Guide · Biometrics and data protection
Clock in without fingerprints: time tracking without biometric data
Fingerprint and face-recognition clocks are common, but Spain's data protection authority (AEPD) considers them high-risk processing and has brought proceedings against organisations using them without complying with the GDPR. Here is why, and the alternatives: clocking in by phone or NFC.
Updated 17 October 2026 · Official sources at the end of the page
14-day free trial. Payment method required; nothing is charged during the trial. Then €1/user/month + VAT.
In short
- Fingerprints or faces used to identify someone are biometric data, a special category whose processing the GDPR prohibits unless an exception applies[1].
- In its November 2023 guide, the AEPD considers biometric attendance control high-risk processing, says that at work consent is not valid to lift that prohibition and requires a prior impact assessment[2].
- According to the AEPD, relying on GDPR art. 9(2)(b) would require a law expressly allowing it, and such a rule «is not found in current Spanish law»[2].
- The AEPD has found infringements and imposed fines in proceedings about fingerprint clock-in systems[4][5].
- Spain's time-recording law does not require biometrics: a reliable daily start/end record is enough[6]. Phone or NFC base clock-in complies without processing biometric data.
Why are fingerprints a problem for clocking in?
The GDPR defines biometric data as data resulting from specific technical processing of a person's physical or physiological characteristics that allow or confirm their unique identification, such as facial images or fingerprint data (art. 4(14)). When used to identify a person, it is a special category of data and processing it is prohibited unless one of the exceptions in art. 9(2) applies[1].
A fingerprint clock or face-recognition terminal processes exactly that data, for the whole workforce, every day, for a purpose (knowing when each person starts and finishes) that less intrusive means can achieve.
What the AEPD says about biometric attendance control
In November 2023 the AEPD published its «Guía sobre tratamientos de control de presencia mediante sistemas biométricos» (guide on biometric attendance control)[2][3]. Its conclusions (our translation):
- «The use of biometric identification and authentication technologies in attendance control is high-risk processing that includes special categories of data.»[2]
- «For working-time recording and access control for employment purposes, if lifting the prohibition is based on 9.2.b), the controller must have a rule with the rank of law specifying the possibility of using biometric data for that purpose, which is not found in current Spanish law.»[2]
- «For working-time recording or access control in the employment context, consent cannot lift the prohibition on processing, nor be a basis for lawfulness, as there is generally an imbalance between the data subject and the controller.»[2]
- Data minimisation and data protection by design apply, «using equivalent, less intrusive alternative measures»[2].
- A data protection impact assessment must be passed before processing starts[2].
The guide also notes that articles 20.3 and 34.9 of the Workers' Statute, which allow employers to monitor work and require time recording, contain no authorisation to use biometric data[2]. Note: as of October 2026, the guide's PDF on aepd.es is marked «en revisión» (under review); the quotes are from the November 2023 version still published there[2].
AEPD decisions on fingerprint clock-in
The AEPD has decided sanctioning proceedings about fingerprint time-recording systems. Two examples published on its website:
- PS/00165/2024 (a regional public body): the AEPD found a breach of GDPR art. 9, as well as arts. 35 and 38, and ordered it to prove it had replaced its time-recording system «with another that does not involve processing biometric data»[4].
- PS/00170/2023 (a private company with fingerprint clock-in): fines totalling €365,000 for breaching GDPR arts. 13 (information to workers), 32 (security) and 35 (impact assessment), plus an order to bring the processing into line[5].
In the first case, as a public body, the decision found the infringement and ordered corrective measures without a fine. The second shows that, for a company, the problems with a biometric system go beyond the legal basis: failing to inform staff, to secure the data or to carry out an impact assessment is also sanctioned.
The time-recording law does not require biometrics
Article 34.9 of the Workers' Statute requires a daily record of each person's start and end time, kept for four years and available to staff, their representatives and the Inspectorate[6]. It does not require any particular identification method. See our guide to Spain's time-recording law for the detail.
Alternatives to fingerprint clock-in
| Method | How the person is identified | Biometric data | Best for |
|---|---|---|---|
| Phone app | Their own login on their phone | No | Mobile teams, multiple sites, remote work |
| NFC base | The person's phone, tapped on a fixed base | No | Offices, shops, sites, warehouses: shows the clock-in happened on site |
| Schedule-based clock-in | The system records according to the assigned schedule and the person corrects any change | No | Regular, stable hours |
| PIN or card terminal | Personal code or card | No | Workplaces that prefer not to use phones |
Phone app
- How the person is identified:
- Their own login on their phone
- Biometric data:
- No
- Best for:
- Mobile teams, multiple sites, remote work
NFC base
- How the person is identified:
- The person's phone, tapped on a fixed base
- Biometric data:
- No
- Best for:
- Offices, shops, sites, warehouses: shows the clock-in happened on site
Schedule-based clock-in
- How the person is identified:
- The system records according to the assigned schedule and the person corrects any change
- Biometric data:
- No
- Best for:
- Regular, stable hours
PIN or card terminal
- How the person is identified:
- Personal code or card
- Biometric data:
- No
- Best for:
- Workplaces that prefer not to use phones
With NFC, the base is fixed at the workplace and people clock in by tapping their phone, so you do not need a fingerprint reader to know they were there. If you also use phone location, the law requires you to inform staff beforehand, expressly, clearly and unambiguously[7]. We compare NFC, QR and face recognition in NFC vs QR clocking.
If you already have a fingerprint clock
- Check with your data protection officer or adviser whether you have a valid legal basis and a passed impact assessment, as the AEPD requires[2].
- Make sure staff have been informed of everything required by GDPR art. 13; that was one of the grounds for the fine in PS/00170/2023[5].
- Consider moving to a non-biometric method (phone or NFC) and securely deleting biometric templates you no longer need.
- Keep earlier time records for the four years the law requires[6].
Ficha.Work: clock-in without biometrics
Ficha.Work does not use fingerprints or face recognition, by design. Each person clocks in with their own account and the record complies with RDL 8/2019.
- Clock-in app for Android, iOS and web, optionally with GPS or geofence location checks.
- NFC bases to clock in on site by tapping the phone (€35 per base, one-off payment).
- Automatic clock-in by schedule.
- Corrections with history through time corrections and four-year record retention.
- Exportable reports, ready for the Labour Inspectorate.
- €1/user/month + VAT. 14-day free trial (payment method required; nothing is charged during the trial).
Fingerprint clock-in FAQ
Is fingerprint clock-in legal in Spain?
A fingerprint used for identification is special-category biometric data (GDPR art. 9). The AEPD considers that at work consent cannot be relied on, that relying on art. 9(2)(b) would require a law that does not currently exist in Spain, and that a prior impact assessment is mandatory. In practice it is very hard to justify.
Can my employer make me clock in with my fingerprint?
According to the AEPD's November 2023 guide, worker consent is not valid for this processing because of the imbalance between the parties, and current employment law does not expressly authorise biometrics for time recording. If in doubt, ask the workers' representatives or the AEPD.
Has the AEPD fined companies for fingerprint clock-in?
Yes. In proceeding PS/00170/2023 it fined a company with fingerprint clock-in a total of €365,000 (for lack of information, security and impact assessment), and in PS/00165/2024 it found that a public body had breached GDPR art. 9 and ordered it to replace the system with one that does not use biometric data.
What about face recognition?
A face used to identify a person is also biometric data, and the AEPD's attendance-control guide applies equally to fingerprints and face recognition.
What is the alternative to fingerprint clock-in?
Clocking in from the phone with a personal login, with an NFC base fixed at the workplace, by schedule, or with a PIN or card. None of them process biometric data and all can meet the daily time-recording duty.
Does the new digital time-recording rule ban fingerprints?
The draft Royal Decree on digital time recording (October 2025) does not expressly mention biometrics and, as of 17 October 2026, has not been approved. Today the limits on fingerprint clock-in come from the GDPR and the AEPD's position, not from employment law.
Sources
All sources are official texts (BOE, AEPD, Spanish Ministry of Labour, Council of Ministers, Congress, EUR-Lex), consulted on 17 October 2026. Quotations are translated from Spanish; the Spanish text is the authoritative one. This page is for information only and is not legal advice: for a specific case, ask your employment adviser.
- [1] Regulation (EU) 2016/679 (GDPR), articles 4(14) and 9 — EUR-Lex
- [2] AEPD — «Guía sobre tratamientos de control de presencia mediante sistemas biométricos» (guide on biometric attendance control, v. November 2023; the PDF is marked «en revisión» — under review — on aepd.es as of October 2026) (Spanish)
- [3] AEPD — press release of 23 November 2023 announcing the guide (Spanish)
- [4] AEPD — decision in proceeding PS/00165/2024 (public body; breach of GDPR art. 9 through biometric clock-in) (Spanish)
- [5] AEPD — decision in proceeding PS/00170/2023 (company; fingerprint clock-in; fines under GDPR arts. 13, 32 and 35) (Spanish)
- [6] Workers' Statute (RDLeg 2/2015), article 34.9 — consolidated text, BOE-A-2015-11430 (Spanish)
- [7] Organic Law 3/2018 (LOPDGDD), articles 89 and 90 — video surveillance and geolocation at work — BOE-A-2018-16673 (Spanish)
Clock in without fingerprints from today
App, NFC or schedule-based clock-in. No biometric data and inspection-ready reports.
Create account and try 14 days14-day free trial. Payment method required; nothing is charged during the trial. Then €1/user/month + VAT.