Most attendance compliance advice written for Indian employers is now describing a law that no longer exists. The Factories Act, 1948 was repealed on 21 November 2025. So were the Contract Labour Act, the Minimum Wages Act, the Payment of Wages Act and twenty-five others. If your attendance policy still cites Section 62 of the Factories Act or Form 25 muster roll rules, it is citing a statute that was taken off the books nine months ago.
That is the headline, and it is less dramatic than it sounds. The obligations did not disappear. They moved, they were renumbered, and in two places they got stricter. The problem for most HR teams is not that the rules are harsh. It is that the rules are now spread across four codes, two sets of central rules notified in May 2026, a set of state rules that in most states is still in draft, and a state Shops and Establishments Act that was never part of the reform at all.
This piece works through what you actually have to record, how long you have to keep it, what the hours and overtime limits now are, and where the genuine uncertainty sits. It is written for the person who has to produce records when an inspector asks, not for the person writing the policy document.
One thing up front, because it governs everything below. Attendance compliance in India is not really about attendance. It is about wages. Almost every register you are required to keep exists because somebody has to be able to reconstruct how a payment was calculated, and almost every penalty attaches to the payment rather than to the record. If you read every requirement below as "prove the wage was right", the whole structure makes sense. If you read it as "prove people came to work", it will not. The wider set of obligations around this sits in our labour law compliance checklist.
What follows reflects the attendance and payroll configurations we run. Engage processes attendance for more than 40,000 employees across factories, retail chains, IT services and field operations, in states with very different Shops and Establishments rules, and the failure that repeats is not a missing register. It is a register that exists and does not reconcile with the payslip. Where something below is flagged as a common problem, that is what we see in real records rather than a guess about what might be in them.
This is general guidance for employers, current as at the date above. It is not legal advice. The Labour Codes are in force but the rules under them are being notified state by state on different timetables, and several of the positions below will change as that happens. Confirm anything state-specific with your advisor before you act on it.
What Actually Changed on 21 November 2025
The four Labour Codes were brought into force on 21 November 2025, replacing twenty-nine central labour statutes. They are the Code on Wages, 2019, the Industrial Relations Code, 2020, the Code on Social Security, 2020, and the Occupational Safety, Health and Working Conditions Code, 2020.
For attendance, two of them matter and the other two mostly do not. The Code on Wages governs the registers that record hours and payment. The OSH Code governs how long people may work, when they must rest, and the conditions attached to that. Social Security matters at the edges, because attendance drives the wage figure that drives PF and ESI. Industrial Relations barely touches it.
Section 143 of the OSH Code is the provision that repealed the Factories Act, 1948, along with twelve other statutes including the Contract Labour (Regulation and Abolition) Act, 1970 and the Inter-State Migrant Workmen Act, 1979. The Code on Wages did the same for the Minimum Wages Act, 1948, the Payment of Wages Act, 1936, the Payment of Bonus Act, 1965 and the Equal Remuneration Act, 1976.
Then there was a gap. A code in force without rules under it tells you the principle but not the form, and for about six months employers were in the position of knowing they had to maintain a register without knowing what it looked like. That gap closed on 8 May 2026, when the Ministry of Labour and Employment notified both the Code on Wages (Central) Rules, 2026 and the Occupational Safety, Health and Working Conditions (Central) Rules, 2026. The wage rules were issued as G.S.R. 343(E) under Section 67 of the Code on Wages.
Here is the part that most coverage of this leaves out, and it is the single most important sentence in this article for the average reader.
The Central Rules probably do not apply to you. India's labour administration splits establishments into a central sphere and a state sphere. The central sphere is mines, oilfields, major ports, railways, air transport, banking and insurance, central public sector undertakings and a defined list of similar categories. Everything else, which is the overwhelming majority of private employers, sits in the state sphere and is governed by rules made by its state government. Those state rules are, in most states, still in draft. Some states have notified final rules; most have published drafts for comment and not yet closed them.
So the honest position in August 2026 is this. The codes bind you. The forms may not exist yet in your state. The sensible reading is to use the Central Rules as the template, because state rules under a central code rarely depart far from it, and to hold your records in a system that can regenerate them in a different format when your state notifies. That is a data structure problem rather than a paperwork problem, which is a distinction worth making early.
Which Law Governs Attendance Compliance Now
Attendance compliance in India is rarely governed by a single statute. Most employers are covered by more than one of these at once, and the practical rule is that where two apply, the more favourable to the employee governs. That catches people out, because the instinct is to comply with the newest law and stop.
| If you are | What governs hours and attendance | What replaced what |
|---|---|---|
| A manufacturing unit with 10+ workers (with power) or 20+ (without) | OSH Code, 2020 and the rules of your state under it | Factories Act, 1948, repealed by Section 143 of the OSH Code |
| An office, shop, restaurant or IT services company | Your state Shops and Establishments Act, plus the OSH Code if you cross its thresholds | Nothing. State S&E Acts are state legislation and were not part of the reform |
| Anyone paying wages to anyone | Code on Wages, 2019 and the rules of your state under it | Minimum Wages Act, Payment of Wages Act, Payment of Bonus Act, Equal Remuneration Act |
| An employer of contract labour | OSH Code, which now carries the contract labour provisions | Contract Labour (Regulation and Abolition) Act, 1970 |
| A central sphere establishment (mines, ports, railways, banking, central PSUs) | The Central Rules of 8 May 2026 directly | Sector-specific rules under the repealed Acts |
| An employer of anyone whose data you hold | Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 | The SPDI Rules, 2011 framework |
The row people get wrong is the second one. A large share of Indian white-collar employers assume the Labour Codes replaced everything and that their state Shops and Establishments Act went with them. It did not. Shops and Establishments Acts are enacted by state legislatures, they were never among the twenty-nine central Acts the codes subsumed, and they continue to set working hours, opening hours, weekly closure, leave and register requirements for most non-factory workplaces. Section 6 of this piece deals with what that overlap means in practice.
The Registers You Have to Maintain
The old regime had you keeping a register of adult workers under the Factories Act, a muster roll under the Minimum Wages Rules, a wage register, an overtime register, a register of fines and deductions, and a separate stack under your state's Shops and Establishments Rules. Much of that was the same information written down repeatedly in different formats.
The codes consolidate it. Section 50 of the Code on Wages requires every employer to maintain a register containing the particulars of persons employed, muster roll, wages and other prescribed details, and the rules set out the format. The OSH Code carries the corresponding obligation for the safety and working conditions side. The consolidation is real: the OSH Code reduces the earlier position from fifty-five forms to twenty, from six registrations to one and from twenty-one returns to one.
What you must be able to produce, whatever your state calls the form, comes to five things.
| Record | What it has to contain | Where the obligation sits |
|---|---|---|
| Register of persons employed | Name, father's or spouse's name, date of joining, designation, category of work, wage rate, PF and ESI numbers, bank details | Code on Wages, Section 50 and state rules |
| Muster roll or attendance register | Daily attendance for every person, with in and out times, for every day of the wage period including absences and weekly offs | Code on Wages, Section 50; OSH Code for covered establishments |
| Wage register | Wage period, days worked, overtime hours, gross wages, each deduction separately, net paid, date of payment | Code on Wages, Section 50 |
| Overtime record | Overtime hours per person per day, the rate applied, and the amount paid, reconcilable to the wage register | OSH Code and Code on Wages read together |
| Register of leave | Leave earned, availed, encashed and carried forward per employee per year | OSH Code, and your state S&E Act, which usually has its own |
Two practical points about the muster roll, which is the record this article exists for.
It has to cover everybody, every day. The most common defect we find is a muster roll that records only the people who came in. A muster roll with gaps cannot be distinguished from a muster roll that was written up afterwards, and that is exactly what an inspector is testing for. Absence, weekly off, holiday and leave each need a mark. A blank cell is a finding.
In and out times, not a tick. A daily present or absent mark was enough under some older state rules and is not enough now, because overtime entitlement is computed from hours and the record has to support the computation. If your muster roll cannot show that a person worked eleven hours on a Tuesday, it cannot support the overtime you did or did not pay them for it.
The register of leave is worth its own attention because the Code changed the accrual rate, and the details of that sit in our guide to leave policy requirements under Indian labour laws. Running it as a balance rather than a spreadsheet is what our leave management software is for.
Working Hours, Spread-over and Weekly Rest
The headline limits are unchanged in substance from the Factories Act position, which is why this section is short and why most employers are already compliant without knowing which statute they are compliant with.
Eight hours a day and forty-eight hours a week is the ceiling for a worker in a covered establishment. Both limits bind. Working six eight-hour days is compliant; working four twelve-hour days is not, unless your state has notified the flexible working-day provision the codes contemplate, and most have not yet.
Spread-over may not exceed twelve hours in a day. Spread-over is the elapsed time from the start of work to the end of it, including breaks. This is the limit most commonly breached in retail and hospitality, and it is breached by rosters that look reasonable on paper: a shift from 10am to 2pm and again from 5pm to 10pm is nine working hours, which is within the daily limit once overtime is paid, but a twelve-hour spread-over exactly at the boundary with no margin for a late close.
One day of rest in every week is mandatory, and no worker may go more than ten days without one where a rest day is substituted.
Overtime begins after eight hours in a day or forty-eight in a week, whichever is crossed first, and this is a place where attendance systems configured before the codes get it wrong. A system that computes overtime weekly will miss a person who worked ten hours on Monday and took Friday off, because their week totals forty-two hours. They are still owed two hours of overtime for Monday. The daily and weekly tests are independent and both apply.
Night shift, women's employment at night and the conditions attached to both changed under the codes in a direction that is more permissive than the Factories Act was, subject to consent and to safety and transport conditions prescribed by state rules. If you run night shifts with women workers, that is a state-rules question and it is one worth asking specifically rather than assuming either the old prohibition or a blanket permission.
Overtime and the Arithmetic Nobody Checks
Overtime is paid at twice the ordinary rate of wages. That much everybody knows. Three things underneath it are where the money actually goes wrong.
First, the wage definition changed, and it changed the base. The Code on Wages introduced a uniform definition of wages across all four codes, under which basic pay, dearness allowance and retaining allowance count as wages, and the excluded allowances are capped: if they exceed fifty per cent of total remuneration, the excess is added back into wages. Employers who ran a low basic and a large allowance stack, which was extremely common in Indian salary structures, now have a higher wage figure for every calculation that sits on it. That includes overtime, gratuity, PF and leave encashment. If your overtime is still being computed on the old basic, it is being underpaid, and the underpayment is per hour, per person, accumulating since November 2025. The structural side of this is worked through in our guide to employee salary structure in India.
Second, rounding is prescribed, and it rounds towards the employee. Under the Central Rules, a period of overtime between fifteen and thirty minutes counts as thirty minutes, and anything beyond thirty minutes counts as a full hour. A system that truncates to actual minutes worked is not neutral, it is non-compliant, and it under-pays in a way that is trivially detectable from your own raw punch data.
Third, overtime is payable at the end of the wage period in which it was worked, not in an arrears run two months later. Deferring overtime to a later cycle is a payment-timing default independent of whether the amount is eventually right.
There is a quarterly ceiling on total overtime hours, and this is one of the places where you genuinely cannot answer the question from the central position alone. The Factories Act capped it at fifty hours a quarter, with several states having notified higher figures, and the codes leave the limit to be prescribed by rules. Draft state rules have carried figures well above the old cap. Until your state notifies, treat the old state limit as the working assumption and check it before you plan a season around it.
The reconciliation to run, if you run only one thing out of this article: take one month, pull the raw punch data, compute overtime hours independently, and compare against what the payroll actually paid. In the migrations we do, this is the check that finds money, and it finds it in both directions. Unpaid overtime is the liability. Overtime paid on shifts that the muster roll cannot evidence is the audit problem. Both come from the same root cause, which is an attendance system and a payroll system that were never actually joined, only exported between. The general version of that failure is covered in common payroll compliance mistakes Indian businesses make.
The State Layer That Did Not Go Away
Every state has its own Shops and Establishments Act, they differ from each other in ways that matter operationally, and none of them was repealed by the Labour Codes.
This produces a genuine overlap. An IT services company in Bengaluru with four hundred employees is an establishment under the OSH Code and a commercial establishment under the Karnataka Shops and Commercial Establishments Act at the same time. Both prescribe hours. Both prescribe registers. They do not agree.
The most visible disagreement is the daily hours ceiling. Most state Shops and Establishments Acts allow nine hours a day; the OSH Code sets eight. Where both apply, the lower limit governs the point at which overtime starts, because the employee gets the benefit of the more favourable provision. In practice this means a number of white-collar employers in India are running nine-hour standard days and treating the ninth hour as ordinary time, on the basis of a state Act, in circumstances where the code makes it overtime.
The register position is more forgiving. Where a state Act requires a register that duplicates one required under the codes, maintaining a single register carrying every field required by both is normally accepted, and several states have expressly permitted combined registers. The compliance risk is in the fields rather than in the number of documents, which is another argument for holding attendance as structured data and generating the forms rather than maintaining the forms as the source of truth.
The other state variations worth checking before you configure anything, because they are not guessable: the spread-over limit, the overtime quarterly cap, the number and timing of mandatory breaks, weekly closure or shop-opening restrictions, and whether your state requires an attendance record for employees who never attend a premises. Public holidays differ by state as well, which is why we maintain a current state-wise holiday list. If you operate in more than three states, this stops being something a policy document can hold and becomes a configuration problem. That is more or less the case for replacing spreadsheets with a system, and it is the single strongest one in Indian HR.
Retention, Format and Electronic Records
Two things changed here and both are easy to miss because they are one line each in the rules.
Retention went from three years to five. Registers maintained under the Code on Wages (Central) Rules, 2026 must be preserved for five years from the date of the last entry made in them. The old position under the Minimum Wages and Payment of Wages rules was three years. If your document retention policy says three years, or your HR system purges on a three-year rule, you now delete records you are required to hold. Note also that the clock runs from the last entry, not from the creation of the record or the employee's exit, which for a running register means five years from when you stopped using it.
Electronic maintenance is expressly supported. The rules provide for records, registers and notices to be maintained and displayed electronically. This is the provision that makes a modern attendance management system the compliant path rather than a convenience sitting alongside a paper register, and it removes the argument, still occasionally made by consultants, that the signed physical muster roll is the only defensible record.
Electronic does not mean informal. Three properties decide whether an electronic record survives contact with an inspection.
It has to be reproducible in the prescribed form. An export of raw punches is data, not a register. You need to be able to print the muster roll for a named month with every field the form requires and every person on it.
It has to carry an audit trail on edits. Attendance is regularised constantly, for good reasons: a missed punch, a client site visit, a device failure. Every one of those is an edit to a statutory record. Who changed it, when, from what value to what value, and on whose approval. A system that lets a manager overwrite a punch silently produces a register that proves nothing, and it is worse than paper, because paper at least shows the correction.
It has to be retrievable after the person has left. Five years from last entry outlives most employments. Purging on exit is the most common way employers lose records they are required to keep, and it is usually done in the belief that it is what data protection requires. It is not, and section 8 explains why.
Biometric and Location Data Under DPDP
Attendance data is personal data, and since the Digital Personal Data Protection Act, 2023 and the DPDP Rules notified in November 2025, it sits under a framework that most attendance deployments were designed before.
Start with a correction, because it is repeated in most vendor content on this subject. The DPDP Act does not create a special category for sensitive personal data, and biometric data has no separate legal status under it. The Sensitive Personal Data or Information framework under the 2011 rules made that distinction; the DPDP Act deliberately did not carry it forward. Fingerprint and face templates are personal data, governed by the same notice, consent, purpose limitation, storage limitation and security obligations as an employee's phone number. This matters because advice built on the old SPDI categories is advice about a repealed framework, and because the actual obligations are in some respects broader rather than narrower.
What the DPDP framework requires of an attendance deployment comes to four things.
Notice and lawful basis. You must tell employees what attendance data you collect, in what form, and why. Employment is one of the legitimate uses recognised under the Act, and processing for purposes connected with employment does not require consent in the same way a consumer transaction does. That is a genuinely helpful provision for employers and it is narrower than it first appears: it covers processing for employment purposes, so an attendance record used to compute wages is comfortable, and the same biometric template reused for a different purpose is not.
Purpose limitation, which is where reuse fails. Aadhaar collected for provident fund enrolment cannot be repurposed for attendance identification without a separate basis. A face template collected for attendance cannot be fed into a security or productivity analytics use without one. This is the most common quiet breach in Indian attendance deployments, and it usually happens because the same vendor sells both modules and enabling the second one is a checkbox.
Storage limitation, in tension with the five-year retention rule. These pull in opposite directions and the resolution is that they apply to different data. The statutory register, meaning who worked which hours, must be kept five years, and the legal obligation is your basis for keeping it. The biometric template, the mathematical representation of a fingerprint or face, serves only to identify the person at the moment of the punch, and there is no legal obligation to retain it after they leave. So the correct configuration is to purge biometric templates on exit and retain attendance records for five years. Most systems do the opposite by default, keeping everything indefinitely, and almost nobody separates the two. The purchase-side version of this decision, along with the rest of what to ask a vendor, is in our biometric attendance system buyer's guide.
Erasure has to reach every copy. If a template lives on the device as well as in the server, deleting the employee in the software does not delete them from the device. Device-level enrolment is a real store of personal data and it is routinely forgotten during offboarding.
On the Aadhaar question specifically: a private employer cannot compel Aadhaar-based biometric authentication for attendance. Aadhaar authentication by private entities is restricted following the Supreme Court's Puttaswamy judgment and the subsequent amendments, and attendance is not among the permitted purposes for a general private employer. Use your own enrolment. Do not build your attendance identity on Aadhaar because the number is already in your PF records.
You may also have seen the Supreme Court's November 2025 decision reported as settling that biometric attendance is legal. It is worth reading what it actually held. A bench of Justices Pankaj Mithal and Prasanna B. Varale allowed the Union's appeal against a 2014 Orissa High Court order and held that introducing a biometric attendance system in government offices was not invalid merely because employees had not been consulted first. That is a decision about consultation obligations in government service. It is not a ruling on DPDP consent, it is not about private employers, and it does not license anything in this section. Vendor content citing it as blanket authority for private-sector biometric attendance is overreading it considerably.
Contract Labour, Field Staff and the Gaps
Three categories of worker produce most of the real exposure, and all three are the ones whose attendance is recorded worst.
Contract labour. The contract labour provisions moved into the OSH Code, and the principal employer's position did not improve. You remain responsible for ensuring the contractor pays correctly, and if the contractor does not, you pay. The contractor's muster roll and wage register are therefore your evidence, and asking for them monthly rather than annually is the difference between finding a problem and inheriting one. The registration threshold and the licensing threshold both moved upward under the Code, which means some contractors who were licensed are no longer required to be; that changes their obligations and not yours.
Field and mobile staff. Sales teams, service engineers, delivery and merchandising staff have no premises to punch at, and the statutory framework was plainly written for people who arrive somewhere. The obligation to record hours does not lift because the work is mobile. What works is a location-verified mobile punch with the same in and out discipline as a fixed device, and what does not work is a weekly self-declared timesheet approved in bulk, which is what most field operations actually run and which evidences nothing. Our field tracking module exists for exactly this record, and the compliance argument for it is stronger than the productivity one. How to configure capture for a workforce with no fixed premises is worked through in cloud-based attendance software for distributed teams.
Remote and hybrid employees. This is the genuinely unsettled area. The codes do not have a developed concept of the remote worker, most state Shops and Establishments Acts predate the question entirely, and there is no Indian equivalent of a right-to-disconnect provision in force. The practical exposure is not that you record too little. It is spread-over: an employee who takes a call at 8am and another at 9pm has a thirteen-hour spread-over, and if your systems can evidence both, you have created a record of a breach that you would not otherwise have had. That is not an argument for recording less. It is an argument for having a policy about the boundary before you have the data about it.
Fixed-term and gig workers. Fixed-term employment is now expressly recognised across the codes, with pro-rata gratuity after one year, and fixed-term employees carry the same attendance and hours entitlements as permanent staff for the period of the term. Gig and platform workers are recognised in the Social Security Code for aggregator contribution purposes and are not brought inside the hours and attendance framework at all.
What an Inspection Actually Looks At
Inspection moved to a facilitator model under the codes, with web-based and randomised allocation and a stated emphasis on advice before prosecution. That reduces the frequency of arbitrary visits. It does not reduce what is looked at, and because allocation is now system-driven, the trigger is more likely to be a data mismatch in your own returns than somebody's discretion. This is the point at which attendance compliance stops being a documentation exercise and becomes an evidence one, and the wider set of filings that sit alongside it is covered on our compliance page.
The sequence is consistent enough to prepare for.
| What is asked for | What it is being tested against | The usual failure |
|---|---|---|
| Muster roll for a named month | Completeness: every person, every day, with marks for absence and offs | Blank cells, or a register that starts mid-month |
| Wage register for the same month | Whether days paid equal days recorded on the muster roll | Payroll run on a cut-off date and never reconciled to late attendance corrections |
| Overtime record | Whether hours above eight a day appear as overtime, at twice the wage rate | Weekly-only overtime computation; overtime on the pre-code basic |
| Wage slips | Whether the slip shows the same hours and deductions as the registers | Slips generated from a different system than the one holding attendance |
| Leave register | Accrual rate and encashment against the code position | Accrual still on the old one-in-twenty rule where the code differs |
| Contractor records | Whether the principal employer holds them at all | Held annually, or not held |
| Regularisation trail | Whether edits to attendance are attributable and approved | Anonymous or bulk edits with no approver recorded |
Almost every test in that second column is a reconciliation between two documents rather than an inspection of one. That is the whole thing. A perfect muster roll that does not match the wage register is worse than an imperfect one that does, because the mismatch is evidence of something and the imperfection is evidence of nothing.
It follows that the most valuable compliance work available to most employers is not producing better registers. It is making the attendance record and the payroll run read from the same data, so that a reconciliation cannot fail because there is nothing to reconcile. That is what an integrated payroll system is for, and the compliance case for it is much stronger than the efficiency case that usually gets made.
Questions People Ask
Is the Factories Act still applicable in India in 2026?
No. The Factories Act, 1948 was repealed by Section 143 of the Occupational Safety, Health and Working Conditions Code, 2020, with effect from 21 November 2025, along with twelve other statutes including the Contract Labour Act, 1970. Factories are now governed by the OSH Code and by the rules made under it by the appropriate government. In substance the hours and record obligations are similar, but the section numbers, the forms and the retention period have all changed, so any policy document, register template or system configuration that cites the Factories Act needs updating.
What attendance records are legally required in India?
Five, whatever your state's forms are called: a register of persons employed, a muster roll or attendance register showing daily attendance with in and out times for every person on every day, a wage register showing days worked and each deduction separately, an overtime record reconcilable to the wage register, and a leave register. The obligation sits mainly in Section 50 of the Code on Wages, 2019, with the OSH Code adding requirements for covered establishments and your state's Shops and Establishments Act adding its own for non-factory workplaces.
How long must attendance and wage registers be kept?
Five years from the date of the last entry made in the register, under the Code on Wages (Central) Rules, 2026. This is an increase from the three-year period that applied under the rules to the repealed Minimum Wages and Payment of Wages Acts. The clock runs from the last entry rather than from the employee's exit, so a running register is retained for five years from when entries in it stopped. Check your state rules, but three years is no longer a safe default anywhere.
Can attendance registers be maintained electronically in India?
Yes. The rules under the Labour Codes expressly provide for maintaining registers and records and displaying notices in electronic form. To be defensible, the electronic record has to be reproducible in the prescribed format for any named period, has to carry an audit trail showing who edited an attendance entry and when, and has to remain retrievable for the full five-year retention period after an employee leaves.
What are the working hours and overtime rules under the new labour codes?
Eight hours a day and forty-eight hours a week, with spread-over capped at twelve hours and at least one rest day per week. Overtime is payable at twice the ordinary rate of wages for hours beyond eight in a day or forty-eight in a week, whichever is crossed first, and both tests apply independently. Under the Central Rules, overtime of fifteen to thirty minutes is counted as thirty minutes and anything beyond thirty minutes as a full hour. Overtime must be paid at the end of the wage period in which it was worked. The quarterly ceiling on overtime hours is left to state rules and varies.
Do the Labour Codes replace my state Shops and Establishments Act?
No. Shops and Establishments Acts are state legislation and were not among the twenty-nine central Acts subsumed by the codes. They remain in force and continue to govern hours, registers, leave and weekly closure for most non-factory workplaces. Where both a state Act and a code apply to the same establishment, the provision more favourable to the employee governs. The practical consequence is that many state Acts permit a nine-hour day while the OSH Code sets eight, so overtime may begin an hour earlier than a policy written from the state Act alone would suggest.
Is biometric attendance legal for private companies in India?
Yes, with conditions. Biometric attendance itself is not prohibited, but the fingerprint or face template is personal data under the Digital Personal Data Protection Act, 2023, so employees must be given notice of what is collected and why, the data may be used only for the stated purpose, it must be secured, and it must be erased when the purpose ends. A private employer cannot compel Aadhaar-based biometric authentication for attendance, because Aadhaar authentication by private entities is restricted and attendance is not a permitted purpose. The Supreme Court's November 2025 decision on biometric attendance concerned whether government offices had to consult employees before introducing the system and does not decide the private-sector data protection question.
What is the penalty for not maintaining attendance records?
Failure to maintain the prescribed registers is a distinct contravention under the Code on Wages carrying a monetary penalty, and it is usually the smaller part of the exposure. The larger part is what the missing record costs you when a wage claim is made: without a muster roll evidencing hours actually worked, an employer is in a poor position to rebut a claim for unpaid overtime or wages, and the practical burden of showing what was worked falls on the party that was required to record it. Repeat contraventions carry higher penalties, and the codes also provide for compounding of certain offences.
How should attendance be recorded for remote and field employees?
The obligation to record hours does not lift because there is no premises. For field staff, a location-verified mobile punch with the same in and out discipline as a fixed device produces a record that can support an overtime computation; a weekly self-declared timesheet approved in bulk does not. For remote employees the framework is genuinely underdeveloped, and the practical risk is spread-over rather than hours, since scattered early and late activity can breach the twelve-hour spread-over limit while the total hours worked look unremarkable. Set the boundary in policy before you start generating data about it.
Where This Leaves You
Attendance compliance is not difficult. It is just newer than most of the documents describing it, and the parts that changed are not the parts people are looking at.
So work in this order. Change your retention rule from three years to five, today, because it is one line and you are currently deleting records you are required to keep. Then check whether your overtime is computed on the post-code wage definition and on a daily as well as a weekly test, because that is where the money is. Then pull one month of raw punch data and reconcile it against what payroll actually paid, which will tell you in an afternoon whether you have a problem worth budgeting for. Then look at whether your attendance edits carry an audit trail, and whether your biometric templates are being purged on exit while the attendance records are being kept. Then, and only then, worry about which form your state will eventually prescribe.
Everything on that list is a property of the system holding the data rather than of a policy document. Registers that are generated from structured attendance data can be re-generated in a new format when your state notifies its rules. Registers that are the source of truth have to be rebuilt. Given that most states have not yet notified, the ability to change format later is worth more right now than being right about the format today.
The neighbouring obligations sit in our labour law compliance checklist, the leave accrual and encashment side is in leave policy requirements under Indian labour laws, and the payroll-side view of the same wage definition is in our HR compliance software guide.
If you would rather your muster roll, overtime computation, wage register and payslips all came out of one record instead of three systems that have to be reconciled, that is what our attendance management software is built to do, across states with different rules. Book a free demo and bring one month of your own punch data. The reconciliation takes about twenty minutes and it is a far more useful conversation than a feature list.
