To meet the GDPR requirements for access control systems, companies must observe the principles of data minimisation and purpose limitation, define a clear legal basis for the data processing, and implement suitable technical and organisational measures (TOMs). This also includes transparent information obligations, ensuring data subject rights, and comprehensive documentation of processing activities, ideally supported by independent specialist planning.

Legally compliant planning and implementation of access control systems

Modern access control systems are essential for corporate security, yet they also carry data protection challenges. This article examines the key GDPR requirements and shows how you can design your access control system to be legally compliant, avoiding fines and strengthening the trust of your employees.

Key Takeaways

  • Legally compliant planning of access control systems requires strict adherence to the GDPR principles of data minimisation and purpose limitation.
  • Comprehensive technical and organisational measures (TOMs) and a clear deletion concept are essential to protect data and ensure data subject rights.
  • Manufacturer-independent planning by independent experts such as PLANATEL® secures an optimal, future-proof, legally compliant implementation of your access control system.

Access control systems (ZKS) are a fundamental part of the physical security of companies and organisations. They protect sensitive areas, property and people from unauthorised access and contribute significantly to maintaining operations. At the same time, these systems process personal data, which places them within the scope of the General Data Protection Regulation (GDPR). Designing and operating an access control system in a legally compliant way is therefore a complex task that requires sound expertise and careful planning. Mistakes in this area can not only lead to substantial fines, but can also permanently damage the trust of employees and business partners. PLANATEL® has supported you since 1992 with manufacturer-independent expertise in planning and optimising your security systems, to help you successfully meet these challenges.

Article image: Access Control System GDPR Requirements Compliance - hero

GDPR fundamentals for access control systems

Access control systems capture and process a wide range of personal data, including names, personnel numbers, access times, locations and permissions. Biometric systems also add sensitive data such as fingerprints or facial-recognition features. GDPR sets out clear principles for handling such data, which must be strictly observed when planning and operating a ZKS. These include, in particular, the principles of lawfulness, fair processing, transparency, purpose limitation, data minimisation, storage limitation, integrity and confidentiality, and accountability.

The principle of data minimisation, for example, requires that only the data strictly necessary for the defined purpose be collected. This means a ZKS should not store more information than is necessary to ensure security and fulfil the defined purpose. The transparency obligation requires that data subjects be comprehensively informed about the data processing, including the purpose, the legal basis, the retention period and their rights. Accountability, in turn, requires the controller to be able to demonstrate compliance with these principles at all times. A careful analysis of data flows and the systems involved is therefore crucial from the outset, to establish a legally compliant basis.

Legally compliant data processing and purpose limitation

Any processing of personal data by an access control system requires a clear legal basis under Art. 6 GDPR. For ZKS, three legal grounds are primarily relevant: the legitimate interest of the controller (Art. 6(1)(f) GDPR), the performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR), and the explicit consent of the data subject (Art. 6(1)(a) GDPR).

Legitimate interest is often used as the legal basis, particularly where the protection of property, trade secrets or employee safety is at stake. This requires a careful balancing of the company's protective interests against the fundamental rights of the data subjects. When recording working hours via a ZKS, performance of a contract (employment contract) may be relevant. Consent is particularly important when processing special categories of personal data, such as biometric features. Here, consent must be voluntary, informed and revocable, which is often difficult to guarantee in an employment relationship due to the relationship of dependency. Purpose limitation is of central importance here: data collected for access control purposes may not simply be used for other purposes, such as comprehensive performance or conduct monitoring. A clear definition of the processing purposes prior to implementation is therefore essential.

Technical and organisational measures (TOMs) in practice

Article 32 GDPR requires the implementation of suitable technical and organisational measures (TOMs) to ensure a level of protection appropriate to the risk. For access control systems, these measures are essential to ensure the confidentiality, integrity and availability of the processed data. The TOMs can be divided into the areas of Zutrittskontrolle (physical access), Zugangskontrolle (system access) and Zugriffskontrolle (data access).

Zutrittskontrolle refers to the physical protection of rooms and buildings that house data processing equipment. This includes measures such as security locks, alarm systems, video surveillance of entrances, as well as organisational rules for keys and visitors. Zugangskontrolle prevents unauthorised use of the data processing systems themselves, for example through user IDs, passwords, multi-factor authentication or biometric methods. Finally, Zugriffskontrolle ensures that authorised users can only access the data for which they hold permission. This is achieved through role-based permission concepts, logging of access, and encryption of sensitive data. Regular review and adjustment of these measures is necessary to respond to new risks and technological developments. PLANATEL® supports you in the manufacturer-neutral design of these TOMs, to find an optimal, future-proof solution.

Article image: Access Control System GDPR Requirements Compliance - mid

Data minimisation, retention periods and deletion concepts

The principle of data minimisation (Art. 5(1)(c) GDPR) is a cornerstone of data protection and states that personal data must be adequate, relevant and limited to what is necessary for the purposes of processing. For access control systems, this means that only the data strictly necessary to fulfil the security purpose, or another defined legal basis, may be captured.

Closely related is the principle of storage limitation (Art. 5(1)(e) GDPR), which requires that personal data only be stored for as long as necessary for the purposes for which it is processed. This requires the development and implementation of a detailed deletion concept. The retention period for access data should be kept as short as possible. For purely security purposes, a maximum retention period of 72 hours is often recommended, unless security-relevant incidents require longer retention. When a ZKS is used for time recording, longer statutory retention periods (e.g. under employment or tax law) may apply, but these must be clearly defined and documented. Companies must ensure that data is automatically and irrevocably deleted once the deadlines have passed. PLANATEL® advises you on preparing such concepts and selecting systems that can technically implement these requirements.

Data subject rights and their implementation

GDPR strengthens the rights of natural persons with regard to the processing of their data. Those responsible for access control systems must provide mechanisms and procedures that enable data subjects to effectively exercise these rights. The most important rights include the right to information (Art. 15 GDPR), the right to rectification (Art. 16 GDPR), the right to erasure ("right to be forgotten", Art. 17 GDPR) and the right to restriction of processing (Art. 18 GDPR).

In concrete terms, this means that employees or visitors can request, at any time, information about which of their personal data is stored in the access control system, for what purpose, and for how long. They have the right to have inaccurate data corrected or to request deletion of their data, provided no statutory retention obligations or other legitimate grounds apply. Where a right to object (Art. 21 GDPR) is exercised against processing based on a legitimate interest, the company must stop the processing unless it can demonstrate compelling legitimate grounds. Implementing these rights requires not only technical provisions within the ZKS, but also clear internal processes and trained staff, to handle requests within the statutory deadlines and in a legally compliant manner. Transparent communication about these rights is also mandatory and should take place as early as the point of data collection.

Data protection impact assessment (DPIA) and documentation obligations

GDPR obliges controllers to carry out a data protection impact assessment (DPIA) where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons (Art. 35 GDPR). This is often the case with access control systems, particularly where sensitive data (e.g. biometrics) is processed extensively, or publicly accessible areas are systematically monitored.

A DPIA is a preventive instrument that identifies and assesses risks and proposes risk-mitigation measures before processing begins. It should be understood as a dynamic process that is reviewed and updated regularly. In addition to the DPIA, comprehensive documentation obligations must be met. The record of processing activities (Art. 30 GDPR) is a central instrument here, documenting all processes in which personal data is processed. It must include details of the processing purposes, data categories, recipients, retention periods and the implemented TOMs. Complete documentation serves not only accountability towards supervisory authorities, but also internal transparency and the continuous improvement of the level of data protection. PLANATEL® supports you in preparing these necessary documents and carrying out DPIAs, to make your processes legally compliant from the outset.

Manufacturer-independent planning as a decisive success factor

The complexity of GDPR requirements, combined with the variety of technical solutions for access control systems, calls for a strategic approach. Here, manufacturer-neutral planning proves to be a decisive success factor. Many providers of access control systems offer solutions that are ostensibly GDPR-compliant, yet are often based on proprietary technologies that create strong manufacturer dependency. In the long term, this can lead to higher costs, reduced flexibility, and difficulties adapting to future requirements.

PLANATEL® has operated as an independent planning and consulting service provider since 1992. Our expertise lies in developing tailored concepts that are precisely matched to your specific needs while also meeting the highest standards of legal compliance. We are financially independent of manufacturers and system integrators, meaning our recommendations are always objective and in your best interest. We analyse your as-is situation, jointly define the target requirements with you, and prepare detailed planning documents for your access control system. This includes selecting suitable technologies and components, defining interfaces, and integrating them into existing infrastructure, always with current data protection provisions in mind, and avoiding manufacturer dependency. Our more than 34 years of experience ensure you receive a future-proof, legally compliant solution.

Article image: Access Control System GDPR Requirements Compliance - bottom

Next Step

Contact us for a no-obligation initial consultation.

PLANATEL®: Independent planning and consulting since 1992
Tel: 040 / 23 73 02-30
Email: info@planatel.de

Frequently Asked Questions

For operating an access control system, the most relevant legal grounds are primarily the legitimate interest of the controller (Art. 6(1)(f) GDPR) for protecting property and people, the performance of a contract (Art. 6(1)(b) GDPR) for time recording, or the explicit consent of the data subject (Art. 6(1)(a) GDPR), particularly for biometric data. Careful weighing and documentation of the chosen legal basis is essential.

What role do technical and organisational measures (TOMs) play in GDPR-compliant access control?

They comprise measures for Zutrittskontrolle (physical protection), Zugangskontrolle (protection of IT systems), and Zugriffskontrolle (protection of data within the systems). Examples include encryption, pseudonymisation, role-based permissions, logging, and secure storage systems. Regular review and adjustment of the TOMs is mandatory.

How can companies implement the rights of data subjects in access control systems?

Companies must establish processes to enable data subjects to exercise their rights, such as information, rectification, erasure and objection. This includes transparent information obligations (Art. 13, 14 GDPR), providing mechanisms for data requests and corrections, and ensuring the deletion of data once the retention period has expired. Staff training and clear responsibilities are essential here.

What must be considered when using biometric data in access control systems?

The processing of biometric data falls under special categories of personal data (Art. 9 GDPR) and is generally prohibited unless explicit consent is given or another exception applies. In addition, a data protection impact assessment (DPIA) is generally mandatory. Companies must carefully assess necessity and proportionality and consider alternative, less intrusive means.

Why is manufacturer-neutral planning of access control systems advantageous for GDPR compliance?

Manufacturer-neutral planning, as offered by PLANATEL®, ensures that the selection of components and systems is objective and based solely on your requirements and GDPR provisions. This avoids manufacturer dependency, enables the integration of optimal, legally compliant solutions, and secures long-term flexibility and cost efficiency. Independent consulting ensures that data protection aspects are an integral part of the system design from the outset.

Which data may be stored in an access control system?

An access control system may only store personal data strictly necessary for the defined purpose (e.g. building security, time recording). This can include identification data such as name and personnel number, as well as access data such as timestamp and location. The principle of data minimisation is decisive here.

Is a data protection impact assessment (DPIA) always necessary for access control systems?

A data protection impact assessment (DPIA) is always required where processing is likely to pose a high risk to the rights and freedoms of natural persons. This is often the case with access control systems, particularly when using biometric data or extensive monitoring, and should be carefully assessed.

How long may access data be stored?

The retention period for access data must be limited to the necessary minimum. For purely security purposes, a maximum retention period of 72 hours is often recommended, unless a specific security incident justifies longer retention. For other purposes, such as time recording, longer statutory periods may apply, but these must be clearly justified.

What is the difference between Zutrittskontrolle, Zugangskontrolle and Zugriffskontrolle?

Zutrittskontrolle governs physical access to rooms and buildings. Zugangskontrolle controls access to IT systems and applications. Zugriffskontrolle defines which users within a system may access which specific data. All three are important components of the TOMs.

Sources and further information

  • fm-connect.com
  • iloq.com
  • dataprotect.at
  • recogtech.com
  • almas-industries.de