Processing on behalf
Processing on behalf exists where a service provider processes personal data on behalf of and on the instructions of a controller. It requires a contract under Article 28(3) GDPR.
As of:September 2026
Who is responsible for what
The controller is the business that decides on the purposes and means of the processing, that is the employer. The processor is the software provider that stores the data in its system.
Responsibility does not travel with the data. Anyone renting time recording as software remains responsible towards the employees and the supervisory authority, including for choosing a suitable provider.
What the contract has to contain
Article 28(3) GDPR names the minimum content: the subject matter and duration, the nature and purpose of the processing, the type of data and the categories of data subjects, the duty to follow instructions, the confidentiality undertaking of the staff, technical and organisational measures, rules for sub-processors, support with data subject rights, deletion or return at the end, and duties to demonstrate compliance.
The contract has to be concluded in writing or in an electronic format. A note in the general terms and conditions is not enough.
MetronHR works these figures out itself: time accounts, premiums, overtime and the limits of the German Working Hours Act, with every booking.
What remains to be done alongside
The processing belongs in the record of processing activities under Article 30 GDPR. Employees have to be informed under Article 13 GDPR, and before the recording starts.
Whether a data protection impact assessment under Article 35 GDPR is needed depends on the individual case. Pure time recording without performance evaluation as a rule does not trigger one; systematic monitoring does.
Common mistake
The data processing agreement gets downloaded from the provider, signed and filed without checking the list of sub-processors. That list is exactly where the data actually goes, and it is exactly what a supervisory authority asks about first.
Further reading
- Article 28(1) and (3) GDPR, Article 4 nos. 7 and 8 GDPR
- Article 13 GDPR, Article 30 GDPR, Article 35 GDPR
- Section 26 BDSG
This is not legal advice; for a specific case at your workplace you are better off asking someone qualified to give it.
Published by: AMNAU GmbH
Editorial responsibility: Ugur Aydogan, Product development.
Last reviewed: September 2026
Knowing the terms is one thing. Settling them cleanly is another.
MetronHR keeps time accounts, calculates premiums and checks the limits of the German Working Hours Act automatically. Try it free for 14 days.
No credit card, cancel any time
Related terms
Works agreement
A works agreement is a written agreement between the employer and the works council. It applies directly and mandatorily to all employees of the business.
Codetermination
Codetermination means a measure requires the works council's consent. For working time it is governed by section 87(1) BetrVG and is enforceable.
Record-keeping duty
The record-keeping duty is the duty to record working times. It follows not from one provision but from several that differ in scope, deadline and addressee.