TimeTec Attendance<\/a> captures attendance data through biometric devices, mobile clocking (with the phone’s own authentication method), and web clocking. Each clock-in is timestamped and tagged with the reporting channel, showing whether the entry came from a device, mobile, or web browser. GPS location is recorded at the point of mobile clock-in, not continuously.<\/p>\n\n\n\nThis is point-of-event data collection: identity verified and location recorded at the moment of clock-in and clock-out. The data serves a defined purpose (attendance, payroll, compliance) and is captured at specific moments rather than continuously.<\/p>\n<\/div><\/div>\n\n\n\n
But using the right system does not automatically mean compliance with the PDPA. Companies still need to take specific steps.<\/p>\n\n\n\n
Consent.<\/strong> Employees must give explicit consent for the collection and processing of their biometric data. This means updating employment contracts or issuing a separate data protection notice that specifically covers biometric attendance. A generic clause in the employee handbook is unlikely to meet the “explicit consent” standard under the amended PDPA.<\/p>\n\n\n\nRetention.<\/strong> The PDPA requires that personal data is not kept longer than necessary for the purpose it was collected. At the same time, the Employment Act requires attendance records to be retained for six years. Companies need a clear retention policy that balances both obligations: retain attendance records for six years for Employment Act compliance, but review whether raw biometric templates (the facial data itself, not the attendance record) need to be retained for the same duration.<\/p>\n\n\n\nAccess control.<\/strong> Biometric data must be protected from unauthorised access. This includes who within the company can access the raw biometric templates, how the data is transmitted between device and cloud, and what happens to the data when an employee leaves the company.<\/p>\n\n\n\nDPO.<\/strong> Companies that process biometric data involving regular and systematic monitoring may need to appoint a Data Protection Officer. An attendance system that captures biometric data from every employee, every working day, could meet this threshold depending on the company’s size and the volume of data processed.<\/p>\n\n\n\nThe Real Lesson of the Viral Case<\/h2>\n\n\n\n
The boss who demanded live location during leave was not using an attendance system. They were using WhatsApp and phone calls to track employees outside working hours. The case was extreme, and most companies would never do the same thing.<\/p>\n\n\n\n
But the principle the case surfaced applies to every company using biometric attendance: data collection must be proportionate to the business purpose, consent must be explicit, and the line between tracking and surveillance is defined by whether the data collection is necessary, not by whether it is technically possible.<\/p>\n\n\n\n
The attendance system at the office door is almost certainly on the right side of that line. The question is whether the company’s consent forms, retention policies, and access controls have been updated to prove it.<\/p>\n\n\n\n
The PDPA does not ask whether the company intended to comply. It asks whether the company can demonstrate compliance. For biometric attendance, that demonstration starts with a consent form most companies have not yet written.<\/p>\n\n\n\n
![\"\"](\"https:\/\/www.timeteccloud.com\/blog\/wp-content\/uploads\/2026\/05\/faceid5.webp\")
<\/figure>![\"\"](\"https:\/\/www.timeteccloud.com\/blog\/wp-content\/uploads\/2026\/05\/ui-old-501x1024.png\"){kind=spacer}
<\/figure>