Skip to content 
Zutrittskontrolle
The best encryption is of little use if anyone can get into the room where retired hard drives are waiting for erasure. Physical access control is therefore one of the fundamental protective measures in data protection. This entry explains the term, distinguishes it from system and data access control and shows what matters for old devices.
In brief
Physical access control is the entirety of measures that prevent unauthorized persons from physically entering buildings, rooms or areas in which data is processed or data carriers are stored. Typical means are locking systems, ID badges, visitor rules and video surveillance. In IT retirement, it protects old devices as long as the data on them has not yet been erased.
Entry, system access, data access – what is the difference?
In German data protection practice, a three-part division has become established. It originates from the annex to the former § 9 BDSG and is still used today to organize technical and organizational measures according to Art. 32 GDPR .
| Term | Protects against … | Examples |
|---|---|---|
| Access control | physical entry into rooms and buildings | Locking system, transponder, reception, visitor log, video surveillance |
| Access control | unauthorized use of IT systems | Passwords, multi-factor sign-in, screen lock |
| Access control | unauthorized reading or changing of data | Role and permission concept, encryption |
Note: The current BDSG uses the terms in § 64 for the field of police and justice partly differently. There, the physical safeguarding of processing facilities is called "Zugangskontrolle". In substance, the same thing is meant.
Typical physical access control measures
- Zone concept: Areas are graded by protection need, from public reception to the server room.
- Locking system and key management: Who has which key or transponder is documented. Lost media are blocked.
- Permissions as needed: Access is granted only to those who need it for the task, following the Need-to-know principle.
- Visitor rules: Guests and tradespeople are registered, escorted and recorded.
- Logging and video surveillance: Entries to critical areas are recorded traceably. In doing so, separate data protection rules for surveillance apply.
Standards such as ISO/IEC 27001 also require physical security areas and controlled access.
Rule of thumb: An old device with unerased data needs the same protection as a server in operation – even if it sits in the basement.
Physical access control in IT retirement
Between a device's dismantling and its erasure, days or weeks often pass. During this time, notebooks, hard drives and smartphones are gathered in one place – an attractive target. Store old devices therefore in a locked room with documented access and hand them over by serial number and sealed. If you commission a service provider, it should describe its physical access control in the data processing agreement . How to secure the entire chain is explained in the entry Chain of custody; which risks lie on old hard drives is shown by our article Corporate DNA on hard drives.
Physical access control at Second IT
At Second IT, devices are processed in secured processing zones. Only authorized employees have access; the areas are protected by access controls and video surveillance. Data carrier destruction takes place exclusively in-house and under video surveillance. Second IT is certified to ISO/IEC 27001. More on Data security at Second IT.
Frequently asked questions about physical access control
Does the GDPR require physical access control?
The word does not appear in the GDPR. However, Art. 32 GDPR requires appropriate technical and organizational measures to protect data from unauthorized access. In practice, physical access control almost always forms part of this.
May fingerprint systems be used for physical access control?
In principle yes, but biometric data for identification falls under the special categories of personal data. Their use requires a sound legal basis and careful weighing of interests. Have your data protection officer review this in advance.
How do I document physical access control?
Describe zones, permissions, key issuance and visitor rules in your TOM concept. Add logs of issued and blocked keys or badges and review the permissions regularly.
How do I secure old devices before erasure?
Store them in a locked room with documented access and hand them over by serial number and sealed. An old device with unerased data needs the same protection as a server in operation.
Is video surveillance enough as physical access control?
No, it is only one building block. A locking system, key management, visitor rules and a zone concept are also part of it. In addition, separate data protection rules apply to video surveillance itself.
Your old devices in secured areas – from goods receipt to the erasure certificate.
Send us your device list. You will receive your offer in 48 hours on average.