Back

EU Time Tracking Law: What Every Employer Needs to Know

BLOG Last updated July 05, 2026

Time tracking is no longer optional for employers across the European Union. Following a landmark 2019 ruling by the Court of Justice of the European Union (CJEU), every EU member state is obligated to require employers to record their workers' daily working hours using an objective, reliable, and accessible system. This guide cuts through the legal complexity to explain exactly what the law requires, how each major country has responded, and what you need to do to stay compliant.

The Ruling That Changed Everything: CCOO v Deutsche Bank (2019)

The legal foundation for mandatory EU time tracking is Case C-55/18, decided by the CJEU on 14 May 2019. The case was brought by the Spanish trade union Comisiones Obreras (CCOO) against Deutsche Bank SAE, the Spanish subsidiary of Deutsche Bank, which at the time had no system in place for recording the daily working hours of its employees.

The court ruled unambiguously that EU law, specifically the Working Time Directive (2003/88/EC) read in light of Article 31 of the EU Charter of Fundamental Rights, requires member states to make employers set up a system to objectively and reliably record the daily working time of each worker. The court's reasoning was straightforward: without such a system, it is practically impossible for workers to verify that their rights are being respected or for labour inspectorates to enforce those rights. The burden of proof in any dispute over working hours falls almost entirely on employers, so they have every incentive to have accurate records.

This ruling did not create a new piece of legislation, it interpreted existing EU law. That means it applied immediately to all EU member states, even those whose national laws did not yet explicitly require comprehensive time recording.

The EU Working Time Directive: The Core Requirements

The Working Time Directive (2003/88/EC) is the bedrock of working time law across the EU. While the directive itself does not spell out exactly how time must be recorded, the CJEU's 2019 ruling clarified that effective enforcement of the directive's protections is impossible without it. The directive's key provisions are:

• Maximum 48-hour working week, averaged over a reference period of up to four months (or longer if permitted by collective agreement or national legislation)
• Minimum 11 hours of daily rest, each worker must have at least 11 consecutive hours free from work in any 24-hour period
• Minimum 24 hours of weekly rest, at least one uninterrupted 24-hour break per seven-day period, in addition to the daily rest entitlement
• Rest breaks during shifts, a break is required for any shift exceeding six hours; member states determine the exact length
• At least four weeks of paid annual leave, this cannot be replaced by a payment in lieu, except on termination of employment
• Night work limits, night workers must not exceed an average of eight hours in any 24-hour period, and are entitled to free regular health assessments

In 2023, the European Commission published both an Interpretative Communication and an Implementation Report updating legal guidance on how the directive should be applied, with particular attention to remote and hybrid workers. The core directive text remains 2003/88/EC, but these documents clarify how it applies to newer working arrangements.

What Your Time Tracking System Must Be

The CJEU did not mandate any specific technology, paper timesheets, digital punch clocks, and software apps can all be compliant. However, the system must meet three criteria derived from the 2019 ruling:

• Objective, the records must accurately reflect actual hours worked, not estimates or averages. Approximations are not sufficient.
• Reliable, the system must be tamper-resistant and consistent. Records must not be easy for managers or employers to manipulate retroactively.
• Accessible, workers must have access to their own time data, and competent authorities (labour inspectorates, works councils where applicable) must be able to review the records on request.

At a minimum, records should capture the daily start time, end time, and any break periods for each worker. Many countries require these records to be retained for between three and ten years.

Country-by-Country: How EU Member States Have Responded

While the CJEU ruling applies across the EU, each member state has implemented its obligations in its own way. Enforcement intensity, record retention periods, and penalty structures vary considerably.

Germany

Germany was notably slow to translate the 2019 CJEU ruling into domestic legislation, but the courts stepped in. In September 2022, the German Federal Labour Court (Bundesarbeitsgericht, BAG) ruled in Case 1 ABR 22/21 that employers are directly obligated under EU law to record all working hours, regardless of whether German statute explicitly said so. This ruling bound all German employers immediately.

In April 2023, the Federal Ministry of Labour and Social Affairs published a draft amendment to the Arbeitszeitgesetz (Working Hours Act) that would have made electronic time recording the default. That draft stalled in the Bundestag due to political disagreements and the collapse of the Ampel coalition in late 2024. As of 2026, Germany still relies on the BAG ruling and the existing Arbeitszeitgesetz provisions rather than comprehensive new legislation. Fines for violations can reach €30,000 under the current act.

Spain

Spain is the most advanced EU country on time tracking, and coincidentally the source of the landmark CJEU case. Real Decreto-ley 8/2019, which came into force on 12 April 2019 (just weeks before the CJEU ruling), requires all companies to keep a daily record of hours worked by every employee, regardless of contract type or seniority. The records must include the specific start and end times of each working day. They must be retained for four years and must be accessible to workers, their legal representatives, and the Labour Inspectorate on request. Fines for non-compliance range from €626 to €6,250 per infraction under the Ley sobre Infracciones y Sanciones en el Orden Social (LISOS), with aggravated cases reaching significantly higher penalties.

Greece

Greece has implemented one of the most technically demanding time tracking systems in Europe. Νόμος 5053/2023 mandated that employers must submit digital time records in real time to the government's ERGANI II platform, an official government database managed by the Ministry of Labour. This obligation came into full effect on 1 July 2024. Employers must log the start and end of each working day, any overtime, and schedule changes, all before the shift begins (not after). Failure to comply carries fines of €10,500 to €42,000 per inspection, making Greek enforcement among the strictest in the EU.

France

France has long required working time recording under its Code du travail. The specific obligations differ by contract type: employees on fixed-hour contracts must have their daily hours recorded individually, while workers on forfait jours (annual day-rate agreements) must have their working days counted rather than their hours. Collective agreements play a large role in defining the exact method used. Fines for non-compliance are administrative in nature, typically up to €1,500 per employee, though criminal sanctions are possible for systematic or repeat violations.

Netherlands

The Arbeidstijdenwet (Working Hours Act) requires employers to record working hours and retain those records for at least five years. The Netherlands Labour Authority (Nederlandse Arbeidsinspectie) conducts inspections and can impose fines of up to €10,000 per violation per employee. Dutch enforcement has become increasingly strict in recent years, particularly in sectors prone to irregular hours such as logistics, hospitality, and cleaning.

Belgium

Belgian employers must record the start and end times for every employee's working day under the Loi sur le travail du 16 mars 1971. The Social Criminal Code governs penalties. Specific sectors have additional requirements; the construction industry, for instance, has operated mandatory electronic attendance registration since 2014 through the CHECKINATWORK system. Belgium distinguishes between administrative and criminal penalties, with the latter applicable for serious or repeated violations.

Portugal

Article 202 of the Código do Trabalho requires employers to maintain a register of working hours. Records must be kept for five years and must be available to workers, their representatives, and the labour inspectorate (ACT). Portugal has progressively moved toward digital record-keeping, encouraged by the government's own digital labour market platforms.

Italy

Decreto Legislativo 8 aprile 2003, n. 66, which transposes the Working Time Directive into Italian law, requires employers to record hours worked, particularly overtime. Records must be kept for five years. Administrative fines can reach €5,000 per worker for serious violations, and repeated non-compliance can trigger criminal liability.

Ireland

The Organisation of Working Time Act 1997, as updated by subsequent statutory instruments including SI 76/2021, requires Irish employers to keep records of daily and weekly working time. Records must be retained for three years. The Workplace Relations Commission can impose fines of up to €2,500 for non-compliance, and workers may also be awarded compensation equivalent to up to two years' remuneration for breaches of working time rights.

Poland

The Kodeks pracy (Article 149) has long required comprehensive working time documentation, including work schedules, actual hours worked, overtime, night work, and work on Sundays and public holidays. Records must be retained for ten years as part of employee documentation. Poland has one of the longest retention periods in the EU.

Sweden

Sweden's Arbetstidslag (1982:673) and Work Environment Act both require working time records. Collective agreements, which cover the vast majority of Swedish workers, typically define the specific recording method. Labour unions play a strong oversight role. Non-compliance is handled through the Swedish Work Environment Authority and can result in penalty orders.

Who Is Exempt?

The Working Time Directive allows certain categories of worker to be excluded from its scope. Article 17(1) provides that where the duration of working time cannot be measured or determined in advance, or where workers can determine it themselves, member states may derogate from the main provisions. The most common exemptions apply to:

• Managing executives and senior decision-makers, people whose total working time is not measured or predetermined, and who genuinely determine their own hours
• Family workers
• Workers officiating at religious ceremonies

These exemptions are narrower than many employers assume. A job title alone does not confer exempt status. A "manager" who works fixed shifts and reports to a supervisor is not exempt simply because of their seniority. Courts across the EU have consistently ruled that exemptions should be interpreted strictly. Autonomous professionals, directors with genuine control over their schedules, and certain family business members are the clearest candidates.

Separate rules apply to mobile workers in road transport, seafarers, inland waterway workers, and air transport workers, these sectors are governed by their own directives rather than 2003/88/EC.

The 48-Hour Opt-Out

Article 22 of the Working Time Directive permits member states to allow individual workers to opt out of the 48-hour weekly maximum, provided the opt-out is voluntary, given in writing, and the worker cannot be penalised for refusing. Countries that permit this opt-out include Ireland, Cyprus, and Malta, among others. Germany and France do not allow the opt-out for most workers.

Crucially, the opt-out does not remove the obligation to track time. An opted-out worker's hours must still be recorded, otherwise an employer cannot demonstrate that the opt-out is valid (genuine consent) or that the opt-out agreement's terms are being met.

GDPR and Data Protection

Working time records contain personal data and are therefore subject to the General Data Protection Regulation (GDPR). Employers processing time records must:

• Identify a lawful basis, compliance with a legal obligation (Article 6(1)(c) GDPR) is the most appropriate basis in most cases, since time recording is mandated by national law
• Apply data minimisation, only collect data that is necessary for the purpose; avoid attaching granular location tracking to routine office-based time records unless operationally required
• Respect retention limits, retain records only as long as required by law, then delete them securely
• Honour employee rights, workers have the right to access their time records, request corrections for inaccurate entries, and receive information about how their data is used
• Take extra care with biometrics, fingerprint and facial recognition-based systems process special category data under Article 9 GDPR and require explicit consent or another Article 9(2) condition; several EU countries have additional national restrictions on biometric time tracking

GDPR violations carry their own separate penalty regime, with fines of up to €20 million or 4% of global annual turnover, whichever is higher. A non-compliant time tracking system could therefore attract two sets of fines simultaneously: one from the labour inspectorate and one from the data protection authority.

Consequences of Non-Compliance

The consequences of failing to implement proper time tracking are multi-layered. Administrative fines from labour inspectorates are the most immediate risk. Beyond fines, employers who cannot produce working time records face a stark evidential disadvantage in any dispute over overtime pay, rest period entitlements, or wrongful dismissal claims. In many EU countries, if an employer has no records, courts will tend to accept the worker's version of events.

In several member states, including France, Spain, and Greece, repeated or egregious violations can attract criminal liability, not just administrative sanctions. Company directors and HR managers can be personally liable in some jurisdictions. Reputational consequences are also significant, particularly for large employers and multinational companies subject to public scrutiny.

Practical Steps for Compliance

Getting compliant is straightforward if approached methodically:

1. Audit your current situation, identify which countries your employees work in, check the specific record retention and access requirements for each, and assess what systems you already have in place
2. Choose a compliant system, digital time tracking software is the most reliable approach and simplifies both record storage and worker access. Ensure any system you choose allows export of records in a format acceptable to local labour authorities
3. Record the right data, at minimum, capture start time, end time, and breaks for every working day, for every employee who is not genuinely exempt
4. Grant workers access to their records, this is a legal requirement, not optional. Workers must be able to view and verify their own time data
5. Set retention schedules, configure your system to retain records for the required period in each country (three years in Ireland, four years in Spain, five years in Portugal, the Netherlands and Italy, ten years in Poland)
6. Document your GDPR basis for processing, update your privacy notice and record of processing activities to reflect time tracking data
7. Train managers and HR, ensure those responsible for approving time records understand the legal obligations and do not approve inaccurate or manipulated entries
8. Conduct regular audits, periodic internal checks catch issues before a labour inspectorate does

Remote and Hybrid Workers

One area where EU time tracking law continues to evolve is its application to remote and hybrid workers. The 2023 European Commission Interpretative Communication on the Working Time Directive confirmed that the obligation to track working time applies equally to employees working from home. The method may differ, a physical punch clock is clearly unsuitable, but the legal obligation is the same. Employers of predominantly remote workforces should pay particular attention to ensuring their digital systems capture all hours, including irregular hours worked outside standard shifts, and that they do not rely on self-reported estimates that could later be challenged.