Electronic access control quietly processes personal data all day long: who entered, when and through which door, and sometimes biometric templates too. That makes your doors part of your data estate. If you design the system around outcomes and good governance from the start, you’ll end up with security that’s reliable, safe and easy to defend under audit. If you bolt “compliance” on at the end, you’ll fight fires for years.

At ACCL we scope, install and support systems across single-site offices and multi-site estates. If you want help translating this checklist into a scoped programme with documents you can put in front of the board, our team can take you from survey to handover. (See: Commercial Access Control Installation.)

This article is general guidance, not legal advice. Involve your DPO early.

Start with purpose and minimisation

Write a one-page operational requirement that states who should go where, when, and why you’re recording it. The NPSA frames Automatic Access Control Systems (AACS) exactly this way: controlling who goes where and when with an auditable trail. That focus keeps processing necessary and proportionate and stops function creep.

Choose the right lawful basis (and Article 9 condition if using biometrics)

Access logs are personal data. Pick a lawful basis (often legitimate interests for premises security; public task where applicable) and document your assessment. If you use biometric recognition (e.g., fingerprint or face) to identify people, you’re processing special category data and you also need an Article 9 condition (and, in some cases, DPA 2018 Schedule 1 support). The ICO’s biometric guidance is explicit that biometric recognition systems process special category data and explains how to run them lawfully and fairly.

Do a DPIA before you build, not after

A Data Protection Impact Assessment is required before deploying biometric recognition and is strongly advised where systematic monitoring occurs (e.g., around entrances). Do it early: identify necessity, proportionality, risks, mitigations, and any alternatives (e.g., cards/fobs instead of biometrics). The ICO sets this out plainly in its biometric guidance.

Be transparent: privacy information and signage that people will actually see

Tell people what you’re doing in clear language at the point of capture: who controls the system, what’s collected, why, how long you keep it, how to exercise rights, and who to contact. If cameras are part of the door journey, the ICO’s surveillance guidance covers signage and privacy notice content; it’s a useful benchmark to keep notices concise and compliant.

For visitors, align reception and access control; don’t over-collect. The ICO’s own “Visitors to the office” example shows a proportionate approach (verify ID if needed; don’t routinely record document details; destroy personalised badges after the visit). Update your on-site privacy notice and website page accordingly. (See: Privacy Policy.)

Retention: set it, justify it, automate it

Keep access logs only as long as they’re needed for security, investigations and compliance, then purge automatically. Avoid blanket “forever” retention. The ICO’s surveillance guidance anchors this to the UK GDPR storage limitation principle; write the period into policy, configure the platform to enforce it, and log deletions.

Security of processing: harden the platform and the network

Treat access control like any other critical system. Use role-based admin, strong MFA for administrators, time-synced logs, encrypted data at rest/in transit, and segmented VLANs for controllers/gateways. If parts of your system are cloud-managed, align supplier due diligence and your configuration to the NCSC Cloud Security Principles (identity & authentication, secure service administration, audit for customers).

If you issue mobile credentials to staff phones, apply a sensible BYOD stance (screen lock, current OS, revoke on loss) and follow NCSC/ICO guidance on BYOD so your policies, controls and helpdesk processes are defensible.

Processors, contracts and international transfers

Your installer and platform vendor may act as processors. Put GDPR-compliant data processing terms in place (instructions, confidentiality, sub-processors, security, assistance with rights and breaches). If any personal data leaves the UK (e.g., cloud support or hosting), you need a valid transfer tool, typically the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs, plus a transfer risk assessment. The ICO’s transfer pages explain when a transfer is “restricted” and how to use IDTA/Addendum correctly.

Biometrics governance: proportionality, alternatives and template security

If you adopt biometrics, build proportionality into the design (e.g., reserve biometrics for higher-risk doors; use card+PIN elsewhere), offer a reasonable non-biometric alternative for those who can’t or won’t enrol, and secure templates rather than storing raw images. ICO enforcement in 2024 against an employer using facial recognition/fingerprint for attendance is a clear reminder: you must justify necessity over less intrusive options and provide alternatives.

Workers’ monitoring: set clear boundaries

Access control is for safety and security, not covert productivity monitoring. The ICO’s Monitoring at Work guidance expects organisations to consider fairness, transparency, impact on workers, and to avoid covert monitoring except in rare, exceptional circumstances. If you intend to reuse access data for HR monitoring, you’ll need a fresh assessment and very careful justification.

Rights requests: plan how you will respond

People can make subject access requests for their personal data in access logs and, where relevant, related video. Decide how you’ll locate, review and extract events without disclosing others’ data. The ICO’s surveillance guidance is helpful on handling requests involving video imagery; apply similar care to event logs that reference multiple individuals.

Accountability in practice: records, training and audits

Keep a Record of Processing for access control (purposes, categories, recipients, retention, transfers, security measures). Train reception, security and administrators on privacy basics: adding/removing users, visitor issuance, retention, and how to handle rights requests. Audit annually that policy matches platform configuration and that retention and deletion work as intended. Delivering the system to a recognised code of practice, such as NSI NCP 109, helps you evidence a disciplined lifecycle (design, installation, commissioning, maintenance).

Design for safe escape: compliance isn’t just privacy

Security can never impede evacuation. For doors on escape routes, design and test release on fire alarm and relevant faults in line with BS 7273-4; capture this in your commissioning pack and drill records. Privacy law sits alongside life safety; treat both as non-negotiable design requirements. If your doors and cameras talk to each other for investigations, engineer that integration properly so releases remain logged and auditable. (See: CCTV, Access Control and Alarm Integration.)

Visitors and contractors: keep the journey tight (and documented)

Pre-register visitors, issue time-bound, least-privilege credentials on arrival, and log releases via the controller (not a dry-contact bypass) so every grant is auditable. Align your VMS and access policies, and publish concise visitor privacy information at reception. Pair intercoms with the access platform so manual releases still create events. (See: Entry Phone Installation.)

Put it all together: a simple project-ready flow

Draft the AACS operational requirement (purpose, zones, users, audit).
Select lawful basis (+ Article 9 condition if biometrics), then complete a DPIA.
Specify retention and transparency; prepare signage and privacy notices.
Lock in processor terms and any international transfer tools (IDTA/Addendum).
Harden the platform (admin MFA, RBAC, logs), segment networks; align cloud parts to NCSC principles.
If biometrics are used, build proportionality and alternatives into design; secure templates.
Commission with witness tests, retention automation and user training, then audit annually.

Do those things and you’ll have doors that are safe, secure and demonstrably compliant, without drowning your team in paperwork.

Written by

Wayne Connors

Founder & Managing Director, ACCL

Wayne founded ACCL in 1997 and has led more than 28 years of project delivery, helping organisations design, install and modernise the network infrastructure behind reliable connectivity, office moves and refurbishments. His experience spans copper cabling, fibre backbones, data centre infrastructure, Wi-Fi, CCTV and access control. About ACCL