Compliance

What the law requires, and how we do it.

FicharPyme implements Spanish employment law: article 34.9 of the Estatuto de los Trabajadores, Spain's Workers' Statute. It is not designed to meet the working-time record-keeping rules of any other country.

Keeping a working-time record is an obligation of your company: it is the company that must record the hours, keep them for four years, and make them available to its staff, to their legal representatives and to the Labour Inspectorate. FicharPyme cannot take that obligation off your hands, and be wary of anyone who tells you otherwise.

What we can do is make it easy and explain, requirement by requirement and in full detail, how we do it. That is what follows. Every citation on this page has been checked against the consolidated text in the BOE, the Spanish official gazette.

Estatuto de los Trabajadores

What it requires of you, and what we bring.

On the left, what the law says. On the right, what the application does. Nothing else.

A daily record, with the specific start and end times for each person.: Clock in, clock out and breaks. The time comes from the server, never from the device, and is stored in UTC with the local date kept separately.
Keep the records for four years.: A four-year retention period that cannot be configured downwards, with automatic deletion on expiry and warnings six months, three months and one month ahead.
Available to the workers, to their legal representatives and to the Inspectorate.: Three separate routes, and none of them does another's job: each person's own portal, access for the employee representatives, and a temporary read-only credential for the Inspectorate.
How the record is organised must be documented by collective agreement, company agreement, or the employer's decision after consulting the employee representatives.: A document generated from your company's actual settings, and versioned every time those settings change. Nobody writes it by hand, so it never goes stale.
An annual working calendar, displayed somewhere visible at every workplace.: A calendar per year and per workplace, with national holidays and each site's own holidays kept apart. It can be printed for display.
Part-time work: a day-by-day record, monthly totals, and a copy handed over with the payslip. Failing to do so creates a presumption of full-time work.: A monthly summary issued on the 1st, versioned if a late correction changes the month, and the download evidences that it was handed over.
Hours are recorded day by day and totalled for the pay period, with a copy of the summary handed over.: Hours above the scheduled working day are totalled and appear in each person's monthly summary.
Twelve hours between the end of one working day and the start of the next. And nine ordinary hours a day, unless a collective or company agreement sets a different distribution.: The fact is shown with its article beside it, never as a breach. The nine hours may have been agreed differently, and what looks like an excess may be an uncorrected clocking.
A day and a half of uninterrupted weekly rest, which may be accumulated over periods of up to fourteen days.: The calendar marks the weekend, with Sunday more prominent than Saturday, but without treating it as a non-working day: plenty of small businesses work weekends.
Paid annual leave, not replaceable by payment in lieu and never less than thirty calendar days. The schedule must be known two months in advance.: Balances per person and per year, with configurable carry-over and a pool of days owed that never expires.

Case law

What the courts have said.

The recording system must be objective, reliable and accessible.: Objective: the time comes from the server. Reliable: the record cannot be altered. And genuinely accessible: each person sees their hours for the month the moment they sign in, without hunting for them.
A record cannot be filled in with the contracted schedule.: A day with no clock-out is left incomplete, at zero minutes, waiting for an explicit correction. The application never invents a single minute.
Access is bounded by the principle of relevance: what is connected to their monitoring duties.: Representatives see working days and totals for their remit, and do not see the ID number, the email address or the reason for a correction. It is enforced by removing data, not by asking for discretion.

GDPR

A working-time record is a file of personal data.

With your staff's hours inside it. So these are the obligations that reach you as well, and what we do about each one.

Storage limitation.: Automatic purge once the four years are up, with a seal over what is deleted: how many records there were, what hash they closed with, and whether they verified.
Health data is a special category.: The type of a medical absence is not shown to whoever runs the shift: they see that the person is away and that it is covered, and they are told in words that the reason is withheld. Certificates are encrypted on disk.
Access and portability.: A complete download of your own data, in machine-readable format and as a spreadsheet, with the hash of each clocking so it can be checked later.
Rectification.: Each person sees what data is held about them —a precondition for being able to ask for it to be corrected— and can request that a clocking be fixed.
Erasure.: Certificates really are deleted. The working-time record is not, because there is a legal duty to keep it for four years, and that gets explained rather than hidden.
Data protection by design.: Each company has its own database, not a column telling it apart inside a table shared with everyone else.
Processor.: A processing agreement signed before the company can be used at all. It is not an afterthought: without it the company is provisioned but never activated.
Security of processing.: Passwords with Argon2id, a mandatory second factor for whoever manages the company, progressive lockout on sign-in attempts, and encryption on disk for anything sensitive.

The four years, and what happens at the end

Retention cannot be set below four years, and when it expires the deletion is automatic. What is not automatic is finding out: that is why there are three warnings beforehand.

Month 0
The entry is recorded
Warning · −6
Six months before
Warning · −3
Three months before
Warning · −1
One month before
Month 48
Deleted, and sealed

The seal records how many entries were deleted, what hash they closed with and whether they verified. The data goes; the proof that it was there does not.

And biometrics, never.

No fingerprints, no face recognition. The AEPD, Spain's data protection authority, takes the view that they have no legal basis for time control in Spain, and it has issued fines over it. This is not a feature we haven't got round to: it is a closed decision about the product.

The integrity chain

It isn't that forging it is hard. It's that it can't be done without showing where.

A working-time record is only worth anything if nobody can touch it up afterwards. If the file can be edited, it proves nothing — neither for the company nor for the people who work there—.

First: a clocking cannot be modified or deleted. And that is not a promise made by the software: the database itself prevents it. It prevents the application from doing it, and it prevents whoever administers the server from doing it too.

Second: every clocking is chained to the one before. Each one is given something like a fingerprint — a number that depends on everything that clocking says and on the fingerprint of the previous clocking—.

As in a chain, changing one link forces every link after it to be redone.

How it chains together

07:58clock ind41a9c
the hash below is calculated with this one inside it
13:30break8f27b3
the hash below is calculated with this one inside it
14:12back1c05ea
the hash below is calculated with this one inside it
18:04clock outb7e3f1

And how it breaks

07:58clock inmatches
13:45alteredno match
14:12backno match
18:04clock outno match

If someone did manage to alter a clocking from six months ago, the chain would stop matching at exactly that point, and the application flags it.

And it can be checked from outside.

Every report carries the hash for the period printed on it along with the formula used to calculate it. A hash whose derivation is never published cannot be checked by anyone; this one can. On top of that, each person takes the hash of their own clockings with them when they download their data, so a year later they can check that the company's record still says the same thing.

Beyond the law

The law doesn't require this. We do it anyway.

The report is issued even if the check fails: Flagged on every page, mind you. Refusing to issue it would leave you unable to show your record because of a fault that might be ours — and the penalty would land on you—.
You get six months' warning before anything is deleted: Ahead of the first automatic deletion at four years, with plenty of time to make your own copy of whatever you want to keep.
Marks not made by the person themselves are distinguishable: By colour and by a label in words, so it never depends on seeing it clearly.
A corrected clocking does not replace the original: Both remain, with who corrected it, when and why. That is what makes fixing an oversight something that doesn't weaken the record.

Penalties

The correct figure, which is not the one going around.

Not keeping the record is a serious infringement under article 7.5 of the LISOS, Spain's employment-offences and sanctions law. The amount is set by article 40.1.b), and it goes by bands:

Band	Fine
Lower	€751 – €1,500
Middle	€1,501 – €3,750
Upper	€3,751 – €7,500

And we say it here for a reason: we don't want you to buy this out of fear. The record is useful — to your company and to your staff—, and that is the argument.

For your adviser

All of this, in a PDF you can forward.

With its issue date visible, and generated from this same text — not written separately, so the two can never drift apart—. If your accountancy practice wants to read it closely before you decide, here it is.

Download as PDF

Generated from this same page, so the two always say the same thing.

Document issued on August 15, 2026