The Legal Position
Location at the moment of clocking is narrow, which helps. What still applies, and the two points where deployments go wrong.
Legal · Reference
General orientation, not legal advice; requirements differ substantially by jurisdiction.
Checking position once, when someone taps a button, is one of the least intrusive uses of location data. That does not make it unregulated.
What applies
Location is personal data, and processing it needs a basis.
Consent is weak in employment because it cannot be freely refused, which rules out the basis most apps ask for.
Legitimate interests is the usual route, with a documented balancing test: the interest, why the processing is necessary, the effect on workers, and why the interest is not overridden.
An impact assessment is likely required where location monitoring is systematic, and a clock-in check applied to a whole workforce generally qualifies.
Consultation may be a legal requirement, and works council agreement is a precondition in several jurisdictions.
Why the narrow version helps
A single position at the moment of a deliberate action is far easier to justify than continuous tracking.
It is initiated by the worker, which matters to the analysis.
It answers one question and stores one point.
Say this explicitly in the assessment, because it is the strongest thing about the design and it distinguishes the deployment from the fleet-tracking cases that produce fines.
The first place it goes wrong
Background collection.
If the app can see location when it is not being used, the narrow justification disappears and the deployment is continuous monitoring with a clock-in feature.
Check what permission the product requests and what it does between punches.
Ask the vendor directly and verify it: leave the app closed for a day and see what arrives.
The second place it goes wrong
Retention.
The operational need is until the timesheet is approved and any dispute resolved — weeks, not years.
Products commonly default to keeping every punch position indefinitely.
Set a period per data category: the punch time and site are the payroll record; the coordinates are the verification and can go much sooner.
Deleting the coordinates while keeping the attendance record is the design that satisfies both the payroll obligation and minimisation, and it is available more often than people assume.
What to tell people
What is checked, and when.
That it is not checked at other times.
Who can see it.
How long the coordinates are kept.
What happens if the check fails.
One page, in plain sentences, given to everyone — and to new starters as part of joining.
Verify the background behaviour
The check that supports the whole legal position.
Leave the app closed for a day.
Look at what arrived.
Nothing is the answer you need, and it is the sentence that distinguishes this deployment from continuous monitoring.
Repeat after vendor updates, because permissions and background behaviour both change with releases.
A concrete product reference
When translating this principle into a buying test, this resource-planning case provides a concrete workflow reference. Verify current behaviour in a trial and judge it against the purpose and limits above.
Independent reference
For an external point of reference, see the European Data Protection Board. Consult the current material directly because technical and legal details can change.