If you employ people in Spain, you already have to record the start and end time of every working day, keep it for four years, and produce it whenever a worker, their representatives or the Labour Inspectorate asks. That has been true since 2019.
What is changing is how, and the change is more consequential than it sounds.
The three things that are actually different
The record has to be digital, and it has to be tamper-evident. Paper is currently acceptable if it is reliable and cannot be altered after the fact. The reform removes the paper route and requires a digital record with traceability - meaning you can show not just what was recorded, but that it has not been changed since.
The Inspectorate gets remote access, in real time. Today an inspector asks and you produce. Under the reform they can look without asking, from their own office. There is no window in which to tidy anything up, which is rather the point.
Ordinary and overtime hours have to be distinguishable on the record itself. Not derivable by someone with a calculator and your contracts. Visible.
And the one that changes the arithmetic entirely: penalties move from per work centre to per affected employee. A site-level fine is a cost of doing business. The same failure multiplied by forty employees is not.
What this means if you are on paper or a spreadsheet
Paper is the honest case: it is legal today and will not be, so it is a migration with a deadline.
The spreadsheet case is worth being blunt about, because it usually feels safer than it is. A spreadsheet fails the tamper-evidence test now, not after the reform. Anyone with the file can change last Tuesday's clock-out and nothing records that they did. If your defence in an inspection is a file that could have been edited five minutes before you sent it, you do not have a defence, you have a document.
What this means if you already clock in and out digitally
You are most of the way there, and the gaps are usually these:
- Can an administrator edit a past entry silently? If yes, that is the gap. Corrections have to be possible - people forget to clock out - but the original value and who changed it have to survive.
- Can an employee see their own record without asking anyone? The law is unusually firm here: the duty to keep records available cannot be made conditional on anything.
- Is overtime distinguishable, or just implied?
- Can you produce four years? Not "we have a four-year policy" - can you actually retrieve a specific employee's May from three years ago.
What not to do
Do not reach for biometrics because the word "digital" appeared in a regulation. Fingerprint and facial recognition are special-category data under the GDPR and need a justification that convenience does not provide. The reform asks for records that cannot be altered. It does not ask for fingerprints, and reading it that way turns a record-keeping project into a data-protection one.
Equally, do not build a monthly signature ritual and call it done. Signed sheets are a legitimate instrument and Spanish practice expects them, but a month signed off in one sitting evidences nothing about whether anything was recorded daily. Signature and integrity are different problems; the reform is about the second one.
A sensible order
- Establish whether past entries can be silently changed. This is the whole reform in one question. If the answer is yes, everything else is decoration.
- Check an employee can see their own hours without going through a manager.
- Check you can retrieve four years back, by employee, in minutes.
- Then worry about the format of the export. It is the easiest part and the part everyone starts with.
This is a summary, and the final text of the decree is what will bind you. But the direction has been clear for a while, and every item on that list is worth doing whether the decree lands in January or the following January.