I'd think even under EU and GDPR logging whether user badged in or used VPN would be entirely fine.
Anyone with full time employment (at least here in Poland) will have attendance data in one or other way because it's required by law