Few industries in Germany have their working time monitored as closely as private security. At the same time, paper timesheets are still the norm in many places, filled in from memory, days after the shift. This article lays out the German legal position and shows how digital, GPS-based time tracking works without becoming a data protection problem.
The record-keeping duties at a glance
- Minimum Wage Act: The security industry is one of the sectors named in § 2a of Germany's Act to Combat Illicit Employment (Schwarzarbeitsbekämpfungsgesetz). That means § 17 of the Minimum Wage Act (MiLoG) applies: the start, end and duration of daily working time must be recorded no later than the end of the seventh calendar day, and retained for at least two years. Violations can be fined up to €30,000, enforced by German customs' illicit-work unit (Finanzkontrolle Schwarzarbeit).
- Working Hours Act: Working time exceeding eight hours on a working day must be recorded (§ 16 para. 2 ArbZG).
- Case law: Germany's Federal Labour Court ruled in 2022 (1 ABR 22/21) that employers are obliged to introduce a system that records the entirety of working time, implementing the European Court of Justice's 2019 ruling.
Why paper and spreadsheets are risky
- Timesheets filled in after the fact are imprecise, and hard to defend during a customs audit.
- Transcription errors when re-typing into payroll are the rule, not the exception.
- Proving to a client that a post was actually staffed is hard to do with paper.
- The seven-day deadline under § 17 MiLoG is easily missed once you're relying on collected paper slips.
GPS time tracking: how it works
With GPS-based time tracking, employees clock in and out via a smartphone app at the site. The app checks, at the moment of clocking in, whether the device is within a defined radius of the site. The result: minute-accurate, server-side verified times, immediately visible to dispatch, as the basis for timesheets, bonus calculation, and proof of staffing for the client.
And GDPR?
Using GPS in an employment relationship is permitted under German data protection law if a few principles are followed:
- Data minimization: Location is only checked at the moment of clocking in and out. Continuous tracking during a shift is neither necessary nor proportionate — German labor courts have repeatedly objected to permanent tracking.
- Transparency: Employees must be clearly informed in advance what data is collected, when, and for what purpose (Art. 13 GDPR).
- Data processing agreement: A data processing agreement with the software provider is required (Art. 28 GDPR); a server location in Germany considerably simplifies the assessment.
- Co-determination: Where a works council exists, it must be involved when introducing technical systems capable of monitoring behavior or performance (§ 87 para. 1 no. 6 BetrVG).
GuardEinsatz implements exactly this model: location is checked only at clock-in, a data processing agreement is included, and access is role-based. Recorded times flow directly into the night/Sunday/holiday bonus calculation and the payroll export. What the app looks like for employees is shown on the GuardEinsatz mobile app page.