Can my employer force me to clock in on my personal phone?

When a company rolls out a time-tracking app, sooner or later someone on the team asks whether they have to install it on their own phone. As a general rule, the company cannot require staff to clock in on their personal phones. The Workers’ Statute makes the company responsible for the working-time record, a 2021 Supreme Court ruling struck down a system that required workers to use their own phones, and the Spanish Data Protection Agency (AEPD) fined a company this year for something similar. A personal phone can only be used if the worker agrees and still has another way to clock in.

Quick answer

What the company does	Is it legal?
Requires workers to install the app on their own phones and offers no other way to clock in	No. The company has to provide the means to clock in.
Uses an app that tracks the worker’s location throughout the working day	No. It collects more data than necessary (art. 5.1.c GDPR).
Offers clocking in on a personal phone as a voluntary option, with an alternative, and covers the cost	Yes, if it is proportionate and staff have been informed in advance.
Has a terminal, kiosk or web clock-in and requires staff to use it	Yes. Refusing to use your own phone does not exempt you from clocking in.
Requires the app on the personal phone of someone who works remotely on a regular basis	No. Art. 17.2 of Law 10/2021 prohibits it.

Who has to provide the means to clock in

Article 34.9 of the Workers’ Statute states that “the company shall guarantee the daily record of working hours”. The company designs the system and bears its cost. The same article requires the system to be organised through a collective agreement, a company agreement or, failing that, a decision by the employer after consulting the workers’ legal representatives.

Behind this lies ajenidad, the principle that defines salaried employment in Spanish law (art. 1.1 of the Workers’ Statute). The tools of the job are supplied by whoever organises the work and keeps what it produces. A personal phone, with its data plan and its wear and tear, is not one of those tools. Imposing it without agreement shifts onto the worker a cost that the law places on the employer.

The employer’s monitoring power under article 20.3 of the Statute allows it to check that workers keep to their hours, with “due consideration for their dignity”. When that monitoring reaches into a private device, it also clashes with the right to privacy in article 18 of the Spanish Constitution, because that phone holds the worker’s private life, from photos to conversations. Article 87 of the LOPDGDD (Spain’s data protection act), which governs digital devices in the workplace, applies to devices provided by the employer. There is no equivalent rule for personal phones, so the framework comes from the right to privacy, case law and, for remote work, an express prohibition.

What the Supreme Court said about personal phones

There is no Supreme Court ruling on clocking in as such, but there is one on the closest comparable case. Telepizza launched its “Tracker Project”, which required delivery riders to install an app that geolocated orders on their personal phones, in exchange for a monthly allowance. The National High Court (Audiencia Nacional) struck it down in 2019, and the Supreme Court upheld the annulment in STS 163/2021 of 8 February.

Three of the ruling’s arguments carry straight over to a clock-in app:

• There were less intrusive ways to achieve the same goal, such as a GPS unit on the motorbike or a wristband, so the measure failed the proportionality test. For clocking in, that less intrusive option is a terminal or web clock-in.
• It was introduced without informing or consulting the workers’ representatives.
• The compensation did not save it. The Supreme Court accepts that employer and worker may agree that the worker contributes their own tools, but it stressed that “what is being examined here is not an agreement, but a project implemented unilaterally”.

The Spanish Data Protection Agency takes the same line. Its guide on data protection in employment relationships states that “it is not lawful to impose on the worker the obligation to provide personal means to facilitate geolocation”, giving the mobile phone as an example. In 2026 it fined a large ride-hailing (VTC) company €200,000 for making its drivers use their own phones with apps that collected more data than necessary. The company did offer a company phone, but only “subject to the availability of resources”, and for the AEPD that was enough to conclude that the drivers’ consent was not freely given. If the alternative depends on phones being available, nobody can genuinely say no. An agreement to use personal phones only holds up if the alternative is available from day one.

With remote work there is even less leeway. Article 17.2 of Law 10/2021 on remote work prohibits employers from requiring workers to install programs or apps on devices they own, or to use those devices for remote work. It applies to regular remote work, meaning at least 30% of working time over a three-month period.

What data a clock-in app on a phone can collect

A clock-in app can stick to recording start and finish times. It can also ask for access to location, the camera or contacts, or track the worker’s position all day. The GDPR’s data minimisation principle (art. 5.1.c) only allows processing of the data needed for the purpose, and here the purpose is proving when the working day begins and ends.

Article 90 of the LOPDGDD allows geolocation within the monitoring powers of article 20.3 of the Workers’ Statute, provided workers and, where applicable, their representatives are informed in advance, expressly, clearly and unambiguously. Storing the location at the moment of clocking in, to check that the worker is at the workplace, is defensible if staff have been informed and it is limited to that moment. Tracking employees throughout the working day, or outside it, turns the time record into surveillance, and in the drivers’ case the AEPD’s fine was for breaching the minimisation principle. You can read more about data protection in time tracking and whether clocking in by geolocation is legal.

How to organise clocking in without imposing personal phones

One possible setup, with the personal phone as just one more option, and a voluntary one:

• A shared terminal or kiosk at the entrance.
• Web clock-in from the work computer, for those who have one.
• An app on a company device for sales reps, travelling staff or people on building sites.
• An app on the personal phone only for those who want it, with any costs compensated and no data beyond the time and, at most, the location at the moment of clocking in.

With several channels, anyone who does not want to use their phone clocks in another way and the company stays compliant. That does not exempt them from clocking in. If the company offers alternatives and the worker refuses to use any of them, they are disobeying instructions (art. 5.c of the Workers’ Statute). The High Court of Justice of Castilla-La Mancha upheld the dismissal of a worker who refused to clock in even though he had three systems available to him.

How we approach it at Cleverfy

In time-tracking software such as Cleverfy, web clock-in, a PIN kiosk and the app work side by side, and each company switches on the ones it needs. The app does not track location in the background. If the company enables geolocation, the location is only captured when someone clocks in, starts a break or clocks out. Consulting the workers’ representatives and, if personal phones are used, compensating the cost remain the company’s responsibility.

The draft of the new Royal Decree on time tracking, still awaiting publication in the BOE (Spain’s Official State Gazette), would require the record to be digital, accessible and tamper-proof, and the option that needs the least investment is an app on each worker’s phone.

Try Cleverfy free for 14 days → · See plans from €1.20/user/month →

---

Legal note: informational article, not legal advice. Based on articles 1.1, 5.c, 20.3 and 34.9 of the Workers’ Statute, articles 87 and 90 of the LOPDGDD, article 5.1.c of the GDPR, article 17.2 of Law 10/2021, STS 163/2021 (the Telepizza case) and the AEPD’s guide on employment relationships. For a specific case, check your collective agreement and consult a professional.

Sources:

• Workers’ Statute, Art. 34
• LOPDGDD, Art. 90 (geolocation)
• Law 10/2021 on remote work, Art. 17
• CGPJ, the Supreme Court upholds the annulment of Telepizza’s project (STS 163/2021)
• AEPD, guide on data protection in employment relationships (in Spanish)
• AEPD, resolution PS/00454/2024