Securing the Punch Data
A record of when each person arrives at each site, and where they were when they did. What a breach here exposes.
Running it · Procedure
Attendance data looks dull until you consider what a full year of it describes about one person.
What it reveals
A pattern of daily movement: what time they leave home, which site they work at, which days.
Which is enough to know when a house is empty, and when a person can be found.
Coordinates occasionally include a home address, from a punch made by mistake.
And for multi-site workers, a list of the addresses they visit — which in care work identifies people receiving care.
A breach here is a safety matter for the people in the records, not only a compliance event.
The controls that matter
Multi-factor authentication on any account that can see punch data. The highest-return control here and frequently absent in small deployments.
No shared logins, which are common at site level and make the access log meaningless.
Session timeouts, because an unattended screen in a back office is the commonest real exposure.
Prompt removal on departure, including the vendor's support accounts.
Read logging, which is both a privacy control and how misuse is detected.
The vendor's side
Where is the data processed and stored?
Who at the vendor can see it, and is that logged?
Breach notification commitment, in hours.
What happens to the data on termination.
Get these in the contract. This data is theirs to lose as much as yours.
The domestic abuse case
Worth naming explicitly, because it is the one that causes real harm.
An abusive partner working at the same employer, or able to influence someone who does, can learn a person's daily pattern from this system.
Which is an argument for restricted access, read logging and no shared accounts.
And for a documented procedure to restrict access to a particular person's records where there is a safety concern.
Most organisations have never considered this, and it takes an afternoon to arrange.
What to check
Is MFA enforced?
Are there shared site accounts?
When was access last reviewed?
Are reads logged, and does anyone look?
Could a worker ask for their records to be restricted, and does anyone know how?
The restriction procedure
An afternoon of preparation for a rare and serious situation.
A documented way to restrict access to one person's records where there is a safety concern.
Who authorises it, who implements it, how quickly.
Because the person who needs it will be asking under pressure, and "we have never done that" is the wrong answer at that moment.
Connect policy to configuration
The practical choices behind this note can be compared with inspect this service connection. Keep the written purpose in control and enable only the data needed for it.
Independent reference
For an external point of reference, see the NCSC website. Consult the current material directly because technical and legal details can change.