What regulation 9 says.
Northern Ireland has its own regulations, and the 2024 change doesn’t apply there.
What a practice should still keep.
- The written opt-outs from the 48-hour average, for anyone who has signed one.
- Enough to show each person’s average hours over 17 weeks: rotas plus a record of changes, or timesheets.
- Night workers’ hours, and the health assessments offered to them (regulation 7).
Fingerprints and faces: only if necessary, never the only option.
In February 2024 the ICO ordered Serco Leisure to stop using facial recognition and fingerprints to clock in more than 2,000 staff at 38 sites: it was neither necessary nor proportionate when a card would do, and no alternative was offered (enforcement notices). The ICO’s guidance on biometric recognition (February 2024) sets out the same test. For a practice: biometrics only if they are truly necessary and proportionate, and never as the only option; a card, a code or an app usually does the job.
A rota is not a record.
The rota says who should work; records say who did. If you rely on rotas to show the 48-hour average, keep the version that actually happened, swaps and late finishes included.
And Djed?.
Djed builds the rota: who works when, on-call included, and keeps published rotas unchanged unless you decide otherwise. In the UK it doesn’t keep working time records or clock-in data. To choose a rota tool, read our guide to choosing rota software.
Sources and date checked.
- Working Time Regulations 1998, regulation 9, as amended by SI 2023/1426 from 1 January 2024.
- ICO, enforcement notices to Serco Leisure (February 2024).
Texts checked on 5 October 2026. This guide is not legal advice: for your own situation, speak to your HR or employment adviser.
Frequently asked questions.
Do UK employers have to record daily working hours?
Not since 1 January 2024, if they can show compliance with the 48-hour average and night limits another way (regulation 9, as amended). Records must still be adequate and kept for 2 years.
Can a practice use fingerprints to clock staff in?
In 2024 the ICO ordered Serco Leisure to stop facial recognition and fingerprint clocking: not necessary or proportionate when a card would do. Use cards, codes or an app.