Last updated: 09/08/2026

Norkent for Spain

GDPR + LOPDGDD. AEPD prohibits biometrics for time control; mandatory daily recording since 2019.

ISOES
CurrencyEuro (EUR)
LanguageSpanish and regional co-official languages
Weekly hours40 annual average hours
OvertimeMax. 80 hours per year
Record retentionMinimum 4 years

Working hours and overtime

Maximum weekly hours: 40 hours of effective work on average on an annual basis (art. 34.1 ET).
Maximum daily hours: 9 ordinary daily hours, except for an agreed irregular distribution (art. 34.3 ET). Minimum rest of 12 hours between workdays.
Limit (overtime): Maximum 80 overtime hours per year (art. 35.2 ET). Hours compensated with rest do not count toward this limit.
Overtime premium / compensation: Minimum of 75% over the ordinary-hour value for non-compensated overtime (applicable collective agreement). Hours compensated with rest are paid, in principle, as ordinary hours.

Breaks and leave

Weekly rest: Minimum of a day and a half uninterrupted (Saturday afternoon and full Sunday, as a general rule), accumulable in periods of up to 14 days (art. 37.1 ET).
Vacation: Minimum of 30 calendar days per year of service (art. 38.1 ET), or the proportional part if the service time is less than a year.
Maternity: 16 weeks, distributed in periods before and after birth; 6 weeks must be taken immediately after birth (art. 48.4 ET).
Paternity: 16 weeks, identical to maternity leave, with the same mandatory distribution after birth (art. 48.4 ET).

Personal data protection

Data protection law: Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 (LOPDGDD).
Competent authority: Spanish Data Protection Agency (AEPD).
Geolocation: It must be limited to the moment of clocking and to working hours; continuous use exceeds the purpose of time control and violates the GDPR minimization principle (AEPD guide on time-control systems).
Biometric data: The AEPD expressly prohibits the use of biometrics for time control without specific legal authorization; non-biometric methods (QR, card, manual recording) avoid this restriction.
Workplace monitoring: Control systems must be limited to time-control purposes, not to measuring performance or continuously monitoring the worker; they must respect arts. 87-91 LOPDGDD (right to privacy and to one's own image).

Digital attendance systems

Digital recording allowed: Yes. Since Royal Decree-Law 8/2019, all companies must guarantee daily workday recording (art. 34.9 ET), without a specific format being imposed.
QR recording: Yes, allowed, as long as the GDPR minimization principle is respected.
Mobile device recording: Yes, allowed, with the same general data protection conditions.
Manual recording: Yes, allowed (paper or templates).

Status of Norkent in Spain

Allowed with conditions
Norkent complies with art. 34.9 ET (daily workday recording since 2019) and, by using QR and manual recording, avoids the AEPD's specific restriction on biometrics for time control. Before its implementation in Spain, a company should consider: 1. Collective or company framework: organize the system through collective bargaining, a company agreement or consultation with workers' representatives (AEPD and case-law criteria). 2. Prior information to the worker: expressly inform about the existence, purpose and scope of the system (arts. 87-91 LOPDGDD and art. 13 GDPR). 3. 4-year retention: records must be kept for at least 4 years, available to workers, their representatives and the ITSS. 4. Geolocation: if activated, it must be limited to the moment of clocking and working hours; continuous tracking violates the GDPR minimization principle. 5. Royal Decree on digital time recording: there is a draft Royal Decree (urgency approved on 09/30/2025) that could impose additional interoperability and timestamping requirements. Its progress should be monitored. 6. Data residency: Norkent stores data in the US (Supabase, Oregon); the employer must ensure a valid international transfer mechanism under the GDPR (standard contractual clauses, adequacy decision or other valid instrument).