Time and attendance, working hours and absences: the complete 2026 guide

1. What time and attendance tracking is

Time and attendance tracking is the set of tools and rules by which a company records when each person starts and finishes work, when they take breaks and why they are absent. The raw data is the clocking: a time, a direction (in or out) and an identity. On its own, however, a clocking tells the payroll office nothing. It becomes useful when it is compared with the scheduled hours, with the rules of the collective agreement and with approved requests, such as annual leave, time off or business trips.

For this reason it helps to distinguish three levels:

• Collection: the badge time clock, the QR code, the app, web clocking, the paper sign-in sheet. It answers the question ‘at what time?’.
• Processing: the comparison between clockings and the theoretical schedule, which produces regular hours, overtime, lateness, anomalies and justifications. This is the time card.
• Output to payroll: the month’s hours and reason codes, ready for the payslip and for the attendance calendar of the Single Labour Book.

A company can change the first level without touching the other two, for example by adding the app for people who work off-site alongside the time clocks already installed. The opposite is harder: if processing is done in an Excel spreadsheet, every new clocking channel adds a manual step.

An example of a daily time card

That one hour and eighteen minutes is not automatically overtime. It depends on the company’s rounding rules, on what the collective agreement provides and, above all, on authorisation: if overtime has to be requested in advance, the difference stays pending until the manager decides. The system is there to bring the case to light, not to decide it.

2. Why it is an obligation: the LUL and the attendance calendar

In Italy the obligation comes through the Single Labour Book (LUL). Private-sector employers, with the sole exception of domestic employers, must set it up and keep it. Besides personal and pay data, the LUL must contain “an attendance calendar showing, for each day, the number of hours worked by each employee”, with overtime hours, absences (including unpaid ones), annual leave and rest periods (Decree-Law 112/2008, Article 39(2)). For employees on a fixed salary paid by the full day or for longer periods, only the day of attendance is recorded.

The book is completed for each month by the end of the following month (paragraph 3). October’s attendance, therefore, must be recorded by 30 November. Omitted or inaccurate recording that leads to pay, social-security or tax treatment different from what is due is penalised, with amounts that rise if the violation concerns more than five or more than ten workers, or lasts more than six or twelve months (paragraph 7).

Paragraph 7 clarifies what counts as ‘inaccurate’ recording: data that differ from the quantity or quality of the work actually performed. A time card that shows the theoretical schedule when the hours worked were different is exactly this case.

What the Court of Justice of the European Union said

On 14 May 2019, in Case C-55/18, the Court of Justice of the European Union held that Member States must require employers to set up “an objective, reliable and accessible system” that measures the duration of each worker’s daily working time. According to the Court, without such a system it is not possible to verify whether the maximum weekly duration and the minimum rest periods have been complied with. The form of the system is for the Member States to decide, taking account of sectors and the size of businesses.

The ruling is addressed to the Member States, not directly to companies. For an Italian company the operational reference remains the attendance calendar of the LUL, which already requires the hours worked day by day. The ruling is nonetheless useful as a quality criterion: a time and attendance system should produce data that is objective (not reconstructed at month end), reliable (hard to alter) and accessible (open to consultation by the worker and the supervisory bodies).

How long data is kept

In its decision of 8 September 2016 on the use of smartphones for clocking in and out, the Data Protection Authority held that data collected for keeping the Single Labour Book may be retained for five years, limited to the information that must be entered in the book. Data needed for other purposes follow the periods set for those purposes. In your own case, the retention period must be set out in the privacy notice and in the record of processing activities.

3. Working time: the limits to monitor

Legislative Decree 66/2003 defines working time as “any period during which the worker is at work, at the employer’s disposal and carrying out his or her activity or duties”. Everything else is rest time. A time and attendance system also serves to check the limits that the decree sets, because many of them can only be verified by lining up the clockings of several days.

The rules on daily rest, breaks and night work (Articles 7, 8, 12 and 13) may be derogated from by national collective agreements or, failing those, by territorial or company-level ones (Article 17). Whoever uses a derogation must as a rule grant equivalent periods of compensatory rest (Article 17(4)). In practice, the thresholds to set in the system are those of the CCNL that applies, which may differ from those in the table: the law is the starting point, not always the value to use.

Two worked examples

Averaging the 48 hours. A warehouse worker works 52 hours a week for 6 weeks of peak season and 40 hours for the following 11 weeks. Over 17 weeks, about four months, the hours total 312 + 440 = 752: the average is 44.2 hours, below the limit. If the 52-hour weeks were 12 and the 40-hour ones were 5, the hours would become 624 + 200 = 824 and the average 48.5: over the limit, even though no single week looked out of scale.

Rest between two shifts. A shop assistant closes the shop at 23:00 and the next day starts the opening shift at 7:00. Only 8 hours pass between the two shifts, fewer than the 11 required by Article 7. If the CCNL provides no derogation for that case, the shift must be changed before it is published, not corrected afterwards.

4. Tracking methods compared

The right method depends on where people work, how many entry points there are and how reliable the identity of the person clocking in must be. A company can use more than one: a time clock at the plant entrance, the app for those at client sites, web clocking for those working from home.

The sign-in sheet seems the cheapest solution. The cost shows at month end: someone copies out the hours, someone else rechecks them, and nobody can say with certainty what time Mario left on the 12th. If a worker disputes overtime two years later, the sheet helps neither the worker nor the company.

To go further on clocking in from a smartphone with a code that regenerates, read clocking with a dynamic QR code (in Italian).

5. Privacy, remote monitoring and biometrics

The Workers’ Statute: when an agreement is needed

Article 4 of Law 300/1970 allows tools that also make remote monitoring of workers’ activity possible only for organisational and production needs, for workplace safety and for the protection of company assets, and only following an agreement with the trade-union representatives or, failing that, with the authorisation of the National Labour Inspectorate (Ispettorato nazionale del lavoro) (paragraph 1).

Paragraph 2 excludes two categories from this procedure: the tools that the worker uses to perform the work and tools for recording access and attendance. A time clock, therefore, does not require the agreement. The information collected can be used for all purposes related to the employment relationship only if the worker has been given adequate information on how the tools are used and how checks are carried out, and in compliance with privacy law (paragraph 3).

The delicate point is a tool that does more than one thing. An app that records only entry and exit is an attendance-recording tool. If the same app collects location during the day, that function goes beyond clocking and may fall under paragraph 1. Before enabling a function that is not needed for clocking, ask your labour consultant how to classify it.

Geolocation: what the Data Protection Authority required

On 8 September 2016 the Data Protection Authority examined an app that detected the smartphone’s position only at the moment the employee clocked in or out. It observed that a smartphone follows the person even outside working hours, and that the detected position has margins of error. It therefore prescribed several measures:

• check that the worker’s position matches the workplace and then delete the coordinates, keeping at most the location, date and time of the clocking;
• show on the device an icon indicating when location is active;
• prevent the app from processing other data on the phone, such as call traffic, SMS, email or browsing.

The decision was adopted before the European Regulation (GDPR) became applicable, under the prior-checking procedure then in force. It remains the clearest reference on how to configure geolocated clocking: position used only at the moment of clocking, coordinates not retained, worker informed. For a case in which a court assessed a system of this kind, read geolocation and remote clocking (in Italian).

Biometrics: not for employee attendance

Fingerprints and facial recognition are biometric data, a special category of personal data. The European Regulation generally prohibits their processing; in the employment context it allows it only if authorised by Union or Member State law, or by a collective agreement, with appropriate safeguards (GDPR, Article 9, as cited by the Data Protection Authority). In Italy there are in addition the safeguard measures provided by Article 2-septies of the Italian Privacy Code (Codice privacy).

On this basis the Authority concluded, in its decision of 29 April 2026, that “current law does not permit the processing of employees’ biometric data for the purpose of recording presence at work”. It added that processing takes place both when the face is recorded the first time and at each recognition, and that using it for attendance does not respect the data-minimisation principle, because the same purpose can be achieved with less intrusive tools.

As early as February 2024 the Authority had fined five companies that used facial recognition for attendance at the same waste-disposal site, with amounts between 2,000 and 70,000 euro. Besides the lack of a legal basis, it had noted the absence of a clear privacy notice and of an impact assessment, and had indicated the badge as a less intrusive alternative. In the case decided in 2026 the only document informing employees of the facial recognition was titled “Consent and privacy notice for workers”: the Authority found it inadequate and judged the processing unlawful for lack of a legal basis, with a fine of 55,000 euro and an order to delete the data. Further reading: time and attendance and privacy: biometrics and fines (in Italian).

What to prepare before enabling a system

• A privacy notice for workers explaining which data are collected, with which tool, for what purposes and for how long.
• Entry of the processing in the record of processing activities, with the retention periods decided.
• An assessment of whether a data protection impact assessment is needed, in particular if location is used.
• For each app function not needed for clocking, a check on whether it falls under paragraph 1 of Article 4.
• The software supplier appointed as data processor, with written instructions.

6. Off-site work, smart working and building sites

Agile working (lavoro agile)

Agile working takes place partly on company premises and partly outside, without precise constraints on hours or place, but within the limits of maximum daily and weekly working time set by law and by collective agreements (Law 81/2017, Article 18). The individual agreement is made in writing and sets out the worker’s rest periods and the technical and organisational measures for disconnection (Article 19). The exercise of the power of control over work performed outside the company must be regulated in the agreement, in compliance with Article 4 of the Workers’ Statute (Article 21).

The employer notifies the Ministry of Labour electronically of the names and of the start and end dates of agile working within five days of the start, or of a change in duration or of termination (Article 23).

In practice, two things are needed for those who work from home. The first is the agile-working day recorded as such, with its own reason code, so that the time card does not treat it as an absence. The second is a clear rule on how start and end are recorded, with the app or on the web, consistent with the rest and disconnection times written in the agreement. Further reading: agile working and safety: what changes (in Italian).

Mobile staff

Technicians, home-care assistants, cleaners at client premises, sales staff: for them an on-site time clock is of no use. The options are the app on the phone, the QR code displayed at the workplace or the team leader’s device. If the phone is personal, it is better to propose its use and leave an alternative for those who cannot or do not want to use it: in the case examined by the Data Protection Authority in 2016 the companies had assured employees a choice between the app and traditional time clocks.

Building sites: the card with a unique code

Decree-Law 159/2025 (D.L. 159/2025), converted into Law 198/2025, provides that companies working on building sites under contract and subcontract, public or private, supply employees with the identification card already required by Legislative Decree 81/2008 (D.Lgs. 81/2008, Article 18(1)(u) and Article 26(8)) and by Law 136/2010, fitted with a unique anti-counterfeiting code (Article 3(2)). The card is used as a badge with the employee’s identifying details and is also made available in digital form, with tools interoperable with the SIISL platform. The obligation may be extended by decree to other higher-risk areas.

The implementation arrangements, including control measures on building sites, monitoring of labour flows and the types of information processed, are entrusted to a decree of the Minister of Labour, after also consulting the Data Protection Authority (paragraph 3). Before buying cards or systems for the building site, check on the Ministry of Labour’s website whether the decree has been published and what it provides. Further reading: badges on private building sites (in Italian).

7. Shifts and schedule planning

Under Legislative Decree 66/2003, shift work is an organisation in which workers successively occupy the same posts according to a pattern, including a rotating, continuous or discontinuous one. Where there are shifts, time and attendance tracking works in reverse: first you plan, then you compare what was planned with what was clocked.

The shift plan must respect the rest periods and limits of section 3 from the outset. A morning-afternoon-night-rest rotation, for example, must be checked at the handover points between one shift and the next, where the 11-hour rest is most easily shortened. Article 9(2) provides an exception to weekly rest for shift work, when the worker changes shift or team and cannot take the rest between the end of one shift and the start of the next.

What to ask of the shift plan

• That a repeating sequence can be set across the whole period, instead of being re-entered every week.
• That it flags conflicts with already approved annual leave and time off before the plan is published.
• That it recognises the breaks built into the shift, so that break clockings do not become anomalies.
• That the manager of a shop or team sees only their own people and can replace an absent colleague.
• That whoever is on shift can see it from their phone, including last-minute changes.

For more on planning, read digital planning of work shifts (in Italian).

8. Annual leave, time off and other absences

Every hour not worked must have a reason code: annual leave, paid time off, ROL (working-hours reduction leave), sickness, accident at work, leave of absence, leave under Law 104, strike, unjustified absence. The codes are defined by the collective agreement together with internal rules, and each has a different effect on the payslip. For this reason absence requests are part of time and attendance tracking: if they arrive by email and are copied out by hand, the difference between ‘absent’ and ‘justified absence’ is only discovered at month end.

Annual leave: the legal minimum

Workers are entitled to at least four weeks of paid annual leave per year. Unless the collective agreement provides otherwise, at least two are taken in the year of accrual (consecutively, if the worker requests it) and the other two within the following 18 months. The minimum period cannot be replaced by an allowance for untaken leave, except when the employment relationship ends (Legislative Decree 66/2003, Article 10).

Example, unless the collective agreement has different rules: of the leave accrued in 2026, at least two weeks must be taken by 31 December 2026 and the remaining two by 30 June 2028. A balances report split by year of accrual shows in advance who risks exceeding those deadlines.

A leave plan drawn up at the start of the year, with a minimum number of days to schedule per group, reduces requests concentrated on the same days. For the organisation of requests, approvals and plans, read annual leave and time-off management or download the HR Guide to Leave Management (PDF) (PDF, in Italian).

Sickness

Sickness enters the time card as an absence with its own reason code and the dates of the certificate. If the company receives the certificates from the National Social Security Institute (INPS) by certified email (PEC), software that reads the attached file avoids copying the dates by hand. What has changed and how to organise: sickness certificates by certified email from INPS (in Italian).

9. From attendance to payroll: the month-end close

The month-end close is the moment when attendance data pass to payroll. Hours and reason codes go to the in-house payroll office or the external payroll firm, become payslip items and end up in the attendance calendar of the LUL, to be completed by the end of the following month. For the reverse path, from the payslip and INPS to the management system (leave balances, costs, sickness), there is the webinar Integration of payroll and INPS data (in Italian) (recorded in 2025, 31 minutes).

If the first two steps run late, everything else slips. An automatic reminder at the start of the month to those with missing clockings in the previous month, and a deadline after which regular requests are considered approved, shift the work onto those who know the data: the employee and their manager.

The format for passing data to payroll

The time and attendance software does not necessarily have to come from the same supplier as the payroll software. What is needed is an agreed layout, by file or through application programming interfaces (APIs), with the same reason codes on both sides. Before changing either system, ask the payroll firm for the layout it uses today and test it on a real month.

Meal vouchers and other attendance-related items

Some items depend on attendance: the meal voucher, for example, may be tied to the day worked or to a minimum number of hours, according to company or contract rules. Calculating them from the time card avoids a second count by hand. Further reading: meal vouchers and attendance (in Italian).

10. Mistakes to avoid

• Recording the theoretical schedule instead of the hours worked. The LUL calendar asks for the hours actually performed: if the real hours differ, a time card that shows 8:30-17:30 every day is an inaccurate recording.
• Noticing breaches at month end. The 48-hour average, the 11-hour rest and the annual overtime ceiling are checked while planning and during the month.
• Enabling location in the app ‘for safety’. Without a rule on when it is detected, what is kept and how the worker is informed, the function creates a problem instead of solving one.
• Using a biometric reader ‘because the employees have consented’. According to the Authority, consent or a privacy notice is not enough: without a rule authorising it, processing biometric data for attendance remains unlawful, as in the 2026 decision.
• Leaving agile working without a reason code. The day at home appears as an absence or as a full presence with no times, and neither is correct.
• Keeping absence requests outside the system. Every email copied out is one more step and a possible error.
• Changing the payroll software and the attendance software in the same month. If something does not add up, you no longer know which of the two to correct.

11. How to choose time and attendance software

Start from the people, not from the features. An office of fifteen people with a single entrance has different needs from a company with three shift-based plants, shops open on Sundays and technicians at client sites. List the groups (on site, on shifts, off-site, smart working, building sites) and for each choose how to clock in and out. Only then compare software.

Questions to ask every supplier

1. Which clocking methods does it support (badge, QR code, app, web, team leader’s device) and can they be used together?
2. Does the app work without a network and send the clockings as soon as the signal returns?
3. With geolocation, when does it detect position and what does it keep? Does it work in the background?
4. What controls exist against clockings tampered with through the phone?
5. Can the calculation rules (rounding, breaks, overtime, night work) be configured on the CCNL that applies?
6. Does it warn in advance of breaches of the 48-hour average, the 11-hour rest and the overtime ceiling?
7. How are shifts planned and how is the plan compared with what was clocked?
8. Are annual leave, time off, agile working, on-call duty and overtime requested and approved in the system, including from the app?
9. How are sickness certificates imported?
10. In what format does it export to the payroll software or the payroll firm, and does the layout adapt to theirs?
11. Can the payroll firm have its own access?
12. Is every change to clockings and requests logged?
13. Where is the data, who has access to it and how long is it kept?
14. Can the app be added to the time and attendance system already in use, without replacing it?

When it makes sense to change the current system, and how to do it without stopping payroll, is explained in changing HR or attendance software: when and how (in Italian). A printable summary is in the HR Guide to Time and Attendance Tracking (PDF).

13. Frequently asked questions