Buddy punching: what it is, and what an employer can lawfully do

Someone clocks in for a colleague who is twenty minutes behind. It takes two seconds, it is done as a favour, and nobody mentions it again. Then an exception report surfaces six weeks of it, and the questions arrive in the wrong order. How do we stop this, people ask, long before anyone asks how we handle the case in front of us and whether we can take the money back.

This article answers the second pair, because those are the ones that go wrong. It covers what buddy punching is and where the name comes from, why rounding and honour systems invite it, what a United Kingdom employer may and may not do to detect it, how to handle a suspected case, whether the pay is recoverable, and the test to apply before anyone suggests fingerprints. It names no products. It describes the position in the United Kingdom and is general information rather than legal advice.

Conduct problems are cheapest to deal with while they are still a conversation. See how New Dynamics continuous feedback keeps that record attached to the person instead of being reconstructed six weeks later.

If your real question is which method of clocking in to use, our post on the employee time clock works through the capture methods one at a time. This post starts after the record is already in dispute.

What buddy punching is, and where the name comes from

The practice is one worker recording a start or finish time for another who is not there. The method barely matters: a lent card, a shared four digit code, a phone handed over in a car park, a line added to a paper sheet on Friday.

The name is American, and so is the imagery. It comes from the mechanical card clock, where you punched a timecard into a machine, and United States federal regulation still carries a section headed "Use of time clocks". That section, 29 CFR 785.48, opens flatly with "Time clocks are not required", and goes on to say that "Minor differences between the clock records and actual hours worked cannot ordinarily be avoided, but major discrepancies should be discouraged since they raise a doubt as to the accuracy of the records of the hours actually worked".

The United Kingdom has no term of art for it and no offence of that name. Here it is alleged misconduct, judged like any other allegation of dishonesty, with the pay consequences running on a separate track.

Three situations get lumped together under one label, and separating them is most of the work:

• Arranged. Two people agree that one will clock the other in. Both have something to answer.
• Covered. A colleague scans a second card without being asked, usually out of sympathy. The person who was late may have nothing to answer at all.
• Tolerated. A supervisor knows, and has known for a year. That is close to an authorised practice, and it changes the case against everybody.

Why rounding and honour systems invite it

An honour system, where hours are written down at the end of the week, cannot really be falsified, because nothing in it was ever contemporaneous. It is remembered rather than recorded, and the drift it produces is rarely deliberate.

Rounding is the more interesting invitation. Where a clock rounds to the nearest quarter of an hour, a 09:07 arrival and a 09:00 arrival produce the same line in the record, so the favour costs nothing and feels like nothing. The same United States regulation accepts rounding only "provided that it is used in such a manner that it will not result, over a period of time, in failure to compensate the employees properly for all the time they have actually worked". No official United Kingdom page we opened publishes a permitted rounding tolerance at all, which our post on the employee time clock covers in more detail.

The third invitation is physical: one terminal at the far end of a site, a rota that changed on Sunday evening, and a lateness trigger with a hard edge. Our post on the attendance policy covers how to write a lateness clause that does not manufacture its own breaches.

It is a conduct matter, so the Acas Code governs it

The Acas Code of Practice on disciplinary and grievance procedures, published on 11 March 2015 and issued under section 199 of the Trade Union and Labour Relations (Consolidation) Act 1992, is the floor for handling this. Its foreword is precise about the consequence of ignoring it: "A failure to follow the Code does not, in itself, make a person or organisation liable to proceedings. However, employment tribunals will take the Code into account when considering relevant cases", and "Tribunals will also be able to adjust any awards made in relevant cases by up to 25 per cent for unreasonable failure to comply with any provision of the Code". Acas has said it will be updating the Code and is consulting on a draft, so check the date on whatever version you are working from. The 2015 Code is the one in effect.

Four provisions do the work in a buddy punching case.

The investigation is not optional. Among the elements of fairness at paragraph 4, the Code lists that "Employers should carry out any necessary investigations, to establish the facts of the case". Paragraph 5 adds the timing: "It is important to carry out necessary investigations of potential disciplinary matters without unreasonable delay to establish the facts of the case".

Separate the roles where you can. Paragraph 6: "In misconduct cases, where practicable, different people should carry out the investigation and disciplinary hearing". Our post on workplace investigations covers who should do which part.

An investigation meeting is not a sanction. Paragraph 7: "If there is an investigatory meeting this should not by itself result in any disciplinary action".

Suspension is not a reflex. Paragraph 8: "In cases where a period of suspension with pay is considered necessary, this period should be as brief as possible, should be kept under review and it should be made clear that this suspension is not considered a disciplinary action".

Our post on the disciplinary procedure takes the stages in order, including the notification and the right to be accompanied.

Is it gross misconduct?

It can be, and it is not automatically. The Code is careful on both halves. Paragraph 23 reads: "Some acts, termed gross misconduct, are so serious in themselves or have such serious consequences that they may call for dismissal without notice for a first offence. But a fair disciplinary process should always be followed, before dismissing for gross misconduct". Paragraph 24 then puts the burden on your own rulebook: "Disciplinary rules should give examples of acts which the employer regards as acts of gross misconduct", and the examples it offers "might include things such as theft or fraud, physical violence, gross negligence or serious insubordination".

So the route runs through your own documents and then through the evidence. If your conduct rules do not mention falsifying a time record, the "everyone does it" answer is harder to displace. If they do, dishonesty of this kind can sit squarely in the fraud category, and our post on gross misconduct covers what follows. What you cannot do is treat the label as the starting point. Gross misconduct is a conclusion reached after an investigation, not a description chosen before one.

Detecting it: what you may and may not do

The Information Commissioner's Office is clear that watching is permitted and that the method has to be justified. Its guidance on monitoring workers states that "Data protection law does not prevent you from monitoring workers, but you must do so in a way which is compliant with data protection requirements", and then sets the test: "Just because a form of monitoring is available, does not mean it is the best way to achieve your aims. You must be clear about your purpose and select the least intrusive means to achieve it".

The regulator's own worked example is this exact problem. "After an employer discovers that a small number of remote workers started later than they recorded on their timesheets, it rolls out device monitoring. This allows senior management to access automatic webcam images and check if workers are at work." The verdict: "This is likely to infringe data protection law because it is disproportionate, and there are less intrusive ways to check start times." And the alternative it names: "The employer can achieve the same purpose by checking the times workers log onto the computer system, and then give workers the opportunity to explain any discrepancies."

Covert monitoring is the question people really want answered, and the guidance does not shut the door. It states that "It is unlikely that you will be able to justify covert monitoring in most usual circumstances", then names this category of allegation as the exception: there may be exceptional circumstances, "for example, if covert monitoring is necessary to enable you to prevent or detect suspected criminal activity or gross misconduct". The conditions are specific. It "should only be authorised by senior management", "You must carry out a DPIA", you should have "grounds for suspecting criminal activity (or an equivalent, such as gross misconduct)" and a reason to think telling people "would prejudice its prevention or detection", you should target it "within a set timeframe, limited to the shortest time possible", and you "should not continue the covert monitoring after the investigation is complete". Not in toilets or changing rooms, and not over private communications.

Read as a sequence, that is a permission almost nobody is ready to use on a first suspicion. Our post on employee monitoring software covers the wider duties.

Can you take the money back?

This is where employers who handled the conduct side well still lose. Recovering pay for hours you believe were not worked is governed by Part II of the Employment Rights Act 1996, and it is not automatic.

Section 13(1) provides that "An employer shall not make a deduction from wages of a worker employed by him" unless one of two things is true: "the deduction is required or authorised to be made by virtue of a statutory provision or a relevant provision of the worker's contract", or "the worker has previously signified in writing his agreement or consent to the making of the deduction". A relevant contractual provision means, in the section's own words, a written term "of which the employer has given the worker a copy on an occasion prior to the employer making the deduction in question".

Two subsections close the obvious workaround. Section 13(6): "an agreement or consent signified by a worker does not operate to authorise the making of a deduction on account of any conduct of the worker, or any other event occurring, before the agreement or consent was signified". Section 13(5) says the same about varying the contract after the event. Paperwork signed at the disciplinary hearing does not reach backwards.

The exposure is real. A worker may complain to a tribunal, and section 23(2) now gives them six months from the date of payment, the word "six" having been substituted for "three" on 1 October 2026 by the Employment Rights Act 2025. Then section 25(4) bites: where a tribunal has ordered repayment, "the amount which the employer is entitled to recover (by whatever means) in respect of the matter in relation to which the deduction or payment was originally made or received shall be treated as reduced by that amount". An unlawful deduction can therefore turn a sum you might have recovered into one you cannot recover at all.

One distinction matters more than any of this. Declining to approve a timesheet before the pay run and clawing back money already paid are different acts. The first is a question about what was properly payable; the second is a deduction and needs a gate. Where the line falls depends on the contract and the facts, so take advice rather than assume the first framing covers you. Our post on payroll deductions sets out the lawful grounds in full.

The records the case will turn on

The record you are already required to keep is the record the case rests on. Regulation 59 of the National Minimum Wage Regulations 2015 requires an employer to keep "records sufficient to establish that the employer is remunerating the worker at a rate at least equal to the national minimum wage", in a form that allows the information for a pay reference period "to be produced in a single document". Those records must be kept for six years.

Written for a minimum wage inspection, it happens to describe exactly what a disciplinary hearing needs: the raw scans, by person, by period, with the edit trail showing who changed what and when. If your system can produce only a tidy summary report, you have an assertion rather than evidence, and the employee's representative will say so.

Handling a suspected case

Two points are easy to miss inside that sequence. Ask what the clock actually proves, which is usually that a credential was presented and not that a person was present. And keep the "arranged, covered, tolerated" distinction live through the interviews, because it decides the outcome for each worker separately. The pay question comes afterwards, on the Part II test above, and never in the same conversation.

The proportionality test before biometrics

Fingerprint and face clock-in is where most articles on this topic become unreliable, so it is worth being exact. Under Article 9(1) of the UK GDPR, processing "biometric data for the purpose of uniquely identifying a natural person" is among the categories that "shall be prohibited", unless one of the Article 9(2) conditions applies. It is a prohibition with exceptions, not a setting.

The Information Commissioner's Office guidance, Can we use biometric data for time and access control and monitoring?, last updated on 06 June 2024, names this use case directly. It defines attendance monitoring as "a method of recording when someone starts and stops working at a specific location", and the impact assessment is not negotiable: "Yes, you must carry out a DPIA whenever you intend to process biometric data to uniquely identify a worker. This is because processing biometric data is considered high risk. You must complete your DPIA before starting the processing."

Consent is where the regulator's own pages pull in different directions. The monitoring guidance warns that "consent is not usually appropriate in the employment context, due to the imbalance of power between you and your workers. Workers are likely to feel that they have no choice but to give you consent." The biometric guidance is more permissive where a genuine opt-out exists, and our post on the employee time clock sets out both passages side by side rather than pretending they agree.

What settles it in practice is proportionality, and the regulator supplies the worked example. A factory manager proposes facial recognition on the doors so workers can clock in and out. After a DPIA, "The company concludes that they cannot demonstrate it is entirely necessary or proportionate to use facial recognition on all of their workers", and it "cannot rely on consent as the lawful basis or condition of processing, as the proposed system offers no alternative method of access for the workers". The guidance is blunt about the documentation too: "If a reasonable alternative option to using biometric data is possible, you should be able to justify why you don't use this method."

So the test before anyone orders hardware is four questions, answered in writing. What is the loss, in pounds, over a year? Which less intrusive controls have you tried and what happened? What is the alternative for someone who opts out, and is it genuinely free of detriment, including queue length and manager sign-off? And is the impact assessment finished before the order is placed, or written afterwards to justify a decision already taken?

Where employers go wrong

• Buying hardware instead of running a process. A stricter clock does not cure a case already in flight.
• Deducting first. The conduct outcome and the pay outcome are separate decisions with separate tests.
• Charging the wrong person. The late arrival and the colleague who scanned for them are not in the same position.
• Enforcing an unwritten rule. If the conduct policy is silent, write it, publish it, and enforce it from then on.
• Rolling out surveillance to everyone because of three people, which is the disproportionality the regulator describes.

Frequently asked questions

What is buddy punching?

Buddy punching is one worker recording a clock-in or clock-out for another who is not there. The name is American and comes from the mechanical card clock, where a timecard was punched into a machine. The method can be a lent card, a shared PIN, a phone passed to a colleague or a line added to a paper timesheet.

Is buddy punching illegal in the UK?

There is no offence of that name in United Kingdom law. It is treated as alleged misconduct and handled under the employer's disciplinary procedure, with the Acas Code of Practice on disciplinary and grievance procedures setting the minimum process. Depending on the facts it may also amount to dishonesty with criminal implications, which is a matter for advice rather than assumption.

Is buddy punching gross misconduct?

It can be. The Acas Code says some acts are so serious that they "may call for dismissal without notice for a first offence", but adds that "a fair disciplinary process should always be followed, before dismissing for gross misconduct". It also expects your own disciplinary rules to give examples of what you regard as gross misconduct. The label is a conclusion reached after an investigation, not a starting point.

Can an employer deduct pay for hours it believes were not worked?

Not automatically. Section 13 of the Employment Rights Act 1996 permits a deduction only where a statutory provision allows it, where a written contractual term already given to the worker allows it, or where the worker consented in writing beforehand. Consent signed after the event does not authorise a deduction for conduct that happened earlier.

Can an employer use covert monitoring to catch buddy punching?

Rarely, and never casually. The Information Commissioner's Office says it is unlikely you can justify covert monitoring in most usual circumstances, while allowing exceptional cases where it is necessary to detect suspected criminal activity or gross misconduct. The conditions include senior management authorisation, a completed impact assessment, grounds for suspicion, a strictly limited timeframe, and stopping once the investigation ends.

Does an employer need consent to use a fingerprint clock?

It needs a lawful basis and a separate special category condition, because biometric data used to identify someone is special category data. Consent is one possible route and only works where a real alternative such as a card or PIN is offered with no detriment. An impact assessment must be completed before the processing starts.

Your next step: handle the case, then look at the clock

1. Write down which of the three situations you have: arranged, covered or tolerated. The outcome for each person follows from that.
2. Export the raw scans and the edit trail today, before anyone tidies a timesheet.
3. Check your conduct rules for a clause on falsifying a time record. If there is none, that is a drafting job, not a dismissal.
4. Run the process in the Code's order, with different people investigating and deciding where you can manage it.
5. Decide the pay question separately, against the section 13 gates, and get advice before recovering anything already paid.
6. Only then look at the clock, and if biometrics come up, finish the impact assessment before the purchase order.

To put the conduct rule itself in writing, read and download our code of conduct guide. The guide is free to read, and the PDF uses our short download form.

Want the conversations that catch this early to leave a record you can rely on later? Book a New Dynamics demo and bring your current conduct policy. You can also email contact@new-dynamics.com.