GPS time tracking for field and remote employees in Spain: what employers can do, what they cannot, and how to clock in with no signal

Is it legal to geolocate employees when they clock in?

Yes, subject to three conditions that are not optional. The first is set by statute: article 90 of Organic Law 3/2018 (LOPDGDD) lets employers process geolocation data to exercise the monitoring powers of article 20.3 of the Workers' Statute, «provided those powers are exercised within their legal framework and its inherent limits». It requires prior information to employees and, where applicable, their representatives «in express, clear and unambiguous terms» about the existence and features of the device, and about their rights of access, rectification, restriction and erasure.

The second comes from the AEPD's guide on data protection in labour relations: the legal basis «is not consent, but the employment contract and the monitoring powers» granted to the employer, and any technological monitoring measure has to pass a three-step proportionality test — it must serve the purpose (suitability), there must be no less intrusive measure of equal effectiveness (necessity), and it must bring more benefit than harm (balancing).

The third is the one most often forgotten and the one that opens most cases. The same guide, on the daily time record, states that its data cannot be used for purposes other than checking working time, «such as checking location», and gives precisely this article's example: «a mobile worker whose time record is kept by geolocation. The purpose of the time record is to check when the worker starts and finishes working time, not to verify where they are at every moment».

In practice: you may store the coordinates of the instant someone taps «in» and «out». You may not turn the clock-in app into a tracker. And article 20 bis of the Workers' Statute makes privacy in the face of geolocation a worker's right, not an employer's courtesy.

What employers can and cannot do with geolocation

The line runs through purpose, timing and proportion, not technology. This table condenses the AEPD's criteria and the rules cited above; it is the one to have at hand when someone asks to «switch on GPS for everyone».

The case the AEPD itself cites as an example of what does not pass the test is judgment 136/2019 of the Audiencia Nacional, of 6 February 2019: a geolocation system that failed the proportionality test. You do not need an incident to end up there; an «everyone, all day» rollout that nobody justified in writing is enough.

What the time-record rules require today (and what has not changed)

The obligation in force is article 34.9 of the Workers' Statute, introduced by Real Decreto-ley 8/2019: the company «shall guarantee a daily record of working time, which must include the specific start and end time of each worker's working day». It is organised through collective bargaining or a company agreement or, failing that, by the employer's decision after consulting the workers' legal representatives. Records are kept for four years and remain available to staff, their representatives and the Labour Inspectorate.

Three points matter directly for mobile clock-in:

• The medium is free; reliability is not. The Labour Inspectorate's Technical Criterion 101/2019 and the Ministry of Labour's guide accept any system that is reliable, truthful and cannot be altered after the fact. Clocking in from a phone complies if the record is sealed and cannot be edited without leaving a trace.
• The obligation is European, not only Spanish. The CJEU, in case C-55/18 (CCOO v Deutsche Bank, 14 May 2019), required Member States to impose an objective, reliable and accessible system measuring each worker's daily working time.
• Remote and field work are not exempt. Article 34.9 does not distinguish where work takes place. Whoever never sets foot in the office clocks in all the same; only the medium changes.

For the general obligations before getting into geolocation, see new time tracking rules in Spain and what a time tracking system should offer.

Mandatory digital time record in 2026: what is approved and what is not

As of 15 September 2026, no rule published in Spain's Official Gazette (BOE) requires the time record to be digital. It is worth saying plainly, because much of what circulates takes it for granted. This is the real status of the two reforms that usually get mixed up:

What to do in the meantime? Exactly what you would do if it were already approved, because what the draft demands — a reliable, tamper-proof, exportable and accessible record — is what the Inspectorate already expects under the current rules. Whoever clocks in on paper or in a spreadsheet has the problem now, not when the decree is published. Whoever uses a sealed digital system will not have to redo anything.

Fines: what not keeping the record costs (and what overdoing GPS costs)

There are two separate enforcement tracks and they should not be confused. The labour track punishes not recording; the data protection track punishes recording too much.

Labour track. Article 7.5 of the LISOS classes as a serious infringement «the breach of legal or agreed rules and limits on working time, [...] the time record and, in general, working time». Article 40.1.b) sets the amounts:

Data protection track. A geolocation rollout with no prior information, no proportionality or continuous tracking is not fined by the Inspectorate but by the AEPD under the GDPR, whose amounts are computed on different parameters and can be far higher. What is judged here is not whether you clock in, but what else you are capturing and why.

That is why a well-built system does both at once: it records working time immutably for the first track, and captures location only at the instant of clock-in, with prior information and per role, for the second.

Home-visit technicians, sales reps, construction and remote work: what is proportionate in each case

Proportionality is assessed role by role, not company by company. What is reasonable for an installer is not reasonable for someone working from home. Four common scenarios:

The practical rule behind the table: if the person has a fixed workplace, location is redundant. If the day starts somewhere different every morning, location at clock-in is suitable, necessary and proportionate, and what you must watch is that it does not become anything more.

Clocking in from a phone with no signal: how offline mode works

It can be done, and it is the condition for mobile clock-in to be real rather than a snapshot of the places with good coverage. Basements, industrial units, garages, rural areas, below-grade construction: if the app needs a connection, people clock in «on the way out» and the record stops being reliable at exactly the moment an inspector would look at it.

A properly built offline mode has four parts:

1. Timestamp on the device. The clock-in is recorded with the time the button was tapped, not the time it reaches the server. If geolocation is enabled for that role, the coordinates come from the phone's GPS signal, which needs no data connection.
2. Encrypted local queue. Pending clock-ins are stored on the phone until the connection returns and cannot be edited from the app.
3. Flagged synchronisation. When the network returns, the clock-ins are uploaded and flagged as recorded offline, with the original time and the sync time. The history then explains why an 8:02 clock-in entered the system at 11:40.
4. Same immutable record. Once synced, an offline clock-in is just another clock-in: sealed, exportable and with its chain of corrections if there were any.

What to check before buying: that offline mode is standard rather than an add-on, that it works on iOS and Android, and that the inspection report shows offline clock-ins exactly like the rest.

Clock-in with a photo or biometrics: what the AEPD says

With facial recognition or fingerprints, the short answer is «almost never». The AEPD's guide on attendance control using biometric systems (November 2023) treats biometric processing, whether for identification or authentication, as high-risk processing that requires a data protection impact assessment; and it holds that, for time records, employee consent does not lift the ban on processing special categories of data, because the imbalance of the employment relationship invalidates it. Relying on the exception in article 9.2(b) GDPR would require a law that specifically authorises biometrics, and article 34.9 does not.

With a photo things change, but less than it seems. An image that is not technically processed to identify the person is not biometric data under article 4(14) GDPR; it is still personal data, subject to the same proportionality test, and the moment the app automatically compares it against a facial template it becomes biometrics. If the purpose is to evidence who is clocking in, a PIN, a QR code at the site or an NFC card achieve it without touching special categories. And if facial verification is chosen, it should run on-device, with no templates on the server and with a non-biometric alternative for anyone who does not want or should not use it.

The combination that best survives a review is the least flashy: identity by PIN, QR or NFC, location only at clock-in for the roles that justify it, and an immutable record behind it. No photo, no fingerprint.

GDPR rollout checklist

Eleven items, in the order they should be done. The first six are paperwork; the last five are configuration. If the tool cannot deliver the last five, the paperwork saves nothing.

1. Proportionality assessment per role. Document suitability, necessity and balancing for each role that will have location enabled, and why the rest will not.
2. Data protection impact assessment (DPIA). The AEPD labour guide, citing Article 29 Working Party Opinion 2/2017, calls for a DPIA before deploying geolocation when the technology is new to the company. Do it even if the processing looks small.
3. Consultation with workers' representatives. Article 34.9 of the Workers' Statute requires prior consultation to organise the record, and article 90.2 LOPDGDD requires informing representatives of the existence and features of the device. Keep minutes.
4. Prior information to each person. Express, clear and unambiguous: what is captured, when, for what purpose, who has access, how long it is kept and how to exercise access, rectification, restriction and erasure (art. 90.2 LOPDGDD and art. 13 GDPR). Signed as received, not as «consented».
5. Register of processing activities. The time record and geolocation go into the article 30 GDPR register, with the app vendor as processor under an article 28 contract.
6. Written usage policy. One page: when location is recorded, what happens outside working hours, what is done with an offline clock-in and who to ask.
7. Per-role activation, not global. Geolocation is switched on for technicians, sales reps and construction, and stays off for office and remote staff.
8. Capture only at clock-in. No background position and nothing between clock-ins. If the app asks for «always» location permission, that is a warning sign.
9. Minimisation and retention. Only coordinates and time, tied to the clock-in; the AEPD reminds that data «must be erased once no longer necessary». The time record itself, four years; location, for as long as you can justify.
10. Transparency for the employee. They should see in the app when their location was recorded and access their history from the employee portal.
11. Immutable, exportable record. Corrections as new events with author and reason, and an inspection report per person and period in one click.

If your collective agreement has clauses on digital rights (article 91 LOPDGDD allows them), check them first: they may add safeguards the general law does not require.

How Dokuflex solves it: location only at clock-in, offline as standard, report ready

The Dokuflex time tracking module — part of Dokuflex, plataforma BPM low-code con IA — is built for workforces that do not clock in at a fixed site: home-visit technicians, installers, field sales, construction and remote teams. What it brings to the problem in this article:

• Optional, per-role geolocation. Turned on or off for each profile without contacting support: on for people clocking in at a customer's home, off for office and remote staff. It records the clock-in and clock-out point, and the employee always knows when their location is recorded.
• Clock-in with no signal. The mobile app (iOS and Android) clocks in offline and syncs when the connection returns, designed for construction sites, industrial plants and travel.
• Identity without mandatory biometrics. Employees choose how to clock in: app, web, reception tablet, QR or NFC card; facial verification, where used, runs on-device and with an alternative.
• Inspection report in one click. Sealed record, four-year retention, employee self-service portal with signed PDF download and instant export per person and period.
• No manual calculations. Overtime, night work and public holidays according to the configured collective agreement, with export to A3, SAP and other payroll systems.

And the same process covers what comes after clock-in: requests for paid leave, holidays and working-time incidents, approved in a workflow and with their document trail in each person's file.

See how field teams clock in with Dokuflex →

Frequently asked questions

Sources

• Spanish Workers' Statute (Real Decreto Legislativo 2/2015, consolidated text): articles 20.3 (employer monitoring), 20 bis (privacy in the face of geolocation), 34.1 (40-hour maximum week) and 34.9 (daily time record).
• Real Decreto-ley 8/2019 of 8 March: article 10, introducing the daily time record.
• Organic Law 3/2018 (LOPDGDD): article 90, geolocation in the workplace; article 91, digital rights in collective bargaining.
• LISOS (Real Decreto Legislativo 5/2000): article 7.5, serious infringement on time records; article 39, graduation; article 40.1.b), amounts.
• AEPD — Data protection in labour relations (2021, in Spanish): sections on the time record and on geolocation; proportionality test; reference to SAN 136/2019.
• AEPD — Guide on attendance control using biometric systems (November 2023, in Spanish).
• AEPD LAB — Working time records and data protection (17 February 2026, in Spanish): least intrusive system, no consent needed, duty to inform, erasure once no longer necessary.
• Ministry of Labour — Guide on the daily time record (in Spanish), and Labour Inspectorate Technical Criterion 101/2019.
• CJEU, case C-55/18, judgment of 14 May 2019 (CCOO v Deutsche Bank).
• Status of the reform (press, in Spanish): elDiario.es, 24 July 2026 (postponement and Council of State objections) and Forbes España, 9 September 2026 (announcement of «immediate» approval).