u003ch3u003eThe legal frame at a glanceu003c/h3u003ernu003culu003ern tu003cli style=u0022font-weight: 400;u0022 aria-level=u00221u0022u003eu003cspan style=u0022font-weight: 400;u0022u003eAccess logs are personal data. You need a lawful basis (often u003c/spanu003eu003ciu003eu003cspan style=u0022font-weight: 400;u0022u003elegitimate interestsu003c/spanu003eu003c/iu003eu003cspan style=u0022font-weight: 400;u0022u003e for premises security) and you must apply the core GDPR principles—fairness, transparency, data minimisation, storage limitation, security and accountability. The ICO’s video surveillance guidance is the go-to reference whenever cameras are part of the entry journey.u003c/spanu003eu003cspan style=u0022font-weight: 400;u0022u003ernrnu003c/spanu003eu003c/liu003ern tu003cli style=u0022font-weight: 400;u0022 aria-level=u00221u0022u003eu003cspan style=u0022font-weight: 400;u0022u003eBiometrics usually raise the bar. If you use biometric recognition (e.g., fingerprint or face) u003c/spanu003eu003ciu003eu003cspan style=u0022font-weight: 400;u0022u003eto uniquely identify a personu003c/spanu003eu003c/iu003eu003cspan style=u0022font-weight: 400;u0022u003e, you’re processing special category biometric data. That requires u003c/spanu003eu003ciu003eu003cspan style=u0022font-weight: 400;u0022u003ebothu003c/spanu003eu003c/iu003eu003cspan style=u0022font-weight: 400;u0022u003e an Article 6 lawful basis and an Article 9 condition, plus careful governance (DPIA, alternatives, template security, retention). The ICO’s dedicated biometric guidance sets clear expectationsu003c/spanu003eu003cspan style=u0022font-weight: 400;u0022u003ernrnu003c/spanu003eu003c/liu003ern tu003cli style=u0022font-weight: 400;u0022 aria-level=u00221u0022u003eu003cspan style=u0022font-weight: 400;u0022u003eAudio recording is rarely justifiable. The ICO cautions that recording conversations is particularly intrusive and generally hard to justify: only do it if strictly necessary and proportionate.u003c/spanu003eu003cspan style=u0022font-weight: 400;u0022u003ernrnu003c/spanu003eu003c/liu003ern tu003cli style=u0022font-weight: 400;u0022 aria-level=u00221u0022u003eu003cspan style=u0022font-weight: 400;u0022u003eWorkers must be told clearly. UK GOV guidance reinforces the basics: tell workers u003c/spanu003eu003ciu003eu003cspan style=u0022font-weight: 400;u0022u003eifu003c/spanu003eu003c/iu003eu003cspan style=u0022font-weight: 400;u0022u003e they’re monitored, u003c/spanu003eu003ciu003eu003cspan style=u0022font-weight: 400;u0022u003ehowu003c/spanu003eu003c/iu003eu003cspan style=u0022font-weight: 400;u0022u003e, and u003c/spanu003eu003ciu003eu003cspan style=u0022font-weight: 400;u0022u003ewhyu003c/spanu003eu003c/iu003eu003cspan style=u0022font-weight: 400;u0022u003e—ideally in the staff handbook and onboarding materials, not just a poster on a wall.u003c/spanu003eu003ca href=u0022https://www.gov.uk/monitoring-work-workers-rights/email-cctv-and-other-monitoring?utm_source=chatgpt.comu0022u003eu003cspan style=u0022font-weight: 400;u0022u003e u003c/spanu003eu003c/au003eu003c/liu003ernu003c/ulu003e
u003ch3u003eu003c/h3u003ernu003ch3u003eu003cstrongu003eAccess Control in the Workplaceu003c/strongu003eu003c/h3u003ernu003cspan style=u0022font-weight: 400;u0022u003eElectronic u003ca href=u0022https://network-data-cabling.co.uk/knowledge-base/access-control/u0022u003eaccess controlu003c/au003e protects people and assets by deciding who can go where, when—and recording that outcome. Because those records are personal data (and, if you use biometrics, often u003c/spanu003eu003ciu003eu003cspan style=u0022font-weight: 400;u0022u003especial categoryu003c/spanu003eu003c/iu003eu003cspan style=u0022font-weight: 400;u0022u003e personal data), the system also sits squarely inside your privacy obligations as an employer. This long-form guide explains how to run access control that’s secure, safe and fair to your workforce—aligned to UK GDPR, the DPA 2018 and ICO guidance—without turning the front door into a privacy headache.u003c/spanu003ernrnu003cspan style=u0022font-weight: 400;u0022u003eIf you want a defensible design and commissioning plan, we can translate the steps below into a scoped specification, governance pack and staff-friendly roll-out. (See:u003c/spanu003eu003ca href=u0022https://network-data-cabling.co.uk/access-control-installation/commercial-access-control/u0022u003e u003cspan style=u0022font-weight: 400;u0022u003eCommercial Access Control Installationu003c/spanu003eu003c/au003eu003cspan style=u0022font-weight: 400;u0022u003e)u003c/spanu003ernu003ch3u003eWhy this matters (and why now)u003c/h3u003ernu003cspan style=u0022font-weight: 400;u0022u003eThe UK Information Commissioner has been clear: monitoring workers must be lawful, transparent and fair. The ICO’s 2023 guidance on monitoring workers specifically calls out the rise of new technologies and reminds employers to consider both the law u003c/spanu003eu003ciu003eu003cspan style=u0022font-weight: 400;u0022u003eandu003c/spanu003eu003c/iu003eu003cspan style=u0022font-weight: 400;u0022u003e workers’ rights before implementing any monitoring. In short: build privacy in from the outset, and be able to explain your choices.u003c/spanu003ernrnu003cspan style=u0022font-weight: 400;u0022u003eThe regulator has also acted. In 2024, the ICO ordered a major leisure operator to stop using facial recognition and fingerprint scanning to track attendance and to delete unnecessary biometric data, noting the employer had not justified why intrusive biometrics were needed over less-intrusive options and had not offered alternatives. That is a strong signal for all employers considering workplace biometrics.u003c/spanu003e
u003ch3u003eBuild your access control around privacy by designu003c/h3u003ernu003cspan style=u0022font-weight: 400;u0022u003eu003cstrongu003e1) Be up-front and specific (transparency)u003c/strongu003e.u003c/spanu003eu003cspan style=u0022font-weight: 400;u0022u003ernu003c/spanu003eu003cspan style=u0022font-weight: 400;u0022u003e Give staff clear, layered information at the point of capture and in internal docs. Say what you collect (door events, any associated images), why (safety and security), who sees it (security/FM/HR in defined circumstances), how long you keep it, and how to exercise rights. The ICO’s surveillance guidance shows what good signage and notices look like; mirror that approach for doors and lobby cameras.u003c/spanu003ernrnu003cstrongu003e2) Pick a defendable lawful basis.u003c/strongu003eu003cspan style=u0022font-weight: 400;u0022u003ernu003c/spanu003eu003cspan style=u0022font-weight: 400;u0022u003e For standard door logs, u003c/spanu003eu003ciu003eu003cspan style=u0022font-weight: 400;u0022u003elegitimate interestsu003c/spanu003eu003c/iu003eu003cspan style=u0022font-weight: 400;u0022u003e is common; document your assessment and safeguards (e.g., no tracking beyond what’s necessary for security). If you intend to reuse logs for HR purposes (e.g., productivity), reassess: the legal and ethical bar is higher and may be inappropriate. The ICO’s monitoring-workers guidance exists precisely to keep you from sliding into “function creep.”u003c/spanu003ernrnu003cstrongu003e3) Do a DPIA early for higher-risk cases.u003c/strongu003eu003cspan style=u0022font-weight: 400;u0022u003ernu003c/spanu003eu003cspan style=u0022font-weight: 400;u0022u003e If you process special category biometric data, or you systematically monitor entrances (especially where staff might feel compelled), complete a Data Protection Impact Assessment u003c/spanu003eu003ciu003eu003cspan style=u0022font-weight: 400;u0022u003ebeforeu003c/spanu003eu003c/iu003eu003cspan style=u0022font-weight: 400;u0022u003e you buy hardware. The ICO expects this; it is your evidence trail that you assessed necessity, proportionality and risks, and that you chose mitigations (alternatives, short retention, access controls, training).u003c/spanu003ernrnu003cstrongu003e4) Minimise and set retention.u003c/strongu003eu003cspan style=u0022font-weight: 400;u0022u003ernu003c/spanu003eu003cspan style=u0022font-weight: 400;u0022u003e Collect what you need, not everything you can. Typical practice is to keep routine access logs for a defined, short period unless they’re needed for an incident. Automate deletion and document the policy; avoid “keep forever”. The same logic applies to camera footage linked to doors.u003c/spanu003ernrnu003cstrongu003e5) Engineer security, not surveillance.u003c/strongu003eu003cspan style=u0022font-weight: 400;u0022u003ernu003c/spanu003eu003cspan style=u0022font-weight: 400;u0022u003e Design your platform so it does its core job reliably—deterministic decisions at the door, event logging, safe release on fire alarm—without over-collecting. If your design adds cameras or microphones at entrances, justify u003c/spanu003eu003ciu003eu003cspan style=u0022font-weight: 400;u0022u003eeachu003c/spanu003eu003c/iu003eu003cspan style=u0022font-weight: 400;u0022u003e element. The ICO warns that audio capture is highly intrusive and generally unnecessary.u003c/spanu003ernu003ch3u003eBiometrics in the workplace: do it right—or don’t do itu003c/h3u003ernu003cspan style=u0022font-weight: 400;u0022u003eBiometric access can raise assurance (no card sharing) but is not a default choice. To pass legal and cultural tests:u003c/spanu003ernu003culu003ern tu003cli style=u0022font-weight: 400;u0022 aria-level=u00221u0022u003eu003cspan style=u0022font-weight: 400;u0022u003eEvidence necessity and proportionality. Reserve biometrics for high-risk zones (e.g., data rooms, labs) where you can show why cards/PINs aren’t enough.u003c/spanu003eu003cspan style=u0022font-weight: 400;u0022u003ernrnu003c/spanu003eu003c/liu003ern tu003cli style=u0022font-weight: 400;u0022 aria-level=u00221u0022u003eu003cspan style=u0022font-weight: 400;u0022u003eProvide a reasonable alternative. Workers should not have to choose between handing over biometrics and getting paid or keeping their job. The ICO’s enforcement makes that point plain.u003c/spanu003eu003cspan style=u0022font-weight: 400;u0022u003ernrnu003c/spanu003eu003c/liu003ern tu003cli style=u0022font-weight: 400;u0022 aria-level=u00221u0022u003eu003cspan style=u0022font-weight: 400;u0022u003eProtect templates, not raw images. Store encrypted templates, restrict who can enrol/delete, log all admin actions, and purge promptly on leavers.u003c/spanu003eu003cspan style=u0022font-weight: 400;u0022u003ernrnu003c/spanu003eu003c/liu003ern tu003cli style=u0022font-weight: 400;u0022 aria-level=u00221u0022u003eu003cspan style=u0022font-weight: 400;u0022u003eExplain clearly. Staff should understand how their data is used, for how long, and what happens if they opt for the alternative path. The ICO’s biometric guidance is explicit on these points.u003c/spanu003eu003cspan style=u0022font-weight: 400;u0022u003ernrnu003c/spanu003eu003c/liu003ernu003c/ulu003ernu003ch3u003eWorker expectations, remote work and fairnessu003c/h3u003ernu003cspan style=u0022font-weight: 400;u0022u003eThe ICO stresses that monitoring must be fair and context-aware. People working from home often have a higher expectation of privacy; designs that might be acceptable on a staffed lobby can be excessive in domestic settings (e.g., always-on audio or broad video analytics). Keep access control firmly tied to its security purpose; avoid repurposing it as a tool for performance tracking.u003c/spanu003eu003ca href=u0022https://www.hunton.com/privacy-and-information-security-law/uk-ico-publishes-guidance-on-workplace-monitoring?utm_source=chatgpt.comu0022u003eu003cspan style=u0022font-weight: 400;u0022u003e u003c/spanu003eu003c/au003ernu003ch3u003eRights, requests and practical boundariesu003c/h3u003ernu003culu003ern tu003cli style=u0022font-weight: 400;u0022 aria-level=u00221u0022u003eu003cspan style=u0022font-weight: 400;u0022u003eSubject access. Employees can request copies of their personal data—access events and any related images. Be ready to locate and extract records without disclosing others’ data. The ICO’s surveillance guidance offers practical approaches to video; apply similar care to door logs.u003c/spanu003eu003cspan style=u0022font-weight: 400;u0022u003ernrnu003c/spanu003eu003c/liu003ern tu003cli style=u0022font-weight: 400;u0022 aria-level=u00221u0022u003eu003cspan style=u0022font-weight: 400;u0022u003eRectification u0026amp; objection. Keep clocks/time-sync clean and fix mis-tagged credentials quickly. Where you rely on u003c/spanu003eu003ciu003eu003cspan style=u0022font-weight: 400;u0022u003elegitimate interestsu003c/spanu003eu003c/iu003eu003cspan style=u0022font-weight: 400;u0022u003e, be prepared to consider objections.u003c/spanu003eu003cspan style=u0022font-weight: 400;u0022u003ernrnu003c/spanu003eu003c/liu003ern tu003cli style=u0022font-weight: 400;u0022 aria-level=u00221u0022u003eu003cspan style=u0022font-weight: 400;u0022u003eNo covert monitoring (except in rare cases). Covert monitoring is only justified in exceptional circumstances and for a strictly limited time—your DPIA and legal advice should explain why.u003c/spanu003eu003ca href=u0022https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/employment/?utm_source=chatgpt.comu0022u003e u003cspan style=u0022font-weight: 400;u0022u003ernu003c/spanu003eu003c/au003eu003c/liu003ernu003c/ulu003e
u003ch3u003eA practical, defensible playbooku003c/h3u003ernu003colu003ern tu003cli style=u0022font-weight: 400;u0022 aria-level=u00221u0022u003eu003cspan style=u0022font-weight: 400;u0022u003eState the purpose (safety/security), the scope (doors/zones), and the lawful basis for logs. Publish a clear internal notice.u003c/spanu003eu003cspan style=u0022font-weight: 400;u0022u003ernrnu003c/spanu003eu003c/liu003ern tu003cli style=u0022font-weight: 400;u0022 aria-level=u00221u0022u003eu003cspan style=u0022font-weight: 400;u0022u003eIf biometrics are proposed, complete a DPIA, choose an Article 9 condition, and provide a non-biometric alternative.u003c/spanu003eu003cspan style=u0022font-weight: 400;u0022u003ernrnu003c/spanu003eu003c/liu003ern tu003cli style=u0022font-weight: 400;u0022 aria-level=u00221u0022u003eu003cspan style=u0022font-weight: 400;u0022u003eDesign for minimisation: no audio by default; keep images only where necessary; short, automated retention.u003c/spanu003eu003cspan style=u0022font-weight: 400;u0022u003ernrnu003c/spanu003eu003c/liu003ern tu003cli style=u0022font-weight: 400;u0022 aria-level=u00221u0022u003eu003cspan style=u0022font-weight: 400;u0022u003eEngineer trust: deterministic door decisions, supervised fire-alarm release, clear admin roles, MFA for admins, and auditable changes.u003c/spanu003eu003cspan style=u0022font-weight: 400;u0022u003ernrnu003c/spanu003eu003c/liu003ern tu003cli style=u0022font-weight: 400;u0022 aria-level=u00221u0022u003eu003cspan style=u0022font-weight: 400;u0022u003eTrain and test: induction briefings; signage; drills that include door release on alarm; rights-request rehearsals.u003c/spanu003eu003cspan style=u0022font-weight: 400;u0022u003ernrnu003c/spanu003eu003c/liu003ern tu003cli style=u0022font-weight: 400;u0022 aria-level=u00221u0022u003eu003cspan style=u0022font-weight: 400;u0022u003eReview annually: lawful basis, retention periods, alternative routes, and whether your access data is leaking into performance monitoring (it shouldn’t).u003c/spanu003eu003cspan style=u0022font-weight: 400;u0022u003ernrnu003c/spanu003eu003c/liu003ernu003c/olu003ernu003cspan style=u0022font-weight: 400;u0022u003eDo those things and you’ll have a workplace access system that keeps people safe and respects their privacy—and that sails through audits because you can show your working.u003c/spanu003ernrnu003cspan style=u0022font-weight: 400;u0022u003eIf you’d like us to turn this into a site-specific policy bundle (privacy notices, DPIA templates, commissioning tests, and a staff-friendly “how we use access data” explainer), we can help design, install and hand over a system that’s secure, compliant and easy to live with.u003c/spanu003eu003cspan style=u0022font-weight: 400;u0022u003ernu003c/spanu003eu003cspan style=u0022font-weight: 400;u0022u003e (See:u003c/spanu003eu003ca href=u0022https://network-data-cabling.co.uk/access-control-installation/commercial-access-control/u0022u003e u003cspan style=u0022font-weight: 400;u0022u003eCommercial Access Control Installationu003c/spanu003eu003c/au003eu003cspan style=u0022font-weight: 400;u0022u003e)u003c/spanu003e




