Time tracking with geolocation: is it legal, and how far can an employer go?

It is one of the questions that comes up most when a company has people working away from the office: can you require staff to clock in with geolocation? The short answer is yes, and there is a law that expressly provides for it. The longer answer is that most implementations we see overshoot, and that is where the trouble starts.

What decides whether your system is lawful is not the technology but when it switches on and what you do with the data. Recording a location at the moment of clocking in and recording where someone moves for eight hours are two different kinds of processing: the first is time tracking, the second is surveillance.

The short answer: yes, and there is an article that says so

Unlike other forms of workplace monitoring, geolocation has its own express provision. Spain's Organic Law 3/2018 on data protection devotes Article 90 to it, within the title on digital rights.

Employers may process data obtained through geolocation systems for the exercise of the monitoring functions over workers or public employees provided for, respectively, in Article 20.3 of the Workers' Statute and in public service legislation, provided that those functions are exercised within their legal framework and with the limits inherent to it.

The authorisation is clear, but note the ending: «with the limits inherent to it». Article 20.3 of the Workers' Statute allows an employer to adopt surveillance and monitoring measures to verify compliance with employment obligations, but while showing «due regard for the dignity» of the person. That is the filter everything else passes through.

The test that decides everything: necessity and proportionality

Spain's data protection authority is consistent on this point: geolocation only stands up if no less intrusive means achieves the same purpose. It is not enough that it is useful, or that the employer prefers it.

The practical consequence makes a lot of companies uncomfortable: if your staff clock in at a fixed terminal on site, adding geolocation is not justified. The terminal already evidences presence; the location adds nothing you do not already know, and it does add an intrusion. Geolocation is justified where the workplace is not fixed, not where it is.

The four questions worth answering in writing before switching it on

• Is it suitable? Does it genuinely evidence working time, or only tell you where people are?
• Is it necessary? Is there another way of evidencing the same thing —a terminal, a network check, a client signature— that intrudes less?
• Is it proportionate? Does the benefit to the company outweigh the sacrifice of the right to privacy?
• Is it the minimum possible? Are you capturing only what is essential, or storing exact coordinates and a history nobody will ever look at?

Documenting those answers is not bureaucracy: it is the evidence that you carried out the proportionality assessment. Where the processing is high risk —by volume, by systematic use or by the kind of workforce— Article 35 of the GDPR also requires a formal impact assessment.

Which legal basis to rely on (and why it is not consent)

This is the most repeated design mistake: asking the employee to accept geolocation when they install the app, and treating the matter as settled. It does not work. In an employment relationship consent is not considered freely given, because the party asking is the party paying the salary, and consent that is not free is not valid.

What supports the processing is compliance with a legal obligation —the working time record under Article 34.9 of the Workers' Statute— combined with the employer's legitimate interest in verifying that the record is truthful. And the authority adds a nuance worth internalising: even where the person consents, that does not rescue processing which is neither necessary nor proportionate when less intrusive techniques exist.

What you must disclose — and since October, in the contract too

Paragraph 2 of Article 90 leaves no room for interpretation about the when or the how.

Beforehand, employers must inform workers or public employees and, where applicable, their representatives, expressly, clearly and unambiguously, about the existence and characteristics of these devices. They must likewise inform them about the possible exercise of the rights of access, rectification, restriction of processing and erasure.

«Beforehand» means before switching the system on, not the day after. And «where applicable, their representatives» means that if there is a works council or staff delegates, the information goes to them as well.

A new obligation has now been added. Since 5 October 2026, Royal Decree 723/2026 includes among the mandatory contract information the existence of automated systems involved in decisions about the location of the post. If your geolocated clock-in feeds decisions of that kind, a privacy policy is no longer enough: it has to appear in the contractual information, handed over before the person starts work.

What the information you hand over must say

• Exactly what is captured: coordinates, a simple inside/outside check against a zone, or an IP address.
• When it activates: only when recording arrival, a break or departure, and never in between.
• For what purpose: to evidence working time, and nothing else.
• How long it is kept: working time records, four years, as Article 34.9 of the Workers' Statute requires.
• Who can see it inside the company, and under which role.
• How to exercise the rights of access, rectification, restriction and erasure, as Article 90.2 requires.
• What alternative exists for anyone who cannot or should not use a personal phone.

Where the line is: what turns clocking in into surveillance

These are the practices that tip a system from legitimate time tracking into unlawful processing. They are not details: they are the difference between complying and not.

What you cannot do

• Keep location on throughout the working day. Clocking in is a moment, not a continuous state.
• Capture position after someone has clocked out. It is the most serious breach and the easiest to detect, and it runs straight into the right to digital disconnection.
• Store a history of exact coordinates that nobody needs in order to evidence a working day.
• Use location for disciplinary purposes without having disclosed that as a purpose.
• Require the use of a personal phone without offering an alternative or compensation.
• Share it with third parties —clients, insurers, routing firms— without a legal basis of its own.

When it is fully justified

Contrary to what is often assumed, geolocation is not suspect in itself: in some settings it is the least intrusive method available, because the alternative is a manual timesheet nobody can verify.

Scenarios that clear the proportionality test comfortably

• Field sales and service engineers who start the day at a client's premises and never pass through the office.
• Delivery and transport, where the workplace is literally the route.
• Construction sites, where the location changes every few weeks.
• Services in people's homes: care, maintenance, cleaning, home assistance.
• Multi-site workforces rotating between locations, where it matters which site the work was performed at.
• Remote work, but with real caution: the location is already in the agreement, so the coordinates rarely add anything. We cover it in our guide to time tracking for remote work.

What is at stake if you get it wrong

The risk arrives down two independent routes, and the same facts can trigger both.

The two routes to a penalty

• Data protection. Breaching the principles of lawfulness, purpose limitation or data minimisation is the GDPR's most serious infringement: Article 83.5 reaches €20 million or 4% of worldwide turnover. Spanish decisions in this area sit far below that ceiling, but processing outside working hours is sanctioned without argument.
• Employment law. If the system is held unlawful, the records it produced lose their evidential value and you are left with no valid working time record: a serious infringement under Article 7.5 of the LISOS, €751 to €7,500 per workplace.
• And the litigation risk, which is not a fine but hurts just as much: evidence obtained through unlawful processing can be ruled inadmissible, and the disciplinary sanction or dismissal it supported falls with it.

You can estimate the employment-law exposure with our penalty calculator, and review the failings inspectors find most often in our article on how NOT to do time tracking.

How to roll it out without overshooting

Implementation checklist

• Decide who it applies to and who it does not. Geolocation normally makes sense for mobile staff and not for people clocking in at a fixed terminal. A single rule for the whole workforce tends to be disproportionate.
• Write down the proportionality assessment using the four questions above, and consider whether you need an impact assessment.
• Configure capture at the moment of the clock-in and check that the app stops requesting location afterwards.
• Inform in writing and get acknowledgement, from staff and their legal representatives, before switching anything on.
• Add it to the contractual information if it feeds decisions about location, as RD 723/2026 has required since October.
• Define access: who can see the location attached to a clock-in and who cannot.
• Offer an alternative to anyone without a company phone.
• Review it annually, because apps change permissions and behaviour with updates.

How Horalia handles it

Horalia's geolocation is built around the rule that matters: it records the location at the moment of clocking in, not before and not after. There is no continuous tracking because nothing follows the position between one clock-in and the next.

What it gives you, and what it deliberately does not do

• Location recorded at clock-in from the mobile app, for staff who travel.
• A clock-in terminal —a tablet at a fixed point where each person identifies themselves with their own code— for sites where geolocation would not be justified. Two scenarios, one tool.
• Corrections approved by the manager, with a trail of who changed what and when, rather than records quietly rewritten.
• Working time reports exportable in the official format, ready to hand to the Labour Inspectorate.
• Retention for the four years Article 34.9 requires.
• Data hosted in the European Union, in line with the GDPR.

And for the paperwork —the geolocation policy, the Article 90.2 notice and the contractual information— there is document management with electronic signature, which lets you evidence that you informed people, who, and when. You can explore Horalia or try it for free.