How to Implement a Digital Time Clock in Your SME (2026)

Most Portuguese SMEs already know that recording working time is mandatory. What few people realise is that, in 2026, almost nobody needs to buy a physical time clock terminal to comply with the law. A phone is enough.

This guide is for those who have already read what Article 202 says and want to know, in concrete terms, how to move from paper or Excel to a digital system without complications. Five steps, clear GDPR rules, and what to choose between biometrics, software with geolocation, and magnetic cards.

If you are not yet familiar with the legal obligation in detail, start with Time Clock Records Are Mandatory in Portugal (2026). This post focuses on practical implementation.

Quick recap of Article 202

Article 202 of the Portuguese Labour Code (Law 7/2009) requires every employer to keep a record of employees’ working time, in an accessible place and in a format that allows immediate consultation. The rule applies to companies of any size, from the first worker.

The record must include the start and end times of work, along with breaks and interruptions. It must cover all workers, including those exempt from fixed hours and those working remotely. The data must be retained for five years (Article 202(4)).

For workers performing work outside the company, Article 202(3) requires the company to receive the record signed by the worker within 15 days of the work. A digital record made at the time solves this without paper going back and forth.

Breaching Article 202 is a serious administrative offence, with fines calculated in Units of Account (UC). In 2026, the UC value remains at €102 (Article 242 of Law 73-A/2025, which approved the 2026 State Budget).

Fines in 2026: what you are risking

Fines vary with the company’s turnover and the degree of fault (negligence or intent). For an SME with turnover below €500,000, the amounts set out in Article 554 of the Labour Code are:

Degree of fault	Fine (serious administrative offence)
Negligence	€612 to €1,224 (6 to 12 UC)
Intent	€1,326 to €2,652 (13 to 26 UC)

Calculated on UC 2026 = €102, set by Article 242 of Law 73-A/2025 (2026 State Budget).

The ranges rise with turnover. For companies with turnover of €10 million or more, the fine for intent can reach €9,690. Where the offence affects several workers, the maximum fine can double (Article 558).

In 2026, Regulatory Decree 2/2026 restructured the ACT and added to its remit ensuring the interconnection of data relevant to inspections with the Tax Authority, Social Security, the employment services and the Registries and Notary Institute.

Options on the market: biometrics, software or cards

In 2026, there are essentially three families of time clock solutions. Each has clear trade-offs.

Physical biometric terminal

These are terminals with a fingerprint, facial or iris reader, installed at the company entrance. The worker presses a finger or presents their face and the system records the clock-in and clock-out.

Advantages: they make fraud difficult (no clocking in for a colleague), they work without a network, and they are robust enough for industrial settings.

Disadvantages: an upfront cost per terminal, plus installation and maintenance. They do not work for remote work. They require a DPIA (Data Protection Impact Assessment) and strict compliance with Article 28 of Law 58/2019, with important restrictions I detail below. In distributed companies, you need one terminal per location.

Software with geolocation (mobile-first)

The worker installs an app on a personal or company phone. When clocking in, the app captures the GPS coordinate to confirm they are at the right location. The entry is recorded in the cloud with a timestamp.

Advantages: no hardware, low cost per employee, works for remote work, on site, and in the field. Setup in minutes. Auditable, immutable logs. It does not collect biometric data, which reduces the regulatory burden.

Disadvantages: it depends on the worker having a phone with GPS and mobile data. It does not rest on consent (in an employment relationship, consent is rarely freely given), but it requires clear information to the worker and clear rules on when GPS is captured (only at the moment of clocking, never continuously). It implies an internal policy on the use of personal phones (BYOD) if the company does not provide the device.

Magnetic card or fob

The classic card system the worker swipes on a reader. Cheaper than biometrics, but functionally similar for on-site work.

Advantages: low upfront cost, no biometric data. It is still personal data processing under the GDPR, but with fewer requirements.

Disadvantages: cards get lent out and lost. It does not cover remote work. It still requires a terminal per location.

For most Portuguese SMEs mixing on-site and remote work, time clock software with geolocation is the sweet spot between cost, flexibility and compliance. Biometrics only pays off in industrial environments with high turnover and a real risk of fraud.

Rolling out a digital time clock in 5 steps

This is the checklist I recommend to any SME moving from paper or Excel to a digital system.

Step 1: Choose a vendor

Before signing a contract, confirm these points:

• The system records start, end, breaks and interruptions (the legal minimum).
• It exports the monthly time sheet in a format your accountant uses, such as Excel.
• It retains data for five years at no additional cost.
• The logs are immutable (nobody in the company can edit records retroactively without leaving a trace).
• The vendor is based or represented in Portugal, or at least uses sub-processors in the European Union, to ensure GDPR compliance on data transfers.
• There is a free trial of at least 14 days.

Step 2: Configure the team

Before asking employees to start using it, get organised:

• A list of employees with their expected schedule and rest day.
• Departments and workplaces.
• Shift types where applicable (rotating, split, night).
• Relevant national and municipal public holidays.

The cleaner this initial configuration, the fewer corrections you will have to make later.

Step 3: Short training for the team

Despite everything being called “training” these days, for a digital time clock five minutes per employee is enough. Show them how to open the app, clock in and out, and what to do when they forget. A short video or an in-person demo. You do not need a room or a certificate.

What does need to be recorded is the formal communication to workers about the purpose of the data processing, especially where geolocation is involved. More on that in the next section.

Step 4: A one-week trial period

Launch as a pilot for a week, ideally with one department or team, before rolling out broadly. Objectives:

• Spot workflows you had not anticipated (multiple breaks, lunches off-site, and so on).
• Confirm the monthly reports come out as you need them.
• Gather feedback from the team on friction in the daily flow.

At the end of the week, adjust the configuration and roll out to everyone.

Step 5: Integration with accounting

The big operational gain comes here. At month end, export the time sheet and send it straight to your accountant. With TeamYo (Pro plan), the time sheet is emailed to your accountant, in Excel, on the day of the month you choose, between the 1st and the 28th.

If the vendor does not do this, you are missing one of the biggest advantages of going digital. Manually reformatted spreadsheets remain an enormous source of error.

GDPR and biometric data: the essentials

This is the section most people underestimate. GDPR rules on attendance data are not complicated, but failing one of them can wipe out the whole advantage of the digital system.

The difference between geolocation and biometrics

These are two completely different regimes.

Geolocation (a GPS coordinate at the moment of clocking) is ordinary personal data under the GDPR. Recording working time is a legal obligation (Article 202), but the law does not require GPS, so collecting it must be necessary and proportionate to its purpose. The CNPD (Portugal’s data protection authority) takes a restrictive view: its 2014 guidance considers phone geolocation for managing field work excessive, and its 2020 remote work guidance does not accept software that logs the device’s location in real time. Geolocation can never be used to monitor performance (Article 20 of the Labour Code). If you want to use GPS for clocking, check with your lawyer or data protection officer first.

Biometrics (fingerprint, facial recognition, iris) are a special category of data under Article 9 of the GDPR, with a general prohibition on processing. Article 28(6) of Law 58/2019 opens an exception for attendance control and access control, but under strict conditions: you may only use biometric representations (templates) and the process must not allow the data to be reversed.

When you need a DPIA

A Data Protection Impact Assessment is mandatory in the cases set out in Article 35 of the GDPR and in the CNPD’s list (Regulation 1/2018), which includes biometrics used to identify vulnerable people, such as employees, and location tracking used to evaluate or classify people. For biometric clocking, expect to need one. For geolocation captured only at the moment of clocking, assess it case by case and document the decision.

Data retention

Time clock records must be retained for five years (Article 202(4)). But note: that period applies to the working time record. Raw biometric data (fingerprints, facial data) cannot be retained indefinitely and cannot be used for other purposes. When an employee leaves, biometric templates must be deleted.

What you have to communicate to workers

Before implementing, communicate in writing:

• The purpose of the processing (complying with Article 202, managing attendance).
• The legal basis (compliance with a legal obligation for the record; legitimate interest, if you use GPS).
• The data collected (timestamp, GPS, identifier).
• The retention period (five years).
• The worker’s rights (access, rectification, objection).
• The data protection officer, where applicable.

This can go in an addendum to the contract or in an internal privacy policy. Without this step, the processing is vulnerable to challenge.

Special cases

Some situations come up repeatedly during implementation. It is worth settling them before you start, not after.

Remote work

Recording also applies to remote workers, with the same working time and rest limits. In practice, the mobile or web app has to be available to the employee from home, and monitoring has to be proportionate: the law forbids requiring a permanent image or sound connection.

Interns

Curricular internships (part of initial education) and professional internships (after qualification) follow different regimes. A curricular intern is not an employee, but keeping an attendance record is good practice for the purposes of the protocol with the education provider. A professional internship is not an employment contract either, but under the IEFP’s ATIVAR.PT internships the host organisation must keep an attendance record for the intern, which supports the funding payments. When in doubt, record.

Workers exempt from fixed hours

Depending on the form agreed, an exemption from fixed hours can release the worker from the maximum limits of the normal working period (Article 219), but not from the recording obligation. Article 202 is explicit: the employer must keep working time records for workers who are exempt from fixed hours.

Temporary agency work

In temporary agency work, the employer is the agency, but during the assignment the user company sets the schedule and applies its own working time rules (Article 185(2) and (3)). In practice, the user company is the one that sees clock-ins and clock-outs, so set out in the assignment contract who keeps the record and how the data reaches the other party. If you take on agency workers, the safest course is for your system to cover them.

Frequently asked questions

Conclusion

In 2026, a digital time clock has stopped being an optional upgrade and become the reasonable minimum. Portuguese SMEs still relying on paper or Excel risk fines, lose hours every month reformatting data for their accountant, and are left exposed in disputes over overtime.

The choice of system matters less than the discipline of the rollout: a vendor with auditable logs, a clean team configuration, short training, a trial week, integration with accounting. Five steps. One week, in most cases.

On GDPR: geolocation carries less weight than biometrics, but it is not free of rules: only at the moment of clocking, with clear information to the worker, and checked with your lawyer or data protection officer. Biometrics only where there is a clear use case, and always with a DPIA and non-reversible templates.

For the full legal detail, see Time Clock Records Are Mandatory in Portugal (2026). For the operational side, this guide is enough.