What are my obligations when implementing a time-tracking system?
As soon as a time-tracking system is introduced, you must comply with a well-defined legal framework. This kind of tool must have a clear purpose: tracking working hours—and only that. It cannot be used to monitor employee behavior or performance in a general way.
Another golden rule: respect employees’ privacy. The system must be proportionate to your HR objectives. For example, there’s no need to track the exact minute-by-minute activity of an employee on a fixed-day contract.
Finally, you must inform your teams transparently (we’ll explain how just below) and ensure the security of any collected data.
How should I inform my employees about the time-tracking system?
Before activating any system, you must inform your employees in writing, in a clear and accessible way. This notice must specify:
The purpose of the system (e.g., tracking working hours)
The operating methods (e.g., via an app or a tablet)
The types of data collected (e.g., timestamps, possibly photo or geolocation)
The data retention period (30 days on Combo)
The rights of employees (e.g., access, rectification, objection, etc.)
The CNIL (French data protection authority) recommends allowing a reasonable time between informing employees and deploying the system. This delay allows them to:
Understand how the system works
Ask questions
Exercise their right to object, if applicable
A 15-day notice period is generally considered reasonable, though this may vary depending on the nature of the system or internal agreements.
Am I allowed to take photos of employees during clock-in?
Yes, but with caution.
Taking photos during clock-in can increase system reliability, but it constitutes an indirect biometric data point. According to the CNIL, such a system can only be used if it is proportionate to its purpose and does not infringe on privacy.
Our recommendations:
Avoid making photos mandatory for everyone. Prefer random photo capture or restrict it to specific cases (e.g., suspected fraud).
Clearly explain the purpose of photo capture in your employee notice.
Secure the images and limit how long they are stored.
What rules to the use of geolocation for time-tracking?
Geolocation is strictly regulated by the CNIL. It may only be used if it is absolutely necessary to verify working hours (e.g., for mobile workers or staff working at multiple sites).
Before enabling it, make sure to:
Ensure there is no less intrusive alternative
Exclude employees on a fixed-day (forfait jour) contract
Include in your employee notice the exact purpose of geolocation, the identity of the data controller, legal basis, intended data recipients, right to object, retention period, rights of access and rectification, and the right to lodge a complaint with the CNIL
Inform or consult your employee representative bodies before implementing a geolocation system
Include this information in your company’s internal rules or post it on your intranet in a “Data Protection Policy > Geolocation” section. Otherwise, you must be able to provide this information upon request
Prefer using company-issued phones for this purpose
Prohibit geolocation outside of working hours
Avoid continuous tracking unless absolutely necessary (on Combo, data is deleted after 30 days)
The system must always be proportionate and respectful of individual privacy.
How long can I keep clock-in data?
The CNIL recommends a maximum retention period of 5 years for data related to working hours, in line with French labor law requirements.
Do I need to inform or consult staff representatives?
Yes. If your company has a CSE (Social and Economic Committee), you are legally required to consult it before implementing any system that monitors employee activity.
This includes:
A clear presentation of the system (objectives, operation, data collected, etc.)
A formal consultation with a CSE opinion (even if it is only advisory)
A modification of the internal rules if the system is permanent or intrusive
You must also ensure this information is posted and accessible to all employees.
What are the risks if I fail to meet these obligations?
Failing to comply with these rules can lead to serious consequences:
In labor court, clock-in data may be dismissed as evidence if the system was not properly implemented
In the event of a CNIL inspection, you may face financial penalties
Employees may object to the system or file a complaint with the CNIL or the courts for privacy violations
In short: it's better to anticipate and clearly frame your time-tracking system from the start, rather than having to fix things after the fact.