More companies in Spain are looking to clock in without a fingerprint, and the reason is not only comfort: Spain’s data protection authority, the AEPD, has made clear that biometric clock-in for ordinary time attendance has no legal basis, and it has the fines to prove it.
Is fingerprint clock-in legal?
Per AEPD guidance, using a fingerprint or facial recognition for a workforce’s routine time attendance has no legal basis: an employee’s consent is not valid in an employment relationship because of the power imbalance, and no rule requires that specific biometric data for clocking in. Source: protecciondatos-lopd.com, “Biometría prohibida en el fichaje de trabajadores” (checked 6 September 2026).
A real fine
The AEPD has fined companies for fingerprint clock-in with no legal basis: one documented case reached a fine of €365,000. Source: digitalperito.es, “AEPD prohíbe la huella dactilar en el fichaje: alternativas 2026” (checked 6 September 2026).
How much biometrics can cost, in total
The €365,000 case is not alone, and it is the largest documented fine to date. Between 2023 and 2025 the AEPD fined several companies over mandatory biometric clock-in, with recent fines ranging from €5,000 to €90,000 depending on the case, on top of the €365,000 case; the highest amounts appear when staff were not informed or no non-biometric alternative was offered. Source: PSD Security, “Fichaje biométrico: ¿es legal?” (checked 7 September 2026). The pattern is the same in every case: no alternative for someone who does not want to give a fingerprint or a face.
What alternatives are legal
The alternatives named as valid are an app, a QR code (static or dynamic), a PIN, and web clock-in. A dynamic QR code stands out because it stops one person from clocking in for another: the code changes and cannot be reused or shared ahead of time. Source: tramitapp.com, “¿Es legal fichar con reconocimiento facial en la empresa?” (checked 6 September 2026).
Clocking in from a personal phone is not the only alternative to weigh
Clocking in from a personal phone avoids biometrics, but it brings a different risk: if the app stores the session with no proper security, someone else with access to the phone could clock in on the employee’s behalf. A dynamic QR code solves that specific point because the code expires after one use, so sharing it in advance is useless.
Why a dynamic QR code, and not a static one or a PIN
A static QR code or a PIN share the same underlying problem: once someone else knows it, they can reuse it or pass it along to a colleague with no way for the system to notice or flag it. IDClock’s dynamic QR code changes every few seconds on the device screen, so clocking in requires standing in front of the device, phone in hand, at that exact moment.
How IDClock clocks people in
IDClock clocks in with a dynamic QR code: a device at the entrance shows the code, the employee scans it with the app, and the system decides whether it is a clock-in or a clock-out. No biometrics: no fingerprint, no face, no voice. The device never reports the punch: the app sends it to the backend, with unlimited users and no per-person cost.
What to check if you switch systems
If your company clocks in today with a fingerprint or a face and wants to move to a system with no biometrics, check four points closely before you choose the replacement: whether the new system asks for any personal data beyond what it needs to identify the clock-in and clock-out, whether the device or app stores that data on the device itself or sends it to a server, how long the rollout takes across the whole workforce, and whether the vendor can confirm in writing that the system processes no biometric data, something the Labour Inspectorate or the AEPD itself can ask to see at any time.
Frequently asked questions
Can a company ask for employee consent to clock in with a fingerprint?
Not validly. The AEPD holds that consent is not freely given in an employment relationship, because of the power imbalance between company and employee, so it does not serve as a legal basis for ordinary biometric clock-in.
Does facial recognition have the same problem as a fingerprint?
Yes. AEPD guidance treats both biometric data types the same way: neither has a legal basis for a workforce’s routine time attendance, and both have led to documented fines that reach into six figures.
Sources
- protecciondatos-lopd.com, “Biometría prohibida en el fichaje de trabajadores” (checked 6 September 2026)
- digitalperito.es, “AEPD prohíbe la huella dactilar en el fichaje: alternativas 2026” (checked 6 September 2026)
- tramitapp.com, “¿Es legal fichar con reconocimiento facial en la empresa?” (checked 6 September 2026)
- PSD Security, “Fichaje biométrico: ¿es legal?” (checked 6 September 2026)