What buddy punching is
Buddy punching, sometimes called proxy attendance, is the practice of one employee recording a colleague’s arrival or departure, so that the attendance record shows an arrival that did not happen, or a departure at a time other than the real one.
Buddy punching can look like lateness or absence, but it does not belong in the same category. Lateness is an event in attendance that the system records as it happened. Buddy punching is an event in the record itself: the fault is that the entry does not match what took place. The difference lies not in seriousness but in where the fault sits, and every sound response depends on it.
Why buddy punching affects more than attendance
An attendance record is not an administrative report that is filed and forgotten. It is the source from which an organisation derives what is paid, what is deducted, what goes into the wage file uploaded under the Wage Protection System, and what is produced in any dispute over a period of service or an entitlement. When an entry is corrupted, everything built on it is corrupted too, and the damage shows up not where it starts but in what the record produces.
That is the source of one error in handling buddy punching: regarding the incident as lost minutes and answering it with a deduction to match. The minutes are the smallest part of the problem. More significant is that the organisation no longer holds a record it can rely on as evidence, not only for this incident but for the whole period during which the route to it was open.
A calculation that shows the scale of buddy punching
Take a department of 20 employees in which three are recorded as leaving about 30 minutes later than they actually leave, in a month of 22 working days:
- For one employee: 30 minutes × 22 = 660 minutes, or 11 hours a month.
- For the three: 33 hours a month, or about 396 hours a year.
The calculation assumes a month of 22 working days and a day of eight hours, which gives 176 hours a month. On that basis, 396 hours come to about two and a quarter months of one additional employee’s working time. The result changes with the basis, which is why the basis is stated with it: on an assumed working week of 45 hours, or 195 hours a month, the figure is about two months. A figure of three months would assume a month of 132 hours, a basis nobody has stated and on which the calculation does not rest. All of this comes from a department of twenty people and half an hour for three of them. What makes buddy punching worth controlling is not the amount in any one incident but the way incidents add up without anyone noticing.
Converting these hours into riyals depends on how an hour’s wage is derived from the monthly wage. We found no general rule in the Saudi Labor Law (نظام العمل) setting that derivation for a fixed monthly wage, so no approximate riyal figure is given. The hours alone are enough to show the scale. Whether an organisation can recover pay for hours it paid on the strength of a false entry is a separate question. Deductions from wages have their articles and ceilings, set out in our guide to wage deductions, and the answer is not something the definition of buddy punching supplies.
Where buddy punching sits in the Saudi Labor Law
Article 65 of the Labor Law lists the worker’s duties, and its third item requires the worker to observe good conduct and morals during the work. That is the duty within which buddy punching falls. It is a duty under the text of the Labor Law, and it does not depend on being repeated in an internal document.
The response passes through the same steps as any penalty. Under Article 71 of the Labor Law, no disciplinary penalty may be imposed until the worker has been notified in writing of what is alleged against them, questioned, and their defence investigated, with all of this recorded in a minute placed in their employee file. The same Article allows the questioning to be oral for minor violations whose penalty goes no further than a warning or a fine of no more than one day’s wage, provided this is recorded in the minute. Article 71 of the Labor Law states the duty and does not state the consequence of breaching it, so no consequence is drawn from it.
Which penalty fits buddy punching is not settled by the definition. The list of penalties in Article 66 of the Labor Law is closed, and the choice from it follows what the organisation’s approved work organisation regulation provides and the seriousness of what has been proven. What that regulation may contain is set out in our guide to the work organisation regulation.
Buddy punching involves two people, not one
What sets buddy punching apart is that it has two actors: the employee who was recorded, and the employee who did the recording. That has two consequences, and both can be missed together:
- Each of them needs a separate procedure. Article 71 of the Labor Law addresses the worker to whom an act is attributed, and in buddy punching the act is attributed to two workers. A single minute about the incident does not take the place of two notifications, two questionings and two investigations of a defence.
- Each of them did something different. One was absent and had their attendance recorded. The other made an entry, in someone else’s name, about an event they had no knowledge of. Those are two acts, not one act with two participants, and each is described separately before deciding what response fits it.
Article 70 of the Labor Law adds a limit that bears on buddy punching: no more than one penalty may be imposed for a single violation. An organisation that responds to the incident with both a deduction from wages and a disciplinary action needs to know which heading each falls under, because the two cannot stand together as two penalties for one violation.
Article 80 of the Labor Law sets out nine cases in which the employer may rescind the contract without an award, notice or compensation, on condition that the worker is given the opportunity to state the reasons for objecting to the rescission. One of them is proven bad conduct, or an act offending honour or honesty. The definition of buddy punching does not establish that an incident of it falls within that case. Classifying a particular incident is a matter for the body competent to decide it; what can be said is that the case exists in the text, under the condition the text attaches to it. The nine cases are set out in our guide to Articles 80 and 81.
How buddy punching is detected, and the problem of proof
Buddy punching cannot be detected by looking at entries one at a time, because by definition each entry looks sound. It can be detected through patterns that appear on comparison: two people’s entries matching to the second day after day; an entry made from a device its owner has no reason to pass; an attendance entry on a day for which leave has been approved; a departure recorded an hour before the person’s last trace in another system.
This raises a problem worth naming: the record that would prove the incident is the very record under challenge. Proof cannot rest on it alone. It needs a second source independent of it, one that already exists for a different purpose: door access logs, system login records, or the work output itself and its timestamps.
That second source is what allows the investigation of the defence required by Article 71 of the Labor Law to be carried out in substance. Investigating a defence is not writing down a denial or an admission. It is testing what the worker says against a source that can contradict it or confirm it. An organisation that holds only the challenged record holds nothing against which a defence can be investigated at all.
Controlling buddy punching is more useful than penalising it
The root of buddy punching lies in how the entry is designed: in which record can one person stand in for another? A card that is swiped passes from hand to hand, a password can be passed on, and a paper register can be signed for an absent colleague. All three make standing in possible at no cost.
One technical response is biometric identification, and it closes one door while opening another. Article 1(11) of the Personal Data Protection Law (PDPL) classes biometric data as sensitive data. We have not reviewed the additional duties that follow from that classification, so none is listed. What an organisation needs to know is that choosing this method is a decision about processing data classed in that way, not a purely technical decision.
One administrative control needs no tool: a clear statement in the organisation’s approved documents that recording attendance is personal and cannot be done on someone else’s behalf, made known to everyone in advance, whether in a code of conduct or in the work organisation regulation. A rule that was not written down in advance carries less weight when it is invoked later.
What buddy punching is not
- Lateness and absence. These are events the system records as they happened, and their frequency can be measured through the absenteeism rate. Buddy punching leaves no trace in that rate at all, because the record says the person was present.
- Attendance regularisation. Regularisation is a declared route through which a wrong entry is corrected with the organisation’s knowledge and approval. Buddy punching enters a false entry without its knowledge. The first corrects an error; the second creates one.
- Leaving with permission. An employee who leaves with recorded permission has committed no incident, even if the departure shows before the end of the working day. The permission is an entry in the record, not a gap in it.
- A system fault. An entry missing because a device failed, or duplicated by a repeated swipe, is a technical fault corrected through the declared route. Attributing it to the employee before the device is checked opens a procedure over an incident that never happened, and can undermine confidence in the whole control.
- Working away from the premises. An employee working at another site under an approved arrangement cannot have their entries measured against those of someone working at the premises. The response starts with defining what is recorded at all, not with suspicion.
A control announced in advance works before any incident occurs. An employee who knows that entries are compared against another source needs no one to stop them. An employee who does not know may take the organisation’s silence as permission. The difference between the two is an announcement that costs nothing.
The provisions relied on are those of the Saudi Labor Law as published by the Ministry of Human Resources and Social Development: Article 65 (the worker’s duty of good conduct), Article 66 (the closed list of penalties), Article 70 (one penalty per violation), Article 71 (the procedure before any penalty) and Article 80 (the cases of rescission without award, notice or compensation). Royal Decree M/44 of 1446H, in force since 19 February 2025, did not amend Articles 66, 70, 71 or 80 of the Labor Law. The classification of biometric data is that of Article 1(11) of the Personal Data Protection Law as published by the Saudi Data and Artificial Intelligence Authority (SDAIA).
Before the first buddy punching case is opened
One sequence can prevent error: keeping two questions apart, what happened? and what will be done? The first is answered by an inquiry that establishes the incident with both of its parties and names what each of them did. The second does not begin until the first has been answered. An organisation that starts with the penalty and then looks for something to support it has reversed the order the statutory procedure described above requires.
Then comes the question that can go unasked: why was it possible? A single incident may be one person’s act. A repeated pattern in one department says something about the record, not about the people. Responding to the second as if it were the first addresses the last link in the chain and leaves the first one in place.
This is an explanation of the concept and of the statutory provisions cited, not legal advice.
A standalone Saudi HR system
One employee file holding the contract, the documents and their expiry dates, the attendance record, leave, salary and end-of-service entitlements. End-of-service, overtime and leave-balance calculations are built into the system.
A standalone system on its own subscription. The connection to Qoyod Accounting is now available.