Time tracking and digital disconnection: certified email for HR

Time tracking and digital disconnection are two legal obligations that no HR department in Spain can treat vaguely any longer.

The first has been in force since 2019 and the Labour Inspectorate has multiplied sanctions twentyfold since then. The second has been active since 2018 and courts are beginning to demand documentary proof that protocols were actually communicated to employees.

The link between both regulations and the tool HR teams need to manage them with legal certainty has a name: certified email.

The regulatory framework: two rules that create a massive documentation burden

Time tracking: RDL 8/2019 and what is coming

Since 12 May 2019, Royal Decree-Law 8/2019 has required all companies — regardless of size, sector or working arrangement — to record each employee’s daily working hours with precise start and end times, retain those records for four years and make them available to employees, their representatives and the Labour and Social Security Inspectorate (ITSS) at any time.

The rule, which amended Article 34.9 of the Workers’ Statute, does not yet exclusively require digital format. However, since 2025 the Ministry of Labour has been processing a Digital Time Tracking Royal Decree that will make paper and Excel invalid, require traceable and immutable systems and grant the ITSS remote access to records.

The Council of State opinion of March 2026 flagged shortcomings in the draft that delayed its approval, but the regulatory pressure is unambiguous: the ITSS is already sanctioning records it considers unreliable without waiting for the new decree.

The 2024 figures speak for themselves: the ITSS imposed €20.19 million in sanctions for working-hours recording violations, 8.8% more than in 2023. For time tracking alone: 9,097 inspections, 1,869 sanctions and 21,649 affected workers.

Sanctions under the LISOS (RDL 5/2000) are graded as follows:

With the new decree still pending, the usual range for medium-sized workforces already sits between €2,000 and €5,000 per affected worker for serious infractions.

Digital disconnection: Article 88 LOPDGDD and its implications

Article 88 of Organic Law 3/2018 (LOPDGDD) recognises workers’ right not to respond to professional communications outside their working hours and requires all companies — regardless of headcount — to draw up an internal digital disconnection policy.

This right is reinforced by Article 20 bis of the Workers’ Statute (introduced by the LOPDGDD itself) and by Article 18 of Law 10/2021 on remote working, which adds specific obligations for telework environments: individual agreements must include a clear delimitation of working hours and companies must adopt organisational and technical measures to prevent the systematic extension of the working day.

The concrete obligations are:

• Draw up a specific protocol, following prior consultation with workers’ legal representatives.
• Communicate it to the entire workforce, including middle managers and senior leadership.
• Include a training and awareness plan (explicit requirement of Art. 88.3 LOPDGDD).
• Align it with the applicable collective agreement, which may add further obligations.

The Supreme Court and the National Court (May 2024) have clarified that the company may approve the policy unilaterally but the prior consultation process with representatives is inescapable. Failing to prove that process has been grounds for judicial sanction, as in STSJ Galicia 304/2021.

Why these two rules make certified email essential for HR

The two regulations share something fundamental: they generate a huge volume of communications that must be provably certified when an inspection, a dispute or an employment tribunal claim arises.

What the rules require you to communicate and prove

Time tracking generates communications that need documented evidence:

• Notification of working-hours amendments (when shifts or working-time conditions change under Art. 41 of the Workers’ Statute).
• Communication of overtime and its compensation or payment.
• Disciplinary sanctions for failure to comply with the clocking-in obligation.
• Formal requests to employees who submit inconsistent records.

The digital disconnection policy requires the company to prove:

• That the protocol was communicated to each worker individually.
• That the worker received the training required by Art. 88.3 LOPDGDD.
• That protocol updates reached all affected employees.
• In telework: that the remote working agreement included the disconnection clause and that the worker signed it with full awareness.

Without certifiable proof of each of these communications, the company is exposed in any inspection or litigation.

Ordinary email is not enough

Sending a standard email with the digital disconnection protocol or a disciplinary notice generates no legally robust evidence.

The recipient can claim they never received it, that the message went to spam, that the attachment was unreadable or that the email was a shared inbox they did not check. None of these objections can be effectively refuted with a standard email.

Recent case law makes this clear: the TSJ of Catalonia (10 April 2024) declared a dismissal communicated by certified email unfair precisely because the company could not prove the employee had accepted that channel for formal communications. The ruling states that it is not enough to certify that the message was sent: the company must prove the channel was accepted by the worker and that the email address belongs to them.

What certified email provides that ordinary email cannot

Legalpin’s certified email generates a record that includes:

• Proof of the sender’s and recipient’s identity.
• Full message content, with a cryptographic hash that detects any subsequent alteration.
• Qualified time stamp under eIDAS certifying the exact moment of delivery to the recipient’s inbox.
• Activity log (message opened, device, IP address).
• Downloadable certificate from the qualified trust provider, presentable directly before a court.

This record turns any HR communication into evidence that the recipient cannot challenge without contrary proof.

Concrete scenarios where certified email protects HR

Communicating the digital disconnection protocol

The company draws up the protocol, submits it to consultation with employee representatives and approves the final version. The next critical step is proving that each employee actually received it.

With certified email, the delivery record for every communication is logged with date, time and content. If a worker later claims never to have received the protocol, the record refutes that claim irrefutably.

For the training plan required by Art. 88.3 LOPDGDD, buromail can certify both the meeting invitation and the delivery of training materials.

Notifying disciplinary sanctions for time tracking violations

If an employee systematically fails to comply with the clocking-in obligation, HR must initiate a disciplinary process. The notice of sanction — from a written warning to a disciplinary dismissal — must reach the worker in a certifiably proven way.

Legalpin’s certified email for HR proves the letter arrived in the worker’s inbox on the date recorded in the file. This evidence is decisive in employment tribunal proceedings where the worker claims ignorance of the sanction.

Working-hours amendments and changes to employment conditions

Substantial changes to employment conditions under Article 41 of the Workers’ Statute require formal notice to the worker with sufficient advance notice (minimum 15 days for individual changes). The company must prove that advance notice to the ITSS or the employment tribunal.

With certified email, the notification date is stamped with a qualified seal. There is no room to dispute the computation of the notice period.

Dismissals and contract terminations

The TSJ Catalonia ruling of April 2024 opens an important avenue: certified email is valid for communicating dismissals provided the worker previously accepted that channel. The solution is to include in the employment contract or a specific annex the clause accepting certified email as the channel for formal communications.

With that clause signed from the start of the employment relationship, all subsequent dismissals and sanctions can be communicated by certified email with full validity. Without it, every critical communication requires a physical registered letter or personal delivery, with all the costs and risks that entails.

Communications with remote workers

Article 18 of Law 10/2021 on remote working reinforces digital disconnection obligations for teleworkers. The individual telework agreement must explicitly include disconnection measures, and the company must prove the worker received and signed it.

The complete Legalpin flow — buromail + electronic signature — allows the certified agreement to be sent, the worker’s electronic signature to be obtained and the complete record to be archived in a single digital process.

How to implement certified email in the HR workflow

Implementation does not require replacing all HR management systems. Certified email integrates at three levels.

Level 1 — Direct portal: the HR technician accesses the Legalpin platform from the browser, drafts or attaches the document and launches the certified send to the worker. Ideal for critical one-off communications (dismissals, serious sanctions, substantial amendments).

Level 2 — Integration with the HR system: Legalpin’s API allows the HR software (SAP, Sage, Factorial, Personio) to automatically launch certified emails whenever a communication requiring certifiable evidence is generated — with no additional manual steps.

Level 3 — Combined notification + signature flow: the system sends the document via certified email and requests the worker’s electronic signature. The unified record — certified delivery, signature and time stamp — is automatically archived in the employee’s digital file.

The acceptance clause: the essential prior step

Before using certified email as a channel for formal notifications, the company must obtain the worker’s express acceptance. The most efficient method is to include this clause in the employment contract or a specific annex at the start of the employment relationship.

The clause must specify:
– The worker’s nominative email address to be used as the formal communication channel.
– The types of communication that will be sent through this channel.
– The worker’s confirmation that they recognise that address as theirs and check it regularly.

With that clause signed from day one, certified email has full validity for any subsequent employment communication, including dismissals.

The risks of not acting: what can happen without documentary evidence

In an ITSS inspection: if the inspector requests records of the digital disconnection protocol or working-hours amendment communications and the company cannot produce them, the infraction may be classified as serious under LISOS, with fines reaching €7,500 per affected worker.

In employment tribunal proceedings: if a worker sues the company for dismissal or a disciplinary sanction and the company cannot prove the communication reached them, the dismissal may be declared unfair with the corresponding statutory compensation.

In a collective dispute: if employee representatives challenge the digital disconnection policy claiming it was never formally communicated or that the prior consultation process was not properly carried out, the company needs documentary proof of every step.

In a compliance audit: listed companies or those with growing ESG obligations need to prove their HR processes comply with current employment law. Documentary evidence of certifiable communications is part of that compliance.

Frequently asked questions

Does certified email replace registered letters for employment communications?

For most HR communications, yes, provided the worker has previously accepted that channel. Legalpin’s certified email generates a record with the same or greater probative value as a postal registered letter, with the advantage of instant delivery and significantly lower cost.

What if the worker claims they did not receive the certified email?

Legalpin’s record proves delivery to the recipient’s inbox with a qualified time stamp. If the worker claims non-receipt, the burden of proof shifts: they must prove the message did not reach their inbox, which is practically impossible when the technical record certifies delivery.

Does the digital disconnection protocol need to be signed by the worker?

The LOPDGDD does not require the worker to sign the policy, but it does require the company to prove it was communicated. Certified email covers that need. For the remote working agreement under Article 18 of Law 10/2021, the worker’s signature is required and can be obtained via electronic signature.

Can the ITSS sanction us if we have the protocol but cannot prove we communicated it?

Yes. Having the document is not enough. The inspector can require proof that it was actually delivered to workers. Without that proof, the company is exposed to a sanction even if the protocol exists and is well drafted.

How much does it cost to implement certified email in an HR department?

Legalpin offers adapted plans from occasional sends to API integration for high volumes. The cost per send is significantly lower than a postal registered letter and eliminates manual management time.

Can certified SMS also be used for employment communications?

Yes, as a complementary channel. For workers who are more responsive on mobile than email, certified SMS guarantees the notification reached the worker’s phone number with the same certifiable traceability as certified email. Many HR departments use both channels in combination to maximise the rate of certifiable receipt.

General information only; this does not constitute individualised legal advice.