Who Sees the Punch Data

The attendance record is unremarkable. The coordinates beside it are a different category, and most deployments give both to the same people.

What each audience needs

The worker: their own punches, including flags and corrections.

The supervisor: who is clocked in now, and the exceptions needing a decision.

Payroll: times and sites, not coordinates.

Whoever investigates a dispute: the coordinates and accuracy figure for the specific punches at issue.

Nobody needs a map of everyone's arrivals, and several products provide one by default.

The design

Coordinates behind a deliberate action that records why, not displayed alongside every punch in the normal view.

The normal view shows accepted or flagged, which is what a supervisor needs to act.

Payroll sees an export without positions.

And reads are logged, because the question after any misuse is who looked.

Why this matters more than it seems

A punch position is usually the workplace, which is uninteresting.

Until someone punches from home by mistake, which happens, and then their home address is in the record.

Or punches from a hospital car park on the way in, which reveals something they did not choose to share.

The coordinates are occasionally sensitive and routinely unnecessary, which is the argument for putting them behind a click and deleting them early.

The worker's own view

Their punches, with the flag status and the reason.

The accuracy figure, which is what lets them understand a refusal rather than feeling arbitrarily blocked.

A correction route they can use themselves.

Ideally, when their data was accessed and by whom — rare in products at this price point, and worth asking for.

The review

Quarterly, twenty minutes.

Who holds each capability, checked against their current role.

Sample the access log: does each look at coordinates map to a stated purpose?

Look for browsing: repeated access to one person, access with no associated dispute.

Report the result including a clean one, which is what makes the control visible to the people it protects.

What to ask a vendor

Can coordinates be hidden from the default view?

Are reads logged?

Can payroll export be produced without positions?

Can a worker see their own punches and flags?

Products vary, and the answers tell you what the product assumes about who this data is for.

Coordinates behind a click

A configuration choice with a large effect.

The normal view shows accepted or flagged, which is what a supervisor needs.

Coordinates appear only when someone opens a specific punch, and the access is recorded.

Because the position is usually the workplace and occasionally a home address, and the occasional case is the one that matters.

Turn the principle into a test

For an example that can make this requirement testable, consult the remote-team use case. Treat the page as a starting point rather than proof and reproduce the workflow with real roles and failures.

Independent reference

For an external point of reference, see the National Cyber Security Centre. Use this established source as an external check before turning the principle into a workplace rule.