Fichar con el móvil personal: guía legal para pymes en España

The real question behind mobile clock-inWhen a small business in Lleida or Tarragona starts looking for a control horario solution, the first idea tha...

The real question behind mobile clock-in

When a small business in Lleida or Tarragona starts looking for a control horario solution, the first idea that often comes up is deceptively simple: why not let staff clock in from their own phones? No extra hardware, no terminals to install, no maintenance. It sounds efficient. But the moment you scratch the surface, a second question appears, and it is the one that actually matters: who is responsible for providing the tools to comply with the law?

In Spain, the obligation to keep a daily working time record falls on the employer. That is not a detail. It means the company cannot quietly transfer the burden of compliance onto employees' personal devices, contracts or data plans. The worker must clock in, yes, but the employer must supply a suitable, reliable and lawful way to do it.

What Spanish law actually requires

The legal framework is a combination of several rules that overlap: the Estatuto de los Trabajadores, the data protection regulation (GDPR and the Spanish LOPDGDD), and, for remote work, Ley 10/2021. Together they set clear boundaries.

Daily register: the company must record the specific start and end time of each person's working day, regardless of flexible schedules or shift patterns.
Employer responsibility: designing the system, ensuring it works, storing the data for the legally required period and being able to prove its reliability all sit with the company.
Remote work: Ley 10/2021 states that the employer must provide the means, equipment and tools needed. It cannot force staff to install apps on their own devices or use personal phones for work.

Nothing in the law bans clocking in from a mobile phone. What it bans is shifting the cost and the risk onto the employee without consent, transparency or alternatives.

Consent is not a tick-box exercise

Many companies assume that because an employee downloaded an app, consent is granted. In an employment relationship, that reasoning is fragile. There is a clear power imbalance between employer and worker, so consent must be voluntary, explicit and informed. A generic clause buried in a contract will not hold up under scrutiny.

Before rolling out any software de fichaje on personal phones, the company should be able to answer, in plain language:

What personal data is collected and why?
How long is it kept, and who can access it?
Is a third-party provider involved, and under what terms?
What rights can the employee exercise, and how?
What happens if someone refuses to use their own device?

If those answers are vague, the system is not ready. And if the app requests access to contacts, photos or personal files, it is collecting far more than a registro de jornada ever needs.

Geolocation: useful, but only with justification

Location tracking is one of the most sensitive features in any time-tracking tool. It can be legitimate for field teams, delivery staff or workers moving between sites in Barcelona or Girona. But it must be proportionate and justified.

The practical rule is simple: capture location only at the exact moment of clock-in or clock-out, never continuously. Anything beyond that starts to look like surveillance rather than time recording, and it will be difficult to defend before the Agencia Española de Protección de Datos or an Inspección de Trabajo.

A better approach: give employees a choice

The most robust systems do not depend on a single method. They let people clock in from a shared tablet at reception, a web browser on a company computer, or a mobile app, and they keep a consistent, auditable record regardless of the channel. This flexibility solves two problems at once: it respects employees who prefer not to use their personal phone, and it gives the company a clean, exportable trail that stands up to inspection.

That is precisely the balance a good control horario platform should deliver: entry and exit logs, shifts, absences and incidents, all organised, all exportable, all ready for the labour authority. No friction for the team, no legal blind spots for the business.

Practical checklist before you launch

Define the purpose of the register and document it.
Offer at least one alternative to the personal mobile.
Request only the permissions strictly necessary.
Inform staff clearly about data processing and retention.
Limit geolocation to the moment of clock-in.
Keep records accessible, secure and exportable.

For pymes across Catalonia, the message is straightforward: the law does not stop you from using mobile clock-in, but it does require you to do it properly. Choose a system that protects the worker, protects the company and makes compliance a routine task rather than a legal risk.

Put these ideas into practice

Talk to ALMC about a solution for your business. Explore your options or contact our team.

Results without leaving the page.