What to Keep and For How Long

A punch produces two things that look like one: a fact about attendance and evidence supporting it. They do not need keeping for the same length of time.

The two records

The attendance record: who, which site, what time, accepted or flagged.

The verification data: coordinates, accuracy figure, method used, whether a mock-location flag was set.

The first is a payroll record and carries the retention that payroll records carry — usually years, set by statute.

The second is evidence, needed until the timesheet is approved and any dispute closed. Weeks.

The design

Keep the attendance record for the statutory period.

Delete the coordinates on a short schedule — long enough to resolve disputes, short enough that you are not holding a year of everyone's arrival positions.

Keep the accuracy figure longer than the coordinates if you can, because it explains a refusal without recording a place.

This separation is available in better products and is worth asking for by name, because it satisfies both obligations simultaneously.

Setting the periods

Coordinates: until the pay period closes plus a dispute window. Commonly a few months.

Attendance records: the payroll retention for your jurisdiction.

Refusal logs: the same as coordinates, since they serve the same purpose.

Corrections and their reasons: with the attendance record, because they are part of the pay explanation.

Write the numbers down, because "as long as necessary" is not a period and will not survive a question.

Deletion that happens

Automated, because manual deletion does not occur.

Verified: try to retrieve something past its period and confirm it is gone rather than hidden.

Including backups and the vendor's copy, which needs to be in the contract.

Including exports, which is the leak nobody tracks: a month of punch data downloaded to a spreadsheet sits outside every control.

What to check

What is the configured retention, and was it chosen or defaulted? Defaults in this category are commonly indefinite.

Can coordinates be deleted independently of the attendance record?

Has a deletion actually run, and did anyone verify it?

Does the vendor's retention match yours?

The argument for short

Beyond the legal one.

A shorter period makes every subject access request smaller and easier.

It reduces what a breach exposes.

And it removes the temptation to answer questions the data was not collected for — a year of arrival positions invites analysis that a month does not.

Separate the two records

The design that satisfies payroll and minimisation at once.

The attendance record — who, where, when, accepted or flagged — carries payroll retention.

The coordinates carry a dispute-window retention, measured in weeks.

Ask whether the product can delete one while keeping the other.

Better ones can, and it is worth asking for by name because it is rarely the default.

An implementation prompt

During configuration, view this scope example can prompt questions about fields, ownership and output. Confirm current capabilities and document each plan, integration or policy assumption.

Independent reference

For an external point of reference, see the Information Commissioner's Office. Its published guidance provides useful context for testing the assumptions in this note.