Logo de Norkent
Norkent

Last updated: 09/08/2026

Norkent for Italy

GDPR + Garante. Biometrics prohibited for attendance control. Statuto dei Lavoratori limits monitoring.

ISOIT
CurrencyEuro (EUR)
LanguageItalian
Weekly hours40 h (max. 48 h average with overtime)
OvertimeMax. 250 hours per year (per CCNL)
Record retentionMinimum 5 years (LUL)

Working hours and overtime

Maximum weekly hours: 40 weekly hours, with a maximum of 48 hours on average over a reference period (usually 4 months, or 6-12 months by collective agreement) (Legislative Decree 66/2003, arts. 4 et seq.).
Rest between shifts: Minimum of 11 consecutive rest hours every 24 hours (Legislative Decree 66/2003, art. 7).
Weekly rest: Minimum of 24 consecutive rest hours every 7 days, generally accumulated on top of the daily rest (Legislative Decree 66/2003, art. 9).
Limit (overtime): Supplementary hours must respect the limits of the applicable National Collective Labor Contract (CCNL); an annual cap of 250 hours is usually set, with the possibility of individual or company agreements.
Overtime premium / compensation: The surcharge percentages are those provided by the applicable CCNL (there is no single legal surcharge); typically 15% daytime, 30% nighttime, 50% holidays.

Breaks and leave

Vacation: Minimum of 4 weeks per year (2 weeks that must be granted within the year and 2 additional weeks to be taken within the following 18 months), under Legislative Decree 66/2003 and the applicable CCNL.
Maternity: 5 mandatory months (2 before birth + 3 after, configurable), with compensation paid by the INPS under Legislative Decree 151/2001 (Testo Unico sulla maternità).
Paternity: Compulsory paternity leave of 10 days (extendable by law), to be taken within the 5 months after birth; paid by the INPS.

Personal data protection

Data protection law: Regulation (EU) 2016/679 (GDPR) and the Privacy Code (Legislative Decree 196/2003 and subsequent amendments).
Competent authority: Garante per la protezione dei dati personali (Italian Data Protection Authority).
Geolocation: Requires a specific legal basis (generally, the employer's legitimate interest) and, if systematic, requires a Data Protection Impact Assessment (DPIA); the Garante has sanctioned disproportionate uses of GPS for labor control.
Biometric data: The Garante has reiterated that the use of biometrics for time control is disproportionate and requires, where admitted, a non-biometric alternative for the worker (not applicable to Norkent, which does not use biometrics).
Workplace monitoring: Limited by art. 4 of the Statuto dei Lavoratori (Law 300/1970): remote controls on workers require a union agreement or authorization from the labor inspectorate.

Digital attendance systems

Digital recording allowed: Yes, limited to the mere recording of check-ins and check-outs. Ministry of Labor Circular 19/2022 excludes the pure time-clock system from the reinforced information duty provided for remote-control instruments.
QR recording: Yes, allowed.
Mobile device recording: Yes, allowed.
Manual recording: Yes, allowed (paper record or Libro Unico del Lavoro).

Status of Norkent in Italy

Allowed with conditions
Norkent, limited to clocking and reports without automated decisions or indirect activity controls, fits within the exception of Ministry of Labor Circular 19/2022. By not using biometrics, it avoids the Garante's repeated prohibition of that category for attendance control. Before its implementation in Italy, a company should consider: 1. Clear prior information: provide the worker with the information required by art. 13 GDPR on purpose, legal basis and retention period before processing begins. 2. No indirect activity control: Norkent must not incorporate features that measure performance or productivity; if they were added in the future, they would require a union agreement or authorization from the INL (art. 4 Statuto dei Lavoratori). 3. 5-year retention: keep records for at least 5 years from the last entry (Ministerial Decree of July 9, 2008, on the Libro Unico del Lavoro). 4. Geolocation: avoid continuous geolocation use; if activated, do so on a specific legal basis and, if systematic, with a DPIA. 5. Data processing agreement: formalize the data-processing agreement with Norkent under the GDPR. 6. Decreto Trasparenza: if Norkent introduced automated decisions about the worker, reassess compliance with the transparency decree (Decreto Trasparenza).