Tracking hours without building a surveillance system

Contemporary workforce tools offer far more than a record of hours. Screenshots, activity levels, keystroke counts, continuous location, idle detection. In an office context these features are contested. In hospitality they are frequently irrelevant to the actual work, and buying them anyway creates obligations and damage with no offsetting benefit. The NIST Privacy Framework offers a structured way to think about proportional data collection and privacy risk.

The useful discipline is proportionality: collect what the operational question requires, and stop.

Start from the question, not the feature list

Most hospitality time questions are answered by a small set of data points. Written down, the list is short enough to be slightly deflating relative to what the software can do.

• Was the person present for the hours being paid? Clock-in and clock-out.
• Is the rota realistic? Scheduled hours against worked hours, by department.
• How long does this task take? Task start and end, sampled — not necessarily collected continuously or by individual.
• Are rest intervals being respected? Derived from the first item.
• Is workload fairly distributed? Aggregated shift counts by person.

Nothing on that list requires a screenshot, a keystroke count or a continuous location trail. If a vendor's differentiating features do not map onto a question you actually have, they are not features you are buying — they are liabilities you are acquiring.

Location is the live issue in hospitality

Location tracking has legitimate narrow uses in this industry — a guide leading a group off site, a driver on a transfer, a lone worker on a large estate where safety monitoring is the point. The distinction that matters is between verification and monitoring.

Verification confirms a condition at a moment: the person was inside the property boundary when they clocked in. It records one fact and then stops. Monitoring records a continuous trail of where someone was throughout their shift, and in most hospitality roles there is no operational question that requires it.

Lone worker safety is a separate system

Night porters, staff on large grounds and anyone working alone in a remote part of a property have a genuine safety case for location awareness. That case is real and should be taken seriously.

It should also be built as its own thing: staff-activated, clearly bounded, with data used only for the safety purpose and retained briefly. Bolting safety monitoring onto the attendance system merges two purposes with different justifications, and the merged version inherits the weakest justification for the most intrusive data.

Retention is where most policies fall down

Organisations think hard about what to collect and barely at all about how long to keep it. Time records typically need to be retained for a period set by employment and tax law — often several years — but that requirement applies to the payroll-relevant summary, not to every granular event behind it.

Separate the two. Keep the attendance record for the statutory period. Keep granular task data, location verifications and system logs for a much shorter window — long enough to resolve a dispute, and no longer. Write the periods down and make deletion automatic, because manual deletion is deletion that does not happen.

The reciprocity test

A practical check before adding any monitoring capability: would you be comfortable showing the team exactly what is collected, exactly who can see it, and exactly how long it is kept?

If the answer is yes, the measure is probably proportionate and you should do the showing, because transparency is most of what makes tracking tolerable. If the answer is no, the honest reading is that you already know it is disproportionate, and the discomfort is the finding.