Access and export: staff can see their records and the company can hand them to the Inspectorate on request.
- No biometrics unless you can justify them: given the AEPD's position[3], it is not worth it for most companies.
- Clear pricing: per user, with no mandatory hardware. Compare on our pricing page.
Attendance control with Ficha.Work
Ficha.Work is time-tracking software built for SMEs and advisory firms in Spain. It complies with RDL 8/2019 and keeps you inspection-ready, without biometric terminals.
- Clock in from the app (Android, iOS and web), optionally with GPS or geofence location checks.
- NFC bases to clock in on site by tapping the phone (€35 per base, one-off payment).
- Automatic clock-in based on each person's schedule, if you prefer.
- No fingerprints or face recognition: we do not process biometric data.
- Corrections through time corrections with a change history, and four-year record retention.
- Exportable monthly reports, ready for the Labour Inspectorate.
- €1/user/month + VAT. 14-day free trial (payment method required; nothing is charged during the trial).
Attendance control FAQ
What is attendance control at work?
It is the system a company uses to record who is working and when they start and finish. In Spain it is how employers meet the daily working-time record required by article 34.9 of the Workers' Statute.
Is attendance control mandatory for companies in Spain?
Keeping a daily record with each worker's exact start and end time is mandatory. It must be kept for four years and be available to staff, their representatives and the Labour Inspectorate (art. 34.9 Workers' Statute, applicable since 12 May 2019).
What is the difference between attendance control and time tracking?
They serve the same legal duty. Attendance control focuses on who is in and when they arrive and leave; time tracking focuses on hours: time worked, overtime, balances and schedules. A good system covers both.
Can attendance be tracked by phone?
Yes. The law does not require a specific device. If geolocation is used, staff must be informed beforehand, expressly, clearly and unambiguously (art. 90 of Organic Law 3/2018).
Can fingerprints be used for attendance control?
The AEPD considers biometric attendance control high-risk processing, says the worker's consent cannot lift the ban on processing this data and requires a prior impact assessment. That is why we recommend alternatives such as phone or NFC clock-in.
How long must attendance records be kept?
Four years, under article 34.9 of the Workers' Statute.
Is there free attendance control software?
Ficha.Work has no free plan: it costs €1/user/month + VAT. You can try it free for 14 days; a payment method is required at signup and nothing is charged during the trial.
Keep reading
Spain's time-recording law
The legal text, LISOS fines and the status of the digital reform.
Clock in without fingerprints
Biometrics and the AEPD: why phone or NFC are the alternative.
Work-time registration
How to keep the working-time record in your company.
Clock-in app
Clock in and out from the phone, with NFC or by schedule.
Sources
All sources are official texts (BOE, AEPD, Spanish Ministry of Labour, Council of Ministers, Congress, EUR-Lex), consulted on 17 October 2026. Quotations are translated from Spanish; the Spanish text is the authoritative one. This page is for information only and is not legal advice: for a specific case, ask your employment adviser.
- [1] Workers' Statute (RDLeg 2/2015), article 34.9 — consolidated text, BOE-A-2015-11430 (Spanish)
- [2] Organic Law 3/2018 (LOPDGDD), articles 89 and 90 — video surveillance and geolocation at work — BOE-A-2018-16673 (Spanish)
- [3] AEPD — «Guía sobre tratamientos de control de presencia mediante sistemas biométricos» (guide on biometric attendance control, v. November 2023; the PDF is marked «en revisión» — under review — on aepd.es as of October 2026) (Spanish)
- [4] Royal Decree-law 8/2019 of 8 March (BOE no. 61, 12 March 2019), final provision six.4 — BOE-A-2019-3481 (Spanish)
Track attendance without paper or biometrics
App, NFC or schedule-based clock-in. Four-year records and inspection-ready reports.
Create account and try 14 days14-day free trial. Payment method required; nothing is charged during the trial. Then €1/user/month + VAT.