Yes, you may use employees' own phones for time and attendance registration, but as the employer you remain responsible for the registration means, and the GPS may only record what is strictly necessary. Under the GDPR you need a clear purpose, you limit location to the moment of registration and you inform your employees fully in advance.
Many employers with staff on the road or on site opt for an app on the smartphone the employee already carries. It is practical and cheap, but it touches on privacy: a private device holds messages, photos and a location that is also available outside working hours. Handling this carelessly risks a complaint to the Belgian Data Protection Authority (DPA).
In this article you will learn what Check In and Out at Work (CIaO) and the cleaning sector agreement (PC 121) require, how a phone allowance works, which principles the DPA applies in decision 61/2025 and what belongs in your geolocation policy, with a checklist and alternatives such as a badge or a device on site.
Do you as an employer have to provide a registration means for CIaO?
Yes. The NSSO is clear on this: an employer covered by Check In and Out at Work must “make registration means available”. You may combine several channels, for example an app, a QR code or a web service linked to a badge or track and trace system. The means must be compatible with the registration device at the workplace.
For now, CIaO applies to the cleaning sector. From 1 April 2027 it will also cover construction work on immovable property of at least 500,000 euros excluding VAT and the delivery of ready-mixed concrete. Who exactly is covered and which data you register is explained on our page about the CIaO obligation for employers in detail.
There is no general law that obliges an employee to use his private smartphone. Because the registration duty lies with you, it is best to always have an alternative ready. In cleaning, this is stated explicitly in the sector agreement; for other sectors it is a cautious interpretation.
What does the PC 121 collective agreement say about the employee's own smartphone?
The joint committee for cleaning (PC 121) concluded a collective agreement on attendance registration on 29 November 2023, in force since 1 January 2024.
- Alternative in case of refusal: if an employee does not want to use his private smartphone, “the employer shall propose an alternative” (article 2).
- Location only at registration: localisation is limited to the moment of checking in or out, not before and not after (article 6).
- No access to private data: the app may not access data that is not needed, such as private messages or photos (article 6).
- Allowance of 7 euros per month for the employee who uses his own smartphone to register.
Three conditions apply to this monthly allowance. It is not prorated: someone who works part of the month receives the full amount. It is not due for a full month of absence. And it does not apply when the employee registers via an employer device or a PC on site.
Read on our page for cleaning companies how to align planning and registration in this sector.
Is an allowance for the employee's own phone exempt from social security contributions?
Not automatically. The NSSO list of accepted flat-rate allowances has no separate flat rate for the use of a private phone. There are flat rates of 20 euros per month for internet and 20 euros per month for a PC, but only for substantial and regular professional use and never for occasional use.
If you still want to reimburse the costs, the NSSO instructions state that the reimbursement is only exempt from contributions if three conditions are met:
- the cost is incurred in the course of employment;
- the cost can be justified with supporting documents;
- the cost is not reimbursed twice, for example not also through another flat rate.
Anything above the actual costs is considered salary. Whether the sector allowance of 7 euros in PC 121 is exempt from social security and tax, we did not find confirmed in an official source. Have your social secretariat check this before you include the allowance in payroll.
What does DPA decision 61/2025 teach about geolocation?
On 25 March 2025 the Litigation Chamber of the DPA issued decision on the merits no. 61/2025. It concerned geolocation in company cars that were also used privately. So the case is not about a registration app, but the principles apply to every system that records the location of employees.
| Principle | What the DPA found | What it means for your registration |
|---|---|---|
| Legal basis | Legitimate interest (article 6.1.f GDPR) was accepted as the legal basis. | Name your legal basis and explain concretely why you need the data. |
| Purpose limitation | Violated: the policy said monitoring was “not the purpose”, while the system did in fact monitor working hours. | Write down the real purpose, for example attendance registration for CIaO or checking hours for payroll preparation. |
| Proportionality | Continuous recording is disproportionate; the system must be able to be switched off outside working hours, and letting the employee switch it on and off counts as best practice. | Record location only when the employee checks in or out himself, never continuously. |
| Transparency | Violated: vague purposes and legal basis, and data categories ending in “et cetera”. | List the processed data in full, without an open-ended list. |
| Retention period | Retention periods were missing, which contributed to the breach of articles 12, 13 and 14 GDPR. | Set and communicate a period; the DPA itself does not impose a specific number of months. |
| Written arrangements | A separate agreement or an annex to the employment contract counts as additional best practice. | Record your geolocation policy in such a separate document and give it to every employee. |
Law firm Claeys & Engels points out that data such as location, kilometres, start and end time and stop times were considered necessary in that case. According to the authors, a detailed geolocation policy and an updated privacy statement are sufficient in such a situation.
A short explanation of location data can also be found in our article what is an ESS app; here we go deeper into what you need to arrange in practice.
Do you need a DPIA and whom must you inform in advance?
Data protection impact assessment (DPIA)
A DPIA is a written risk analysis you carry out before starting a processing operation. The DPA recommends one as soon as several risk criteria are met, and “vulnerable data subjects, such as employees” and “systematic monitoring” are two of them. Large-scale or systematic processing of location data is also on the DPA list of processing operations that require a DPIA.
Duty to inform employees
Before going live, you inform every employee concerned in writing about:
- the legal basis and the purposes of the processing;
- who is monitored and how long the system runs;
- exactly which data you process and how long you keep it;
- their rights, including access, rectification and the right to lodge a complaint with the DPA.
Collective agreement no. 39 when introducing new technology
There is no Belgian law or collective agreement that deals specifically with the geolocation of employees. When introducing a new registration technology, collective agreement no. 39 on new technologies may apply, with a procedure of information and consultation as soon as at least 10 employees are involved.
Read in this legal analysis on locating employees how data obtained in breach of the GDPR was excluded as evidence in an employment case from 2019.
Checklist: what belongs in your geolocation and privacy policy?
Use this list as the basis for a separate geolocation policy, alongside your general privacy statement.
- Purpose: describe the real purpose, for example the legal attendance registration under CIaO and checking hours worked for payroll preparation.
- Legal basis: state which legal basis you use; the DPA accepted legitimate interest, provided you justify it concretely.
- Data: list all data categories in full (time, location at registration, site or assignment, device), without “and so on”.
- Moment of localisation: state that location is only recorded when checking in and out and never outside working hours.
- Access to the device: confirm that the app has no access to private messages, photos or other unnecessary data.
- Retention period: define per data category how long you keep it and when you delete or anonymise it.
- Alternative: describe which registration means an employee receives who does not want to use his own phone.
- Allowance: state whether you pay an allowance for the employee's own smartphone, how much and under which conditions.
- Procedure: document the DPIA, the consultation under collective agreement no. 39 where applicable, and the date on which each employee received the policy.
What alternatives do you have if an employee refuses to use his own phone?
An alternative does not have to be expensive. The NSSO allows several channels to be used side by side, so you can offer the app to those who want it and provide another means for the others.
- Badge at a terminal: the employee registers with a badge on a device at the workplace, which is connected to CIaO via a web service.
- Employer device: a company smartphone or a shared tablet on site or in the van.
- PC on site: registration via a computer at the workplace, for example at reception or in a site cabin.
Note the link with the allowance: in PC 121 the 7 euros is not due when the employee registers via an employer device or a PC on site.
In our step-by-step plan to introduce CIaO and get employees on board you can read how to handle refusals in practice.
How MyVIRO helps
MyVIRO is built with these principles in mind. The app records location only at the moment of checking in and out, never outside working hours. Employees start the registration themselves, and per team you choose which functions are visible. Registrations go directly to CIaO via the NSSO web service, and the data stays in Belgium.
In the back office you immediately see missing check-ins, deviating locations and open approvals before payroll preparation. If an employee does not want to use his own smartphone, the same app also works on a company smartphone, on iOS and Android.
- See how MyVIRO works from Check In/Out to full self-service
- Read what MyVIRO for companies delivers in practice
Request a demo and explore with us how to get registration and privacy right in one go.
Read also
- What is an ESS app? Employee self-service explained for Belgian employers
- Is travel time working time? How to record mobility correctly for payroll
- Reporting sick via an app: when is a medical certificate required in 2026?
Frequently asked questions about own phones, GPS and the GDPR
There is no general law that imposes or explicitly allows this. Under CIaO the employer must make registration means available, and in cleaning (PC 121) you must propose an alternative to anyone who refuses.
No. In decision 61/2025 the DPA ruled that continuous recording is disproportionate and that the system must be able to be switched off outside working hours. The PC 121 agreement limits localisation to the moment of registration.
In PC 121 it is 7 euros per month, not prorated and not due for a full month of absence. For other sectors there is no general amount and no separate NSSO flat rate for a private phone.
The DPA does not impose a fixed period, but you must set one and communicate it to employees. Missing retention periods were one of the transparency failures in decision 61/2025.
Then you provide another means, such as a badge at a terminal, an employer device or a PC on site. The NSSO allows different registration channels to be combined.
Sources
- NSSO, Check in at work: how to register (in Dutch): socialsecurity.be
- NSSO, DmfA administrative instructions on expense reimbursements (in Dutch): socialsecurity.be, instructions
- FPS Employment, PC 121 collective agreement of 29 November 2023 on attendance registration (pdf, in Dutch): werk.belgie.be
- ACCG, PC 121 flat-rate smartphone allowance (pdf, in Dutch): accg.be
- Data Protection Authority, decision on the merits no. 61/2025 of 25 March 2025 (pdf, in Dutch): autoriteprotectiondonnees.be
- Claeys & Engels, Geolocation of company cars: confirmation of the DPA principles (in Dutch): lexgo.be
Author: Jean-Philippe Delberghe at MyVIRO. Published on 23 October 2026. Last updated on 23 October 2026.
This article is an informative explanation and not legal advice. Consult your social secretariat for your specific situation.