Biometrics and data protection
Data protection in access control: what to comply with when logging entries in Spain
Quick answer
Access control with cards or codes processes personal data (who went through, where and when), so you need a clear purpose and lawful basis, must inform people, keep logs only as long as necessary, limit who can view them, and sign an agreement with any installer or cloud provider that can access them.
Why it applies even without biometrics
The entry "card 1234, warehouse door, 07:58" is personal data if the card is assigned to someone. The GDPR and Spain's Data Protection Act apply in full. The good news: without biometrics or cameras, compliance is simple and proportionate.
Seven things to have in place
- Purpose. Why you control access: safety of people and property, protecting restricted areas, roll call in emergencies. Write it down.
- Lawful basis. Usually legitimate interest in site security or, in employment, the employer's powers of control. Consent is not normally needed.
- Information. People must know the system exists, who the controller is, what the data is for, how long it is kept and how to exercise their rights. In writing for staff; a sign or the reception register for visitors.
- Minimisation. Collect only what is needed. A door system does not need a date of birth or photo without a specific reason.
- Retention. No single statutory period is set for access logs: it must be the minimum needed for the purpose. Many organisations take as a reference the one month that the Data Protection Act sets for CCTV images. Define it, configure it in the software and stick to it.
- Who can view it. Named accounts, as few as possible, with strong passwords. No shared "admin" user.
- Record of processing activities. Include access control in the internal record the GDPR requires.
Uses not covered by default
The system was installed for security. Later using those logs for something else — measuring punctuality, monitoring breaks, disciplinary action — is a change of purpose that must have been planned and communicated. If the reader is also used for time recording, say so expressly: they are two processing operations.
Third parties who see the data
- Installer and maintainer with access to the software.
- Cloud provider, if the system is not on-premise (cloud or on-premise).
- Security or concierge company.
There must be a data processing agreement with each.
When more is needed
- Biometrics: a DPIA and a far stricter analysis (guide).
- Cameras linked to entrances: CCTV has its own rules (guide).
- Number plate recognition: a plate linked to a person is personal data (guide).
- Visitors: minimise what you ask for at reception (guide).
People's rights
Anyone can request access to their own records. Plan how to respond without revealing other people's data.
Quick checklist
- Purpose and basis written down.
- Staff informed; sign for visitors.
- Deletion period configured.
- Named administrator accounts.
- Processing agreements signed.
- Processing included in the record of activities.
When we hand over an access control installation, we configure the retention period you specify and named accounts.
Frequently asked questions
Do I need employees’ consent to issue access cards?
Normally not: the basis is usually legitimate interest in security or the employer’s powers of control. Informing them is mandatory.
How long can I keep access logs?
The minimum needed for the purpose. There is no single statutory period; many organisations use one month as a reference, unless an incident requires specific records to be kept.
Sources
This guide is for information only and is not a substitute for legal advice or for the technical design of each installation. Regulations change: always check the current text at the official source.