What data protection documentation must the shop deliver to its employees upon hiring?

When signing the contract, the shop must deliver to the worker the art. 13 GDPR information notice adapted to the employment context, identifying the controller (the company owning the shop with its CIF), the specific purposes (HR and payroll management, time tracking, occupational risk prevention, where applicable video surveillance of the premises under art. 89 LOPDGDD (Spain's Organic Law 3/2018)), the legal bases (performance of the employment contract, legal obligation in tax and Social Security matters, employer's legitimate interest for business control within art. 20 of the Spanish Workers' Statute), the categories of recipients (external accountant, mutual insurance, bank for payroll, where applicable External Prevention Service), the retention periods differentiated by block and the worker's rights. Additionally, express information on video surveillance is delivered if a system is installed, the digital media use policy if any and specific teleworking agreements where applicable.

How can the shop track employee working time complying with the GDPR?

The shop may implement a time tracking system, as required by art. 34.9 of the Spanish Workers' Statute, based on non-invasive methods: identification with PIN or username and password at POS or time clock terminal, RFID card or fob, employee mobile app with geolocated clocking, login to the management system, scanning a personal QR code or NFC clocking. Any of these options easily meets the time tracking purpose without resorting to particularly invasive processing. Before implementing the system, the worker and the workers' representatives (where they exist) are expressly informed about the chosen method, specific purpose, data processed and periods. The record is retained for four years (art. 34.9 of the Spanish Workers' Statute) and made available to the Labour Inspectorate and the workers themselves. The practical rule is: the simplest clocking tool that does the job is always the preferred solution.

Can the shop have cameras pointed at employees during their work?

Yes, within the framework of art. 20.3 of the Spanish Workers' Statute and art. 89 LOPDGDD. Video surveillance of the work area is allowed when it responds to a legitimate purpose of the employer (premises security, business control within legal limits), provided that the worker and their representatives are expressly, previously and sufficiently clearly informed about the existence of the cameras and their purposes. Covert recording is not generally admissible, nor is installation in toilets, changing rooms or break areas. Use of recordings to verify specific labour breaches is allowed by art. 89.1 LOPDGDD where the worker has previously been clearly informed of the system's existence. Installation without prior information closes the door to disciplinary use, even if the images exist.

How long must the shop retain employee labour data?

Periods are differentiated by block. Employment contracts, payroll, Social Security enrolment and discharge forms and equivalent documentation are retained for the limitation period for claiming Social Security debts (four years, art. 21 of the Spanish General Social Security Act) and for tax obligations arising from payroll (four years, Spanish General Tax Act). In practice, a reference period of four years is used, extendable when there is an open proceeding or pending matter. Occupational risk prevention documentation has its own periods depending on nature (medical examinations, specific training). The time record is retained for four years (art. 34.9 of the Spanish Workers' Statute). Video surveillance recordings, one month (art. 22.3 LOPDGDD), save for delivery to authority following an incident. After the contract ends, unnecessary data are deleted; mandatory ones are blocked and destroyed once all periods expire.

Retail employee data: payroll, time tracking and workplace video surveillance

Physical retail, in addition to processing customer data, manages data of its own workforce: contracts, payroll, time tracking, occupational risk prevention and, in many cases, video surveillance of the premises that also affects the worker. It is an area where the GDPR, the LOPDGDD, the Spanish Workers' Statute and labour and social regulations converge.

This guide explains how to organise the main labour processing operations in retail under the GDPR (Regulation (EU) 2016/679), the LOPDGDD (Spain's Organic Law 3/2018) and arts. 20.3 and 34.9 of the Spanish Workers' Statute, without overengineering or complicating shop life.

Typical labour processing at the shop

A shop with staff usually maintains four or five differentiated processing operations on its workforce:

Processing	Typical data	Legal basis
Hiring and payroll	DNI, bank details, salary, withholdings, family status for tax purposes.	Contract performance (6(1)(b)) + legal obligation (6(1)(c))
Time tracking (art. 34.9 Workers' Statute)	Entry and exit clockings.	Legal obligation (6(1)(c))
Occupational risk prevention	Medical examination data, fitness, training.	Legal obligation (6(1)(c)) + 9(2)(b)/(h) GDPR for health data
Premises video surveillance (affects staff)	Image of the worker in the work area.	Legitimate interest (6(1)(f)) + arts. 22 and 89 LOPDGDD
Internal and operational communication	Corporate email, internal messaging.	Contract performance (6(1)(b)) + legitimate interest (6(1)(f))

Initial labour information to the worker

On hiring, the worker receives the art. 13 GDPR information notice adapted to the employment context, integrated into the onboarding documentation or delivered as a signed annex. Minimum content:

Identity of the controller (the company owning the shop, CIF, registered office) and DPO details if appointed.
Purposes: HR and payroll management, time tracking, risk prevention, business control within the limits of art. 20 of the Spanish Workers' Statute, where applicable video surveillance.
Legal bases: performance of the employment contract, tax and Social Security legal obligation, legitimate interest within the business control admitted by case law.
Recipients: labour advisor, paying bank, accident insurance mutual, External Prevention Service, tax and Social Security authorities.
International transfers if SaaS tools outside the EEA are used (typically yes for corporate email, storage, HR software): Data Privacy Framework or another appropriate instrument.
Retention periods by block.
Worker rights and route to exercise them.
Reference to the right to lodge a complaint with the AEPD (the Spanish Data Protection Authority).

Additionally, where there is a video surveillance system, the express art. 89 LOPDGDD information is delivered, identifying the cameras, specific purposes (premises security; business control within art. 20 of the Spanish Workers' Statute) and rights. This information is accompanied, where applicable, by communication to the legal representatives of the workers where they exist.

Non-invasive time tracking

Art. 34.9 of the Spanish Workers' Statute requires keeping a daily working time record. The shop can comply with simple, non-invasive solutions fully suited to the GDPR:

PIN or username and password at POS or time clock terminal.
Personal RFID card or fob.
Employee mobile app with clocking, possibly with geographic verification of the premises.
Login to the management system or POS as a clocking event.
Personal QR code scanned at an in-shop terminal.
NFC with personal card or tag.

These alternatives meet the time tracking purpose and respect the minimisation principle. Before implementing the system, the worker (and the workers' representatives where they exist) is expressly informed about the chosen method, purpose, data processed and periods. The time record is retained for four years (art. 34.9 of the Spanish Workers' Statute), accessible to the Labour Inspectorate and the workers themselves.

Workplace video surveillance: art. 89 LOPDGDD

Video surveillance in the work area serves a typical dual purpose in retail: premises security and business control within art. 20.3 of the Spanish Workers' Statute. Art. 89.1 LOPDGDD authorises the processing of images to verify the worker's compliance with their labour obligations, provided that:

The worker (and their representatives where they exist) has been informed previously and sufficiently clearly about the existence and location of the system.
The installation responds to the legitimate purpose of security and control and respects the principles of proportionality and minimisation.
Cameras are not installed in toilets, changing rooms or break areas.
The retention period for recordings is one month maximum (art. 22.3 LOPDGDD), save for delivery to authority following an incident.
Covert recording is not the rule; the system is announced. Only in very exceptional and documentary-justified cases is the temporary omission of information allowable, and case law has been especially cautious on this point.

If the worker has not been previously informed of the system, recordings will hardly be usable to verify disciplinary breaches, even if they materially exist. Prior information is not a formality: it is the prerequisite for using images in that area.

"In a shop, time tracking and video surveillance are well managed with very simple tools and a good information document delivered on day one. When problems arise it is usually because the system was installed without notice, or because an image was used a year later without any record that the worker had known about the camera from the start."

Mario P. Talamillo · Managing Partner, Certix®

Processors in labour management

The shop's labour management relies on several providers acting as processors and requiring an art. 28 GDPR contract:

External accountant who runs payroll, keeps the accounts and files tax returns.
External Prevention Service, where outsourced, for health surveillance and prevention plan.
HR and rota management software (SaaS).
Digital clocking tool (app, platform).
Corporate email, cloud storage used to manage labour documentation.
Security company/installer of the video surveillance system with remote access.

For each: full art. 28 GDPR contract, verification of international transfers (Data Privacy Framework where applicable) and data return procedure on service termination before any destruction.

Use of digital media and shop communications

When the shop equips staff with corporate email, POS with login, internal app or operational messaging, it is advisable to establish a digital media use policy under art. 87 LOPDGDD, which regulates digital rights in the labour context. Basic lines:

Clear information on tools, their operational purpose and authorised use criteria.
Information on the possibility of business control within legal and case law limits.
Respect for the right to digital disconnection outside working hours.
Procedure for granting and revoking access on incorporation and departure of the worker.
Basic best practices: do not use personal WhatsApp to send sensitive shop data, individual passwords, session locking.

Retention and blocking after the worker leaves

After the contract ends, the worker's data is not automatically deleted: it is differentiated by block and managed according to legal periods:

Contract, payroll, Social Security forms and equivalent documentation: reference period of four years (Spanish General Social Security Act and Spanish General Tax Act), extendable if there is an open proceeding.
Prevention documentation: own periods depending on nature (medical examinations, specific training).
Time record: four years (art. 34.9 of the Spanish Workers' Statute).
Video surveillance recordings: one month (art. 22.3 LOPDGDD), save for delivery to authority.
Internal communications and corporate email: closure and blocking of the worker's account with defined criteria, safeguarding what may be relevant for operations or pending matters.
After all periods expire, documented secure destruction.

Minimum checklist for a shop with staff

Art. 13 GDPR notice delivered to the worker at incorporation.
Express art. 89 LOPDGDD information where there is video surveillance.
Simple time tracking system (PIN, RFID, app, login, QR, NFC) with prior information to the worker.
Digital media use policy (art. 87 LOPDGDD) where applicable.
Art. 28 GDPR contracts with accountant, External Prevention Service, HR software, clocking, email and video surveillance.
Retention periods documented by block.
Worker offboarding procedure (revocation of access, return of equipment, email management).
Labour processing operations entered in the RoPA.

Frequently asked questions

What documentation must the shop deliver to the employee on hiring?

Art. 13 GDPR information notice adapted to the employment context, express art. 89 LOPDGDD information if there is video surveillance, digital media use policy where applicable and, where relevant, specific teleworking agreement. All kept as evidence of delivery.

How can the shop track employee working time?

With simple and non-invasive methods: PIN, RFID card, mobile app, POS login, personal QR or NFC. Prior information to the worker and to the workers' representatives where they exist. Record retained for four years (art. 34.9 Workers' Statute) and available to the Labour Inspectorate.

Can there be cameras pointed at employees during their work?

Yes, within art. 20.3 of the Spanish Workers' Statute and art. 89 LOPDGDD. Prior and clear information to the worker and their representatives is required. Not in toilets, changing rooms or break areas. Maximum retention of one month. Without prior information, images cannot be used to verify breaches.

How long does the shop retain labour data?

Reference period of four years for payroll, contract and Social Security forms (Spanish General Social Security Act and Spanish General Tax Act). Time record, four years (art. 34.9 Workers' Statute). Recordings, one month (art. 22.3 LOPDGDD). Prevention, own periods depending on nature. After expiry, documented secure destruction.

This content is for informational and educational purposes only and does not constitute legal advice. Applying the regulation to each specific case requires individual analysis. Regional sectoral regulations may extend or modify time limits and requirements.

Want to organise your shop's workforce data?

At Certix we assign you a compliance expert specialised in the retail sector. No commercial intermediaries, no generic templates.

Talk to an expert