The Records as Personal Data

General orientation, not legal advice.

Timestamp records are unremarkable individually and revealing in aggregate.

What you are holding

When each person arrives and leaves, every day.

Which over a year describes a commute, a caring arrangement, a health pattern, a religious observance, by inference.

Corrections and their reasons, which sometimes contain health information.

Photographs, where those are used, and stored facial data where matching is used.

The four obligations

Say what you hold and why, in a paragraph people can read.

Keep it to what the purpose needs. Times and sites, not reasons beyond a category.

Limit who sees it. Supervisors see their own team; detailed records require a reason.

Delete on a schedule, per category, with the statutory retention respected and nothing held beyond it.

Where investigations go wrong

Browsing. Pulling a year of someone's records to see what turns up is disproportionate, and it converts a sound case into one that looks like a search for a reason.

Scope creep. An investigation into one week that becomes an examination of everything.

Record the authorisation, the scope and the reason before looking, which takes a minute and is the difference between a lawful check and a fishing expedition.

Access requests

People can generally ask for what you hold, and attendance records are commonly requested — usually during a dispute.

Which means the records need to be retrievable per person and free of anything you would rather not show them.

A note saying "suspicious again" is disclosable and reads exactly as it sounds.

Write records as though they will be read, because in this subject one eventually will.

Retention

Driven by the longest applicable obligation, which for pay records is usually years.

Photographs and biometric data much shorter, and deleted on departure.

Investigation material under its own rule, with a hold so it survives routine deletion while a matter is live and is deleted when it closes.

The test

Could you produce everything you hold about one person, today, and be comfortable doing so?

If no to the first, the records are disorganised.

If no to the second, something is in there that should not be, and finding it now is cheaper than being asked for it.

Record the authorisation

One minute that separates a lawful check from a fishing expedition.

Who decided to look, when, at what scope, and why.

Before looking, not afterwards.

Because an examination of a defined period for a stated reason is defensible, and a browse through someone's year is not — and the two look identical in the data unless the record exists.

Reproduce the workflow

For another way to make this requirement testable, consult the professional-services use case. Reproduce the case with real roles, codes, failures and recovery steps.

Independent reference

For a thematic point of reference, see the European Data Protection Board. Consult the source directly because technical, operational and legal details change.