Last updated: 09/08/2026
Norkent for United Kingdom
Working Time Regulations with 48h opt-out. UK GDPR requires a DPIA and a non-biometric alternative.
ISOGB
CurrencyPound sterling (GBP)
LanguageEnglish and regional co-official languages
Weekly hours48 h average (voluntary opt-out)
Vacation5.6 weeks (28 days)
Record retention2 years (WTR) / 6 years (leave)
Legal framework and labour authority
Main labour law: Working Time Regulations 1998 (WTR) and Employment Rights Act 1996 (amended by the Employment Rights Act 2025, which introduces a mandatory holiday record from April 2026).
Code / number: Working Time Regulations 1998 (SI 1998/1833); Employment Rights Act 1996; UK GDPR (the version of the GDPR retained by the Data (Use and Access) Act 2025); Data Protection Act 2018.
Labour authority: Health and Safety Executive (HSE) and Advisory, Conciliation and Arbitration Service (Acas).
Official sources: gov.uk; ico.org.uk; legislation.gov.uk.
Working hours and overtime
Maximum weekly hours: 48 weekly hours on average, normally calculated over 17 weeks (WTR). The worker may sign an individual and voluntary opt-out to work more.
Rest between shifts: Minimum 11 consecutive rest hours between workdays (WTR).
Weekly rest: Minimum 24 consecutive rest hours every 7 days, or 48 hours every 14 days (WTR).
Overtime premium / compensation: The United Kingdom does not legally require an overtime surcharge; it depends on the contract or the employer's policy (the WTR sets a working-time limit, not a surcharge).
Breaks and leave
Vacation: 5.6 weeks (28 days including the bank holiday system) for a full-time schedule, under the WTR; the Employment Rights Act 2025 introduces mandatory leave record-keeping from April 2026.
Maternity: 52 weeks of leave (26 ordinary + 26 additional), with SMP (Statutory Maternity Pay) for 39 weeks, under the Employment Rights Act and the Statutory Maternity Pay Regulations.
Paternity: 2 weeks of ordinary leave, paid according to the applicable statutory scheme (SPP).
Personal data protection
Data protection law: UK GDPR (the version of the GDPR preserved by the Data (Use and Access) Act 2025) and the Data Protection Act 2018.
Competent authority: Information Commissioner's Office (ICO).
Geolocation: Considered personal data; requires a valid legal basis (art. 6 UK GDPR) and, if systematic, a DPIA and the offer of a non-invasive alternative.
Biometric data: Its use for time control requires a DPIA, the specific condition of art. 9 UK GDPR, and the offer of a non-biometric alternative.
Workplace monitoring: Limited by the DPA 2018 and the ICO: the employer must inform workers in advance about the processing and its purposes.
Digital attendance systems
Digital recording allowed: Yes. The WTR allows any record format that is "adequate" (adequate record).
QR recording: Yes, allowed.
Mobile device recording: Yes, allowed.
Manual recording: Yes, allowed.
Status of Norkent in United Kingdom
Allowed with conditions
The United Kingdom maintains a flexible framework under the WTR, without requiring specific technology, and the ICO is strict about transparency. Norkent avoids the reinforced requirements for biometric data. Before its implementation, a company should consider:
1. Valid legal basis: define a legal basis under art. 6 UK GDPR (legal obligation or legitimate interest); consent is not the appropriate basis in the employment context.
2. Privacy notice: provide a clear privacy notice before or at the start of using the system.
3. Record retention: keep time records for at least 2 years (WTR) and leave records for 6 years (Employment Rights Act 2025, from April 6, 2026).
4. Subject access requests (SARs): respond to them within one month.
5. Geolocation and biometrics: if enabled in the future, carry out a DPIA and comply with the requirements of art. 9 UK GDPR.
6. International transfers: if data is stored outside the United Kingdom, verify valid transfer mechanisms under the UK GDPR.