Access control: cards, codes or biometrics?

• Card or fob: fast, issued and cancelled in the system, logs which card passed. Weak point: it gets lost or lent.
• PIN code: nothing to lose, simple for a few doors. Weak point: it gets told, seen, and a shared code does not show who entered.
• Biometrics (fingerprint, face): cannot be lent or forgotten. Weak points: stricter data protection rules, and failed matches that need another way in.
• Combination: card plus PIN at a critical point means a lost card is not enough to get in.

In OVIT’s systems, biometrics are used where a credential alone is not enough, with a clear fallback path when a match fails.

1. Zone map: common areas, staff areas, stockrooms, areas of value or infrastructure (e.g. server room, cash office).
2. Roles: staff, warehouse, maintenance, cleaning, management. Each role gets its zones.
3. Schedules: the cleaners’ card opens during cleaning hours, not round the clock.
4. Exceptions: each one has a reason, an approver and an expiry date.
5. Review: check regularly who can go where, and remove what is no longer needed.

OVIT manages credentials, schedules and exceptions against the real flow of people on site, not a generic access list.

• Register name, who they are visiting, and time in and out.
• A temporary card that expires the same day, valid only for the zones of the visit.
• An escort in zones where visitors should not move alone.
• For contractors: permissions for the duration of the job and only for its area.
• At the exit: the card comes back, and you check that every card issued was returned.

Where a guard staffs the entrance, the visitor rules belong in the post orders, so every shift does the same thing.

• A simple procedure: whom the card holder tells, and how fast the card is cancelled.
• A check of the log for any use after the loss.
• A new card, rather than reactivating the old one if it turns up.
• New codes for any the leaver knew, especially shared ones.
• No unnamed “master card” in circulation.

• Denials: repeated failures at the same door or with the same card.
• Door forced: opened without a valid credential.
• Door held open: someone propped it or it did not close.
• Out-of-hours access: at a time the role should not be there.

An access log shows who was where and when, so it is personal data. Give access to few people, for a defined purpose.

In OVIT’s systems, every door decision resolves into one accountable record, so it stays explainable after the fact.

The Hellenic Data Protection Authority states that special categories of data include, among others, biometric data for the purpose of uniquely identifying a person (Art. 9(1) GDPR), and that member states may introduce further conditions and limitations (Art. 9(4)). The GDPR defines biometric data in Art. 4(14), giving facial images and fingerprint data as examples (Hellenic DPA, biometric data).

• Ask first whether a card, or a card with a PIN, is enough for that door.
• If you choose biometrics, keep them to a few critical points, not every door.
• Provide another credential for anyone who fails to match or should not use a biometric.
• Get legal advice on the lawful basis before installation.

• Door forced or held open: an alarm signal with the matching camera.
• Denial: the door’s video is linked to the denial record.
• Arming: a zone’s alarm arms when the last person leaves.
• One record: door, camera and the guard’s action in the same event.

OVIT designs alarms, access control, CCTV and barriers as one connected whole, and on the Guardly platform every access event enters the same live record as patrols and incidents. For when you also need a person, see security guard or security system.