Contents
Who is responsible for what
The controller is the business that decides on the purposes and means of the processing, that is the employer. The processor is the software provider that stores the data in its system.
Responsibility does not travel with the data. Anyone renting time recording as software remains responsible towards the employees and the supervisory authority, including for choosing a suitable provider.
What the contract has to contain
Article 28(3) GDPR names the minimum content: the subject matter and duration, the nature and purpose of the processing, the type of data and the categories of data subjects, the duty to follow instructions, the confidentiality undertaking of the staff, technical and organisational measures, rules for sub-processors, support with data subject rights, deletion or return at the end, and duties to demonstrate compliance.
The contract has to be concluded in writing or in an electronic format. A note in the general terms and conditions is not enough.
What remains to be done alongside
The processing belongs in the record of processing activities under Article 30 GDPR. Employees have to be informed under Article 13 GDPR, and before the recording starts.
Whether a data protection impact assessment under Article 35 GDPR is needed depends on the individual case. Pure time recording without performance evaluation as a rule does not trigger one; systematic monitoring does.
Common mistake
The data processing agreement gets downloaded from the provider, signed and filed without checking the list of sub-processors. That list is exactly where the data actually goes, and it is exactly what a supervisory authority asks about first.
This is not legal advice; for a specific case at your workplace you are better off asking someone qualified to give it.
Published by: AMNAU GmbH
Editorial responsibility: Ugur Aydogan, Product development.
Last reviewed: 2 September 2026