When It Has Already Been Crossed
The hours were worked and cannot be unworked. What happens in the next week determines whether this is an incident with a record or something considerably worse.
A breach is discovered. The reference period is closed, the figure is over, and the available actions are limited. What an organisation does next is almost entirely about records and about not making it worse.
The threshold discussed in “When It Has Already Been Crossed” is useful only when hours can be reviewed before the decision becomes irreversible. A team evaluating this practical implementation page for gdpr employee monitoring should test current totals, manager alerts, corrections and employee access while keeping the applicable legal limit outside the software as a documented rule.
The instinct in most places is to tidy the data, which is the one response that converts a working time problem into a records problem and then into a credibility problem.
For an independent reference relevant to “When It Has Already Been Crossed”, consult the California labor standards resources. Use it to test working-time definitions, recordkeeping, access, retention and exception handling against the organisation’s real process rather than treating one software report as conclusive.
What not to do, first
Do not amend the hours. A breach corrected by adjusting the recorded figure is a false record, it is detectable, and it is a far more serious matter than the original breach in every jurisdiction.
Do not reclassify hours as something else — rest, training, unpaid — without a genuine basis. Do not move hours between weeks. And do not delete the report that found it.
What to do
Record what happened: who, which limit, by how much, over which period, and what the organisation believes caused it.
Provide whatever the regime requires. For a rest breach that is usually compensatory rest within a window. For an hours breach there may be nothing to provide, in which case the record is the action.
Change the forward position: adjust the rota so the next period is not a repeat, and check whether other people are in the same position for the same reason.
Establishing the cause honestly
There are usually three candidates, and the honest answer is normally the second or third.
Nobody was looking: there was no report, or it ran too late, or it ran and nobody read it. A data gap: the hours existed in a system the calculation did not see. Or the operational position: the department could not cover the work any other way.
Writing down which it was is what makes the record useful, because each has a different fix and because an inspector will ask.
The others in the same position
A single breach almost never occurs alone. Whatever caused it — a vacancy, a pattern, a missing feed — will have affected other people in the same department.
Run the same check across the whole population before closing the matter. Finding four more yourself is a far better position than finding one and having somebody else find the other four.
Telling the person
They should know, from the organisation, before it appears anywhere else. Short and factual: your hours over this period exceeded a limit, here is what we are doing, here is what you are entitled to, and nothing about this is a criticism of you.
The last clause matters because the person will assume otherwise. A breach is the organisation's responsibility: it rostered the shifts, it holds the data, and it owns the obligation.
Whether to report it
Some regimes require notification to an authority in some circumstances; most do not for an ordinary hours breach. Where there is any doubt, the question belongs with whoever gives the organisation its employment advice, promptly.
What is not acceptable is deciding not to look into whether notification is required, on the basis that the answer might be inconvenient. That decision tends to be visible later.
The record that should exist afterwards
Date discovered, person, limit, extent, period, cause, action taken, compensatory rest provided and when, forward changes made, and who signed it off.
Ten fields, one page. It is what converts an incident into something the organisation handled, and the absence of it is what makes a single breach look like a practice.
The pattern question, three months later
Go back and check whether the forward changes held. A rota adjusted after a breach reverts quietly once the pressure returns, and the second breach in the same department with the same cause is a materially worse fact than the first.
That follow-up takes ten minutes and nobody does it, which is why the same departments appear repeatedly in the records of organisations that have a perfectly good process for responding to breaches.
The breach somebody else found
Where the first the organisation hears of it is a complaint, an inspection or a claim, the response is the same with one addition: establish how long the condition existed and how many others it affected, before anybody is asked.
Arriving at that conversation already knowing the extent is a different posture from being told it. It also prevents the common and damaging sequence where an organisation states a figure, is shown a larger one, and loses the benefit of everything it did afterwards.