Digital time tracking: what the law requires today and what is still pending

If you run a small business or you are a freelancer with employees, you have probably heard about mandatory digital time tracking. The confusion is understandable: there is a law in force since 2019, a bill that Congress sent back to the government in 2025, and a draft regulation that has still not been published in the Official State Gazette (BOE).

In this article we separate what is already mandatory from what is still going through the process, with the real timeline, the penalties in force and a practical action plan. No invented figures and no deadlines nobody has confirmed.

This guide covers what a business owner or HR manager needs to understand: the requirements in force, the real timeline, the penalty framework, what a good system looks like, and the concrete steps to get there. If you are also preparing for other regulatory changes in Spain, you may want to read our guide to VeriFactu 2027 for SMBs and freelancers, which covers the parallel mandate for electronic invoicing.

What the law in force requires and what the draft proposes

The law in force: RDL 8/2019 (art. 34.9 of the Workers' Statute)

Since May 2019, article 34.9 of the Workers' Statute has required every company to keep a daily record of each employee's working hours, including start and end times. The rule leaves the format open: paper, a spreadsheet or a digital application are all valid, as long as the system is reliable and cannot be manipulated. Records must be kept for four years and be available to workers, their representatives and the Labor Inspectorate.

This is the law today. If your company does not record its employees' hours, it is already in breach of the rules in force and can be fined.

The draft regulation (2025-2026): not approved yet

The Ministry of Labor is pushing a regulation that would go beyond the 2019 law. This draft has still not been published in the BOE and is therefore not in force. If it were approved, the three main changes it proposes would be:

• Digital format only. The draft proposes banning paper, handwritten signatures and spreadsheets. Only electronic systems would be accepted.
• Remote access for the Labor Inspectorate. If it is approved, inspectors could consult the records remotely and in real time, without traveling to the company.
• Unalterable, traceable records. The draft text calls for automatic time stamping, a log of every change, and no deletion without a trace.

The draft also proposes that the record include start time, end time, breaks and overtime, a level of detail beyond what the current rule demands.

Data retention: four years

Companies must keep time tracking records for a minimum of four years. This requirement already exists under the 2019 law in force, and the draft would keep it unchanged.

Who it applies to

The obligation applies to every company in Spain with employees, regardless of headcount. A company with one employee and a 500-person enterprise have the same duty. There are no sector-specific carve-outs and no distinction between full-time and part-time workers. A freelancer working alone, with no employees, is not covered.

The real timeline: what has happened and what is still pending

The path of this reform has been bumpy. Knowing the real timeline helps you tell apart what is law, what was attempted and what is still pending.

The honest answer on timing is that there is no closed date. The draft has not been published in the BOE, and the Council of State opinion has added uncertainty to the calendar. There is also open debate about the transition period: the draft text mentioned 20 days, the Ministry of Labor has talked about six months, and the Ministry of Economy has asked for a year for small businesses. There is no agreement.

What is clear is that the obligation to record working hours already exists, and has since 2019. Fines for having no time record apply today, under the rules in force. You do not need to wait for any new BOE entry to act.

Fines and penalties: what applies today and what was proposed

It is important to separate what is already being fined from what was proposed but never approved. Confusing the two has produced incorrect figures in a lot of press coverage.

The penalty framework in force (LISOS)

Current fines are set by the Spanish law on offenses and penalties in the social order (LISOS, RDL 5/2000). They apply per company, not per worker:

What the failed bill proposed

The May 2025 bill, the one Congress sent back in September, proposed a radical change: fines calculated per affected worker, in a range of EUR 1,000 to EUR 10,000 per worker for serious offenses. That would have multiplied the economic impact for companies with staff. But that bill was sent back and is not law. As things stand, fines are still per company under the LISOS in force.

What the Inspectorate is penalizing today

Working time and time records are a standing enforcement line for Spain’s Labor and Social Security Inspectorate, which publishes an annual activity report broken down by subject. What can be verified from the law itself is the LISOS band in the table above, and the fact that the Inspectorate already applies it under the 2019 rules in force, without waiting for any new regulation.

What a digital time tracking system should include

The 2019 law does not spell out specific technical requirements beyond the system being reliable. The draft regulation, if it is approved, would include a concrete list. These are the requirements the draft proposes and which, in any case, are good practice for any time tracking system:

1. Immutable records with audit trail

Once an employee clocks in or out, that record should not be deletable or editable without generating an auditable log entry. If a correction is needed, because an employee forgot to clock out for example, the system should record the original entry, the correction, who made the change, and when. An Excel spreadsheet fails this test by design, because any cell can be overwritten without a trace.

2. Start, end, breaks, and overtime

The draft would require four distinct data points per employee per day: shift start time, shift end time, break periods, and any overtime worked. The 2019 law in force only asks for start and end times, so a system that records nothing else would meet today's rule but not the proposed one.

3. Remote accessibility for ITSS

Today the Inspección de Trabajo y Seguridad Social (ITSS) reviews time records during an on-site visit. The draft would let inspectors access them remotely and in real time, which in practice points to a cloud-hosted or cloud-accessible system. On-premise software reachable only from the company's internal network would fall short unless it also offers a secure external access point.

4. Employee access

Workers and their legal representatives must have access to their own time records. This is already required by the 2019 law. The system should let employees view their logged hours, check they are accurate, and raise a dispute if they are not.

5. No high-risk biometric requirements

While the law does not prohibit biometric systems (fingerprint readers, facial recognition), the GDPR and Spain's data protection authority (AEPD) classify biometric data as high-risk. If you use biometric time tracking, you must conduct a Data Protection Impact Assessment (DPIA) and justify why less invasive methods are insufficient. In practice, most SMBs are better served by PIN, app-based, or geolocation clock-in methods that avoid the GDPR complexity entirely.

6. Four-year data retention

Records must be stored for a minimum of four years, under the 2019 law and under the draft alike. The system should prevent accidental or intentional deletion within that window. Cloud platforms usually handle this automatically; if you self-host, you need backup and retention policies in place.

Concrete steps to prepare your company

Even though the draft is not approved, preparing early makes practical sense: the obligation to record working hours already exists, the Inspectorate is already fining companies, and the direction of travel is clear. Here is a step-by-step plan to move from paper or spreadsheets to a digital system.

Step 1: Audit your current system

Start by documenting how your company currently tracks working hours. Identify whether you use paper logs, Excel, a legacy software tool, or nothing at all. Map the gaps against the six requirements listed above. If the answer to any of them is no, you may already be in breach of the 2019 law.

Step 2: Define your requirements

Before evaluating vendors, clarify what your company specifically needs beyond legal compliance. Consider questions like:

• Do you have remote or hybrid employees who need to clock in from their phone?
• Do you need to export the records for your labor advisor?
• Do you manage shift schedules that the system should support?
• How many locations does your company operate from?
• Do you need vacation and absence management alongside time tracking?

Step 3: Evaluate and select a platform

With your requirements defined, evaluate platforms against both the rules in force and your operational needs. Choosing a system that already meets the standards in the draft saves you a migration if it is approved. Prioritize solutions adapted to Spanish labor law rather than generic international tools that may not cover immutability, time stamping or employee access. If your business already uses multiple disconnected tools (CRM, invoicing, project management), this is also a good moment to consider all-in-one platforms that integrate time tracking natively, reducing both cost and complexity.

Step 4: Negotiate with employee representatives

The law requires that the implementation of a time tracking system be agreed upon with worker representatives (if applicable). Even in companies without a formal works council, it is advisable to communicate the change transparently to the team. Explain the legal context, how the system works, and how their data will be protected.

Step 5: Implement and test

Roll out the system in phases. Start with a pilot group, iron out issues, and then extend to the full team. Typical implementation timelines for cloud solutions range from 1 to 4 weeks for small companies. Check that the system captures every required data point, generates unalterable records, and is reachable remotely. Run it in parallel with your old process for at least two weeks to catch discrepancies.

Step 6: Train your team

A system only works if employees actually use it. Train every team member on how to clock in, log breaks, and report overtime. Assign a compliance owner, usually an HR lead or office manager, who monitors adoption and resolves issues. Companies that skip this step end up with incomplete records, which the Inspectorate can treat as a minor offense under the LISOS.

How UTILIA OS helps you stay compliant

UTILIA OS includes digital time tracking as a native module within its all-in-one business management platform. It is not an add-on or a third-party integration. Time tracking is built into the same environment where teams already manage their CRM, invoicing, projects, and internal communication.

Here is how it addresses each compliance requirement:

• Immutable digital records with full audit trail for every clock event
• Start, end, breaks, and overtime tracking captured automatically
• Cloud-based with remote access, ready for the remote inspection the draft proposes
• Employee self-service portal where workers view and verify their records
• No biometric data required, avoiding GDPR complexity
• 4-year data retention handled automatically
• Vacation and absence management integrated in the same platform

For SMBs that currently use separate tools for time tracking, CRM, invoicing, and project management, consolidating into a single platform also eliminates redundant subscriptions. Instead of paying for several separate tools, everything runs from one workspace, which reduces both cost and the operational overhead of managing multiple vendor relationships.

The planned opening for UTILIA OS is October 2026. You can join the waitlist and keep the yearly price even paying month to month, forever.