GPS, selfie and GDPR clock-in methods: what is legal in Romania

What the law actually requires: a record of hours worked

Before comparing technologies, it helps to be clear on what the law demands. The Romanian Labour Code (Law 53/2003) requires employers to keep a daily record of the hours worked by each employee, including the start and end of the working schedule. The resulting document is the timesheet (foaie de pontaj), which must be available to ITM inspectors on request.

The law does not mandate a specific technology. You can clock in on paper, with a card, through an app or via biometric recognition — all are allowed, as long as the record is real, accurate and available. In other words, the choice of method is free, but the GDPR consequences of each method differ radically.

The second legal layer is GDPR (EU Regulation 2016/679). Any clock-in processes personal data (who worked, when, where). The data minimisation principle requires you to collect strictly what is necessary for the purpose. This is where methods diverge sharply: some collect ordinary data, others special-category data.

Card and PIN: cheap, but exposed to buddy-punching

Clocking in with a proximity card or a PIN code is the oldest digital method. The employee taps a card or enters a numeric code at a terminal, and the system records the time.

From a GDPR standpoint this is a gentle method: it processes only an identifier (card number or PIN) and a timestamp — ordinary personal data, easily justified by the employer's legitimate interest in tracking hours. There is no sensitive data.

The problem is not legal but one of data integrity. A card can be handed to a colleague and a PIN can be shared over the phone. That is how buddy-punching arises — one employee clocking in for another who is late or absent. Workforce-management research estimates significant losses from this fraud, and for businesses with many hourly staff the effect compounds. Card/PIN alone cannot prove who actually clocked in.

• Pro: low cost, simple GDPR (no sensitive data), fast.
• Con: does not tie the clock-in to the real person — exposed to buddy-punching.
• Fit: small, high-trust teams where clock-in fraud is not a concern.

GPS and geofencing: great for field work, mind proportionality

GPS clock-in uses the location of the employee's phone. With geofencing you define a geographic zone (e.g. a radius around a site, shop or work point) and the app only allows clocking in when the employee is physically inside the zone. It is the natural fit for mobile work: field crews, couriers, sales reps, home service.

GPS answers the 'where' well but raises a GDPR proportionality issue. A person's location is personal data that can become intrusive if tracked continuously. The golden rule: capture location only at the moment of clocking in (a single point: 'was in the zone at time X'), do not track the employee's route throughout the day. Continuous position tracking usually exceeds the clock-in purpose and becomes hard to justify.

In practice, geofencing confirms presence at the workplace but still does not confirm identity. The phone with the app can be left with a colleague. That is why GPS works best combined with a person check — for example a selfie at clock-in.

• Pro: ideal for field work; confirms presence in the work zone.
• Con: risk of over-collection if you track continuously; does not confirm identity on its own.
• Best practice: capture location only at clock-in, inform employees clearly, document it in your privacy policy.

Biometric fingerprint: strong against fraud, but special-category data

A fingerprint, biometric facial recognition or iris scan fully solves buddy-punching: you cannot lend your fingerprint to a colleague. For that reason many companies see them as the 'gold standard' for accuracy.

But here lies the major legal trap. GDPR classifies biometric data used to uniquely identify a person as a special category of data (sensitive data). Processing it is, as a rule, prohibited except on strict legal grounds. In an employment context, employee consent is a fragile basis, precisely because the employee–employer relationship is unequal: European data-protection authorities often consider that an employee cannot truly consent freely. On top of that, the minimisation principle requires you to prove no less intrusive alternative could achieve the same purpose.

The practical consequence: for plain time-clocking, if an equally effective but less intrusive method exists (like the non-biometric selfie), using a fingerprint becomes hard to justify. Several EU supervisory authorities have fined or ordered the shutdown of biometric time-clocks on exactly this reasoning. Fingerprints can be a valid choice in high-security scenarios, but they require a data protection impact assessment (DPIA) and a solid necessity argument.

• Pro: eliminates buddy-punching, maximum accuracy.
• Major con: GDPR special category — fragile legal basis at the workplace, mandatory DPIA, risk of penalty.
• Takeaway: reserve biometrics for genuine security cases, not routine time-clocking.

Non-biometric selfie: verify the person without sensitive data

The non-biometric selfie is the method that wins the comparison above. At clock-in, the employee takes a photo of their face, automatically attached to the time record. The key legal difference: the photo is stored and checked visually (by a manager or through simple comparison), without being converted into a biometric template that uniquely identifies the person via an algorithm. As long as you do not process facial features as biometric identification data, the image remains ordinary personal data, not special category.

The result is a rare balance: you get anti-buddy-punching protection (a colleague cannot clock in for another — the photo proves who was present) without the GDPR burden of biometrics. You do not need the strict legal basis for sensitive data, and the impact assessment is far simpler than for a fingerprint. Combined with a 6-digit PIN (declared identity) and optionally GPS geofencing (the place), you get a clock-in that answers 'who', 'when' and 'where' at once.

Good GDPR practices still apply to the selfie: transparent employee notice, a clear purpose (presence verification), a reasonable retention period for the images and mention in your internal policy. But the compliance burden is markedly lighter than with a fingerprint, and the penalty risk far lower.

From accurate clock-ins to the timesheet and legal hours

Marking the entry and exit time is only the first half. The second is turning those marks into the timesheet and the correct calculation of hours under the Labour Code: regular hours, overtime, night work and public holidays.

The law sets minimum premiums the system must calculate correctly. Overtime is compensated primarily with paid time off, and when that is not possible, with a pay premium of at least 75% of the base salary. Night work (in the 22:00–06:00 window) benefits either from a shorter schedule or a premium of at least 25% of the base salary. Public holidays have their own compensation rules. An hours engine that applies these rules automatically reduces payroll errors and inspection exposure.

This is where a dedicated time-clock module makes the difference. The Appy time-clock module works for any company, not just hospitality: mobile clock-in with a 6-digit PIN plus non-biometric selfie (GDPR-safe, anti buddy-punching), optional GPS geofencing and QR clock-in, an hours engine aligned with the Labour Code (overtime, night, holidays), a timesheet and ITM export, plus shift planning. That way the choice of clock-in method and the legal obligation to record hours are solved in one place, transparently and correctly.