Attendance monitoring and privacy in Italy: what employers may do

Recording attendance is a management duty, but employee data is protected by two sources: the Workers’ Statute (Statuto dei lavoratori) on remote monitoring and the GDPR on personal data. This guide summarises what they ask, when an agreement is needed and what to avoid.

What art. 4 of the Workers’ Statute says

Art. 4 of Law 300/1970, rewritten by art. 23 of Legislative Decree 151/2015, covers three cases:

• Paragraph 1: tools from which remote monitoring of workers’ activity also derives may be used only for organisational and production needs, workplace safety and protection of company assets. They are installed after a collective agreement with the works councils (RSU or RSA) or, failing that, with authorisation from the national labour inspectorate (INL, Ispettorato nazionale del lavoro).
• Paragraph 2: this rule “does not apply to tools used by the worker to perform the work and to tools that record access and attendance” (our translation).
• Paragraph 3: the information collected can be used for all purposes connected with the employment relationship provided the worker is adequately informed about how the tools are used and how checks are made, and in compliance with Legislative Decree 196/2003 (the privacy code, whose art. 114 confirms art. 4).

In practice a tool that only records working time falls under paragraph 2. But the exemption concerns recording attendance: extra functions, such as location, can bring the tool back under paragraph 1.

Opinions, GDPR and the privacy notice

Art. 8 of the Statute forbids the employer from inquiring, directly or through third parties, into political, religious or union opinions and into facts not relevant to assessing professional aptitude; the privacy code (art. 113) confirms it. So no fields or notes to collect data that is not needed to manage hours.

The GDPR (Regulation (EU) 2016/679) adds the principles of art. 5:

• lawfulness, fairness and transparency, with a legal basis for the processing (art. 6);
• data minimisation: data adequate, relevant and limited to what is necessary;
• storage limitation: no longer than necessary for the purpose;
• appropriate security.

The privacy notice (informativa, art. 13) must say who processes the data, why, and for how long it is kept, or by what criteria the period is set. Art. 88 lets Member States set more specific rules on employee data: in Italy the Statute and the privacy code, among others, deal with it.

Biometrics: the Garante says no

Fingerprints and facial recognition are biometric data, a special category (art. 9 GDPR). According to the Italian data protection authority (Garante privacy):

• in its decision of 26 February 2026 (no. 122), fining a cooperative 15,000 euro over six employees’ fingerprints, it wrote that current law “does not allow the processing of employees’ biometric data” to record attendance, and that the same aims can be met with less invasive tools (our translation). It banned the processing and ordered the data deleted;
• in its newsletter of 25 June 2025 it recalled that employee consent is generally not a valid basis in the workplace;
• in 2024 it fined five companies for biometric attendance recognition at a waste-disposal site (from 2,000 to 70,000 euro), pointing to badges as the alternative.

Geolocation of badges and apps

INL circular 2/2016 treats GPS as an added tool, not used “primarily and essentially” to do the work, so an agreement or authorisation is needed (paragraph 1). In its decision of 9 January 2020 on the workforce-management system of a large operator, the Garante held continuous monitoring of employees’ position non-compliant and asked for an icon showing when location is active. If you want to locate people who clock in, start with an agreement, a notice and an assessment by your DPO.

Checklist for the employer

1. Privacy notice given before use, with purposes, retention periods, rights and instructions on how the tool is used (art. 4, paragraph 3).
2. Legal basis identified with the DPO or consultant, without relying on consent.
3. Minimisation: only the data needed (start, end, break, absences).
4. No biometric data for attendance.
5. Location only with an agreement or authorisation and a prior assessment.
6. Role-based access: everyone sees only what they need.
7. Defined retention: the LUL has its own periods; for other data, choose and document a period.
8. Access requests: employees can ask for a copy of their data (art. 15 GDPR), with a reply within one month.

Questions for the vendor: what data it collects, who can access it, where it is stored, for how long, how it is deleted and exported, and how it sets out its role towards you in writing, since you are the controller.

Mistakes to avoid

1. Assuming that clocking in is enough and skipping the privacy notice.
2. Switching on location or other monitoring features without an agreement.
3. Asking for consent for biometric data: it does not make it lawful.
4. Giving everyone access to everything, colleagues’ data included.
5. Keeping everything forever, with no retention period.

How Chrono Desk does it

Chrono Desk records hours in the timesheet: start, end and break or just the total, with a note per shift.

• Four roles, each with its own permissions: employees see their own data, managers their team’s, administrators and the payroll consultant the company’s; payslips are visible only to the employee, administrators and the consultant;
• sign-in with RoxPay SSO, no passwords;
• period reports that export to CSV.

The privacy notice, legal basis and retention periods remain the company’s choices. To see it in practice, talk to us. If part of the team works remotely, also read our guide to remote work and attendance.

---

This guide is for information only and does not replace advice from your payroll consultant, your DPO or the rules of your collective agreement.