Time and Attendance Policy: Tracking Work Hours Correctly

Published 30 December 2025

A time and attendance policy tells employees what their working hours are, how time is recorded, how overtime is approved and paid, and what happens with lateness and absence. Tracking work hours correctly means recording actual time worked for every employee, office or remote, in a way that matches the legal limits on hours, supports accurate overtime and payroll, and collects no more personal data than you need.

This guide covers what Indian law now requires on hours, overtime and records under the Labour Codes, the sections your policy should include, how to choose a tracking method, how to handle remote staff and privacy under the Digital Personal Data Protection Act, 2023, and a worked overtime example.

What Indian law requires on working hours

Since 21 November 2025, hours of work in India are governed by the Occupational Safety, Health and Working Conditions Code, 2020 (OSH Code) and the Code on Wages, 2019, together with the rules of the appropriate government. The main points from the Code text:

Daily limit: no worker may be required or allowed to work more than eight hours in a day, with intervals and spread-over as notified by the appropriate government (section 25).
Weekly rest: no worker may work more than six days in any week. Where an exemption takes away a weekly holiday, compensatory holidays must be given within the month or the following two months (section 26).
Overtime: overtime is paid at twice the rate of wages, calculated daily or weekly, whichever is more favourable to the worker, and an employer can require overtime only with the worker’s consent. The government may cap total overtime hours (section 27).
Night shifts: for a shift that crosses midnight, hours worked after midnight count towards the previous day (section 28).
Notice of periods of work: every establishment must display a notice showing the periods of work for each day (section 31).
Women’s night work: women can work in all establishments, but employment before 6 a.m. or after 7 p.m. needs their consent and the prescribed safety conditions.

The central rules notified in May 2026 add detail for establishments where the central government is the appropriate government: a limit of 48 hours in a week, overtime at twice the rate for work beyond eight hours in a day for daily wagers or beyond 48 hours in a week for others, and rounding of part hours (15 to 30 minutes counts as half an hour, more than 30 minutes as a full hour). Most private establishments fall under state rules, so check your state’s notified limits and its shops and establishments law before fixing your schedule.

Note the scope: the OSH Code’s definition of “worker” excludes people employed mainly in managerial or administrative roles and supervisors above a notified wage level. Many employers still record their time for leave, payroll and wellbeing purposes.

Records you must keep

The Ministry of Labour’s employer compliance handbook lists the registers under the Code on Wages: an attendance register cum muster roll, a wage register, an overtime register, and a register of fines and deductions. They can be kept in physical or electronic form, must be kept up to date, and must be preserved for five years. The handbook also requires normal working hours to be displayed on the notice board. A digital attendance system is therefore acceptable, provided it produces complete records you can show an inspector.

What your time and attendance policy should cover

Scope: who is covered, including shift, office, field and remote staff.
Working hours: standard hours, shift patterns, breaks, weekly offs and flexible start windows.
Recording time: the method, when to clock in and out, and how to correct a missed punch.
Overtime: who can approve it, consent, how it is recorded, the pay rate and when it is paid.
Lateness and early leaving: grace periods, how repeated lateness is handled, and any effect on pay.
Absence: how to report unplanned absence and how unauthorised absence is treated.
Remote and hybrid work: core hours, availability and how time is recorded off-site.
Privacy: what data is collected, why, who can see it and how long it is kept.
Disputes: how an employee can query their record and who decides.

For shift rosters and office rules in detail, see attendance rules for shift-based and office teams.

Choosing a tracking method

Method	Works well for	Watch out for
Paper or digital register	Small sites	Errors, late entries, hard to total overtime
Card or PIN terminal	Offices and factories	Buddy punching, lost cards
Biometric device	Large sites and shift work	Biometric data is sensitive; needs a clear purpose and strong security
Mobile app with location	Field staff	Track only during working time, never continuously
Timesheets or system log-in	Remote and project-based staff	Under-recording of overtime; needs manager review

No single method is mandatory. Pick the least intrusive one that produces reliable records for your setting, and use the same method for comparable roles so the rules feel fair.

Tracking time for remote and hybrid staff

Remote days are working days, and the same limits on hours and overtime apply. Practical rules:

Define core hours and the time zone they are measured in.
Record start and finish through the HR system or a daily timesheet, not chat messages.
Require prior approval for overtime and record it the same day.
Set a “right to disconnect” expectation for messages outside working hours, so unrecorded work does not build up.
Do not treat screen activity or keystrokes as a measure of hours worked.

Our guide to work from home rules for hybrid teams covers equipment, security and availability.

Privacy: attendance data under the DPDP Act, 2023

Attendance records are personal data, and biometrics and location are among the most sensitive kinds an employer holds. The Digital Personal Data Protection Act, 2023 allows processing for purposes of employment as a legitimate use (section 7(i)), and requires every data fiduciary to take reasonable security safeguards to prevent a personal data breach (section 8(5)). The DPDP Rules were notified on 14 November 2025 with an eighteen-month phased compliance period, according to the government’s explainer on the Rules, so build your process to the standard now.

A privacy checklist for attendance:

Tell employees in plain language what is collected and why.
Collect only what attendance needs. Location at clock-in is easier to justify than continuous tracking.
Restrict access to HR, payroll and the direct manager.
Store biometric templates securely and delete them when employment ends.
Set a retention period that covers the five-year register requirement, then delete.
Check vendor contracts for security and breach notification duties.

Example: calculating overtime pay

Example (hypothetical, using the method in the central rules; check your state rules and what counts as wages for overtime): Ravi is paid Rs 26,000 a month. The central rules treat the daily wage of a monthly-paid worker as one twenty-sixth of the monthly wage, so his daily wage is Rs 1,000 and his hourly rate over an eight-hour day is Rs 125. Overtime is paid at twice that rate, Rs 250 an hour. In a week where he works 52 hours against a 48-hour limit, he earns four hours of overtime, which is Rs 1,000, paid with that wage period. If he had worked 4 hours 20 minutes extra, the part hour would round to 30 minutes.

Handling lateness, absence and disputes

The Code on Wages allows only authorised deductions from wages, and deduction for absence from duty is one of them. Write the rule down: the grace period, how many late marks count as a half day, and how unauthorised absence affects pay. Apply it the same way to everyone. When patterns continue, move to documented conversations and then a formal warning; our guide on when and how HR should issue formal warning letters explains the steps. Allow employees to query their records, and fix genuine errors in the same wage period.

Common mistakes

Letting managers approve overtime verbally, so it never reaches payroll.
Paying overtime at the ordinary rate instead of twice the rate.
Keeping attendance in one tool and leave in another, so balances do not match. Align with your leave policy and leave types.
Collecting location or biometric data without explaining why or setting a retention period.
Not displaying working hours and periods of work at the establishment.

Attendance data flows directly into wages, so connect it to your payroll steps, as described in how to run payroll without a full payroll system. To draft the policy itself, the HRTailor.AI HR Policy Generator produces a structured first draft for your country and company size that you can then edit.

Last reviewed: 26 October 2026. General information, not legal or tax advice.

Official sources

Frequently Asked Questions

Do attendance rules apply to remote employees?

Yes. Remote work still requires clear tracking aligned with labour laws.

Can employers deduct pay for late arrivals?

Only within the law. In India the Code on Wages, 2019 allows only authorised deductions, such as deductions for absence from duty, so write the rule into your policy and apply it consistently.

Is biometric attendance mandatory?

No. Employers can choose systems that suit their operations.

Time and Attendance Policy: Tracking Work Hours Correctly