GDPR and Time Tracking: What EU Freelancers and Small Teams Need to Know

Quick answer

Recording hours is usually fine under GDPR. The trouble starts elsewhere: with what else a tool collects, and what you do with it. For GDPR time tracking compliance, three habits cover most of the ground: pick a lawful basis before you start, collect only what the purpose needs, and tell people what you record and when you delete it.

This is general information, not legal advice. National employment and data protection rules differ across the EU, so check your own country's regulator if you track other people's time.

How it actually works

GDPR applies once you process personal data about other people. Tracking only your own hours for your own invoicing is a different situation from logging a contractor's or an employee's time. If you're a freelancer working solo, most of this article matters only when a client's staff or your subcontractors enter the picture.

Pick a lawful basis

Every processing activity needs a legal basis. The European Data Protection Board lists six of them: consent, contract, legal obligation, public interest, vital interests, and legitimate interests. For time tracking, two are the usual fits:

• Contract. Recording hours you need to pay someone or invoice a client. The processing has to be genuinely necessary for the contract, and you should write down why.
• Legitimate interests. Project budgeting or workload planning. This needs a documented balancing test: is the aim lawful and real, is the tracking necessary for it, and does it override what the person would reasonably expect?

Consent is the one to be careful with. The EDPB guidance says that, in principle, employees cannot freely consent to processing by their employer, because they may feel unable to refuse. If someone can't say no without consequences, that consent isn't valid.

Collect only what you need

The Commission's overview of the principles says data should be "adequate, relevant, and limited to what is necessary" for the purpose. For a timesheet, that means project, client, start and end times, and total hours. Screenshots, keystroke logs, location trails and biometric data are much harder to justify for billing or budgeting.

The same page says a purpose must be specific. Hours collected for invoicing shouldn't quietly become evidence in a disciplinary case without a compatible purpose or a fresh basis. For a practical example of using records as proof for the right reason, see keeping evidence when a client disputes your hours.

Tell people and set retention

People need to know what you record, why, on what basis, and for how long, in a concise and plain-language notice. They also keep their rights to access, correct, erase or object. For a small team, one accurate paragraph in an onboarding doc does the job.

On retention, the guidance says to keep data for the shortest time possible and to set time limits to erase or review it. Tax or labour record rules may require you to keep timesheets longer. Pick a date. Write it down. Delete on schedule. If a third-party tool processes the data for you, sign a data processing agreement with the provider.

When to use it (and when to skip it)

Plain hour tracking fits well when the purpose is clear:

• Invoicing clients from logged hours.
• Comparing estimates to actuals on a project.
• Seeing whether a three-person team is overloaded, as in tracking time on a small team without micromanaging.

Slow down or skip when tracking turns into surveillance. Broad activity monitoring, location data, biometrics, or automated productivity scores raise the risk. In those cases a data protection impact assessment (DPIA) is worth doing before you switch anything on. Automated scores that drive employment decisions can also engage GDPR's rules on automated decision-making, so keep a human in the loop.

Automatic capture sits in the middle. It can be useful, but the more it records in the background, the more you have to justify. Our piece on how far automatic tracking should go covers the accuracy side of that trade-off.

Here's a simple test: could you explain the tracking to the person being tracked in two sentences, and would they find it reasonable? If not, collect less.

How Pomlo fits in

Pomlo is a time tracker for iOS, Android and the web, built around the kind of timesheet data this article treats as the safe default: hours by project and client. One-tap start and stop keeps the log simple, and reports show where the week went, so you can budget projects and explain an invoice without collecting anything beyond hours.

A few specifics that matter here:

• Projects and clients let you organise hours by who you're billing, which maps to the contract basis.
• Built-in invoicing turns tracked hours into an invoice in one tap.
• Privacy-respecting: your data isn't sold or used to train models.

You still need your own notice, basis and retention date. A tool can't choose those for you, so write them down before you start. Download Pomlo from the App Store or Google Play and start with a plain hours log.

Frequently Asked Questions

Does GDPR apply if I only track my own time as a freelancer?

Tracking only your own hours for your own use is generally not what GDPR is aimed at. It applies once you process personal data about other people, such as a client's team members or your contractors. Rules vary by country, so check your national data protection authority.

Can my team consent to time tracking?

Consent is a weak basis for employees because they may feel unable to refuse. Contract, or a documented legitimate interest, is usually the better fit.

How long should I keep timesheets?

Only as long as you need them for the stated purpose, with a set review or erase date. Tax or labour record rules may require longer, so check which apply to you.

Do I need a DPIA for a time tracker?

Simple hours and project entries are lower risk. Broad activity monitoring, location or biometrics raise the risk and make a DPIA worth doing.