GDPR and Time Tracking

What GDPR asks of an employer recording time

Time records are personal data, so the General Data Protection Regulation (GDPR) applies to them in the EU and EEA, and the UK GDPR in the United Kingdom. For time tracking, three duties matter most:

• Let workers access their records. Workers have a legal right to see and check their own time data, and to get a copy within one month of asking.
• Keep records only as long as required. Labour law says how long time records must be kept. GDPR says not to keep them much longer than that, then delete them securely.
• Tell workers what you record. Workers must know what is collected, why, who sees it and for how long.

Even where GDPR doesn't apply, these are good practice, and New Zealand's Privacy Act 2020 and Australia's Privacy Act have similar principles.

How Timeclock.Kiwi helps

• Workers see their own times in the mobile app, and can email themselves a full copy of everything held about them as an Excel file (once a week).
• Workers can report a time that looks wrong straight from the app. Their manager is notified, and fixing the shift answers the request.
• Admins can export any worker's data from the People page, for people who don't use the app.
• Data retention deletes time records automatically once they're older than your country requires. Pick your country and we suggest the period.
• A GDPR checklist in Settings shows what's done and what's left.
• Hosted in New Zealand, which the European Commission recognises as giving adequate protection, so EU data can be stored here without extra transfer paperwork.
• A Data Processing Agreement covering what we do with your data. Read it here.

How long to keep time records

How long each country says working time records must be kept, and where we couldn't confirm a set period, the period we suggest instead (marked Suggested). When you turn on data retention, we fill in the period for your country.

Country	Keep records for	Law	Notes
Australia	7 years	Fair Work Regulations 2009, regulation 3.31	GDPR doesn't apply here.
Austria	7 years Suggested	Bundesabgabenordnung § 132 (payroll and tax records)	The Working Hours Act (AZG) doesn't set a clear period for time records. Payroll records must be kept 7 years for tax, and wage claims can be made for 3 years.
Belgium	5 years	Royal Decree of 8 August 1980 on social documents
Bulgaria	3 years Suggested	Labour Code art. 358 (wage claims can be made for 3 years)	Payroll records themselves must be kept much longer (50 years) under the Accountancy Act, but those are your payroll, not your time records.
Canada	3 years	Canada Labour Standards Regulations (36 months) and provincial employment standards	Provinces set their own rules, most often 3 years (Ontario, Alberta, BC count from when the work was done or employment ended). Payroll records must be kept 6 years for the CRA.GDPR doesn't apply here.
Croatia	6 years	Pravilnik o sadržaju i načinu vođenja evidencije o radnicima (NN 55/2024)	Counted from the end of the calendar year the record is for.
Cyprus	2 years Suggested	Organisation of Working Time Laws 2002 to 2007 (labour inspection period)
Czechia	10 years Suggested	Pension Insurance Act 582/1991 § 35a (records needed for pensions)	The Labour Code (§ 96) doesn't set a period for time records. Advice ranges from 3 years (claims) to 10 or 30 years where the records support pension contributions.
Denmark	5 years	Working Hours Act (Arbejdstidsloven), registration rules from 1 July 2024	Counted from the end of the period used to work out the employee's average weekly hours.
Estonia	7 years Suggested	Accounting Act § 12 (source documents)
Finland	2 years Suggested	Working Hours Act 872/2019 § 32	Records are commonly kept 2 years from the end of the calendar year. Payroll bookkeeping must be kept 6 years.
France	1 year	Code du travail, article D3171-16	Wage claims can be made for 3 years (L3245-1) and payslips must be kept 5 years (L3243-4), so many employers keep time records for 3 years.
Germany	2 years	Arbeitszeitgesetz § 16(2) and Mindestlohngesetz § 17	Payroll accounts (Lohnkonto) must be kept 6 years under EStG § 41.
Ghana	3 years Suggested	Labour Act 2003 (Act 651), section 101	GDPR doesn't apply here.
Greece	5 years Suggested	Civil Code art. 250 (wage claims can be made for 5 years)	Times are also reported to the ERGANI II digital work card system.
Hong Kong SAR China	1 year	Employment Ordinance, section 49A	Records must cover each employee's last 12 months, and are kept for a while after they leave (sources differ between 6 and 12 months).GDPR doesn't apply here.
Hungary	3 years Suggested	Labour Code (Mt.) § 286 (wage claims can be made for 3 years)	Accounting records, including payroll, must be kept 8 years.
India	5 years Suggested	Code on Wages (Central) Rules 2026, rule 51(4)	Applies where the central government is the appropriate government. Most private employers fall under their state's rules, which can differ.GDPR doesn't apply here.
Ireland	3 years	Organisation of Working Time Act 1997 (records regulations, S.I. 473/2001)
Italy	5 years	Libro Unico del Lavoro (Decreto Legislativo 66/2003)
Kenya	5 years Suggested	Employment Act 2007, section 74	GDPR doesn't apply here.
Latvia	5 years Suggested	Accounting Act (Grāmatvedības likums), source documents	The Labour Law (art. 137) requires time records but doesn't set how long to keep them.
Lithuania	10 years Suggested	Document retention index, accounting documents	Payroll accounting documents must be kept 50 years.
Luxembourg	5 years	Code du travail, article L.211-29
Malta	2 years	Organisation of Working Time Regulations (S.L. 452.87), regulation 20(3)
Netherlands	1 year	Arbeidstijdenbesluit article 3.2:1 (52 weeks)	Payroll records must be kept 7 years for tax (Algemene wet inzake rijksbelastingen, article 52). Transport has its own rule (104 weeks).
New Zealand	6 years	Employment Relations Act 2000 s130 and Holidays Act 2003 s81	GDPR doesn't apply here.
Nigeria	3 years	Labour Act section 75 and National Minimum Wage Act section 5	GDPR doesn't apply here.
Philippines	3 years	Omnibus Rules Implementing the Labor Code, Book III Rule X	Counted from the last entry or from when employment ended.GDPR doesn't apply here.
Poland	10 years	Kodeks pracy art. 94 (employee records)	Counted from the end of the year the employment ended, so keep current staff records for longer.
Portugal	5 years	Código do Trabalho, article 202
Romania	3 years Suggested	Codul muncii art. 268 (wage claims can be made for 3 years)	The Labour Code (art. 119) requires daily start and end times but doesn't set how long to keep them.
Singapore	2 years	Employment Act section 95 and Employment (Employee Records) Regulations	For people who leave, their last 2 years of records are kept for 1 more year.GDPR doesn't apply here.
Slovakia	10 years Suggested	Social Insurance Act (wage records, 10 years)	The Labour Code (§ 99) requires time records but doesn't set how long to keep them.
Slovenia	20 years Suggested	ZEPDSV (Act on Records in Labour and Social Security)	The time use record is treated as a document of permanent value, so deleting it may not be allowed at all. Check with your adviser before turning deletion on.
South Africa	3 years	Basic Conditions of Employment Act, section 31(2)	Counted from the last entry in the record.GDPR doesn't apply here.
Spain	4 years	Real Decreto-ley 8/2019
Sweden	2 years	Arbetstidslagen (Working Hours Act) § 11	Kept for the current year and the 2 years after. Bookkeeping, including payroll, must be kept 7 years.
United Kingdom	6 years	National Minimum Wage Regulations 2015, regulation 59	The Working Time Regulations alone need 2 years, but minimum wage records, which include hours worked, need 6.
United States	3 years	Fair Labor Standards Act, 29 CFR 516.5 and 516.6	Payroll records with hours worked need 3 years, time cards 2. Some states require longer, so check your state.GDPR doesn't apply here.

Not listed? Ask your accountant or employment adviser, and set the period by hand. Tax and payroll rules sometimes need longer than working time rules. Last reviewed 31 October 2026. This is general information, not legal advice.

Worker privacy notice template

Copy this into your employment agreement or staff handbook, fill in the parts in [brackets] and delete what you don't use.

Copy the template

Who is responsible for what

You (the employer) are the data controller: you decide what is recorded and why, and workers come to you with requests. Timeclock.Kiwi is the data processor: we store and process the data only to provide the service to you. See our Data Processing Agreement and Privacy Policy.