There is no single rule governing how employers record the hours their staff work: there are several. They sit in different pieces of legislation, they are enforced by different bodies, and they ask for different things over different periods.
That matters more than it sounds. An employer can be confident about one obligation and exposed on another without realising the two were ever separate. And one of them changed this year.
Working Time
The Working Time Regulations 1998 require employers to keep adequate records showing whether the limits on working time and night work are being complied with. In practice that means being able to demonstrate compliance with the 48-hour average weekly limit for anyone who has not opted out, holding copies of opt-out agreements where they exist, and recording night work hours along with the associated health assessments. Night work limits are enforced by the Health and Safety Executive rather than through employment tribunals.
The regulations do not prescribe a format, a system or a dataset, and they do not expressly require daily time recording. That sounds like leniency, and it is easy to think of it as one less thing to worry about. However, it works the other way. Had the law set out exactly what to record, keeping to that specification would be a defence in itself. Because it does not, there is no method an employer can point to and say it followed the rules. What gets examined instead is whether the records it happens to hold are enough to prove compliance – and that is judged afterwards, by someone else.
Holiday Records, New Since April 2026
This is the newest duty and the one most likely to catch employers out, because until this year it did not exist. Most employers were required to keep working time records but not records showing they had met their obligations on holiday.
Section 35 of the Employment Rights Act 2025 changed that. From 6 April 2026, every employer must keep adequate records showing that workers received the correct amount of annual leave, that holiday pay was calculated correctly, and that any payment for unused statutory leave on termination was made properly. Records must be retained for six years from the date on which they were made.
Failing to keep them is a criminal offence in its own right, punishable by a potentially unlimited fine. That is separate from the question of whether any holiday pay was actually underpaid.
Enforcement sits with the Fair Work Agency, which launched on 7 April 2026. Its powers over holiday duties are being phased in rather than applied from day one, and it will be able to issue notices of underpayment covering a six-year period. There is no detailed guidance yet on what counts as adequate in this context, so for now employers are making their own judgement about what to keep and in what form.
National Minimum Wage
Minimum wage records must be kept for six years. The feature that matters here is the burden of proof, because it runs the opposite way to what most people expect. Where a worker brings a claim, the employer is presumed not to have paid the minimum wage unless its records demonstrate otherwise.
The exposure this creates is greatest for salaried staff whose hours are not recorded at all. An employer can be paying comfortably above the minimum and still be unable to prove it, because proof depends on knowing how many hours were actually worked rather than how many were contracted. Penalties run to 200 per cent of the underpayment, capped at £20,000 per affected worker.
PAYE
PAYE records must be retained for the current tax year and the three previous ones. That is shorter than the rest, which is worth noting for a practical reason: any organisation trying to align its retention policy to a single period will find that period is six years, not three.
What This Means in Practice
Two things stand out across all of it.
The first is that none of these obligations prescribes a system. The law asks for records that are adequate and that can be produced when required. A spreadsheet can satisfy that. So, in principle, can paper.
The second is that adequacy is tested after the event, in circumstances where an employer would generally prefer not to be tested. What fails at that point is the evidence, hours that were never captured, breaks assumed rather than recorded, salaried staff left out of time recording altogether because it was assumed the rules did not apply to them. The obligation is not to have a view about what happened. It is to be able to show it.
There is also a tension worth naming. Six years is a floor for retention, not a licence, and UK GDPR still requires that personal data is kept no longer than is necessary. The two are reconcilable – the legal obligation is what makes the retention necessary – but a retention policy needs to say so, and it needs to distinguish between the records the six-year duty actually covers and everything else that happens to sit in the same system.
Where a Timeclock Fits
A timeclock does not create compliance on its own. Holiday entitlement and pay are calculated in the HR and payroll system, and that is where the six-year record ultimately lives.
What a terminal does is capture the underlying events accurately, at the moment they happen and at the place the work starts and finishes. A GT8 records who was present and when, at the point of clocking, and passes that to the workforce management system behind it. The value is in having a consistent, timestamped account of attendance that was created at the time rather than reconstructed afterwards, which is the difference between holding records and holding records that answer the question.
Find Out More
To discuss workforce time recording and how our terminals would fit your organisation, contact our team on 01202 621700 or at hcmsales@grosvenortechnology.com.