Access control determines who may pass through a door and under which conditions. RFID cards, PIN codes and mobile credentials identify a permission holder; the controller checks permissions and records events.
Types of access control systems
RFID cards and key fobs
RFID credentials use different frequencies and identification methods. Frequency alone does not determine security: 13.56 MHz includes older implementations and credentials with cryptographic mechanisms such as MIFARE DESFire. Readers, keys and verification methods also matter.
PIN code and two-factor verification
For rooms with higher security requirements, such as a server room, a cash office or an archive, the card is combined with a PIN. A lost card on its own opens nothing, and every entry is logged with the time and the user.
Mobile access (Bluetooth/NFC)
A smartphone replaces the physical card. It is a convenient option for remote management and for granting temporary access rights.
Biometrics: when it makes sense and what it requires
Biometric data processed for unique identification falls within GDPR's special categories. Applicable grounds under Articles 6 and 9 are needed; an impact assessment is required where processing is likely to create high risk. Purpose, necessity and less intrusive alternatives shape the assessment.
For time and attendance, practice is restrictive: if a card does the same job, biometrics will hardly pass the proportionality test. For attendance tracking, a card or PIN is therefore the more appropriate choice, while biometrics are reserved for individual critical doors and only after a written impact assessment.
Biometric data storage depends on the particular device and software. Check the manufacturer's documentation, template protection, access controls and data deletion rather than assuming that every template is irreversible.
Integration with video surveillance
Combining access control with a CCTV system makes it possible to capture a snapshot automatically at every unlock, which is useful when investigating an incident and during internal audits. The retention period and the rights to access the archive are defined in advance.
Management and reporting
Centralized software makes it possible to manage hundreds of doors from a single computer, generate reports, set working hours for each card and assign zone-based access according to security level.
Further reading: GDPR.
