Access Control Register Spain (Registro de Control de Acceso)

An Access Control Register Spain (Registro de Control de Acceso) is a formal record-keeping instrument governing the monitoring and logging of physical and logical access to company premises, restricted areas, and information systems in Spanish workplaces, operating under the dual framework of Ley Orgánica 3/2018, de 5 de diciembre, de Protección de Datos Personales y garantía de los derechos digitales (LOPDGDD) Article 89, and Reglamento (UE) 2016/679 del Parlamento Europeo y del Consejo (RGPD) Article 6. The register records who accesses controlled locations or systems, when access occurred, the duration of presence, and the authorisation basis — whether employee, contractor, visitor, or service provider.

LOPDGDD Article 89 — «Derecho a la intimidad frente al uso de dispositivos de videovigilancia y de grabación de sonidos en el lugar de trabajo» — establishes the conditions under which employers may monitor employee presence and access through technical systems. Although Article 89 primarily addresses video surveillance, the Agencia Española de Protección de Datos (AEPD) has consistently extended its principles to all forms of access monitoring through binding resolutions and its guía de control de acceso — including RFID access cards, biometric readers, turnstile systems, and electronic badge logs. The AEPD's guía de videovigilancia (2021) and guía de protección de datos en las relaciones laborales (2021) both address access control registers as independent processing activities requiring separate RGPD Article 30 documentation.

The legal basis for processing access control data in the employment context is RGPD Article 6.1(b) — processing necessary for the performance of the employment contract — and RGPD Article 6.1(c) — processing necessary for compliance with legal obligations including workplace security requirements under Ley 31/1995, de Prevención de Riesgos Laborales (LPRL) Article 14, which imposes on employers the duty to guarantee the safety of all persons on company premises. For security-sensitive installations — críticas under Ley 8/2011 de Protección de Infraestructuras Críticas — access control is a mandatory security measure imposed by the Centro Nacional para la Protección de las Infraestructuras Críticas (CNPIC).

Biometric access control — fingerprint readers, facial recognition, retinal scanners — involves special category data under RGPD Article 9.1 (biometric data processed for the purpose of uniquely identifying a natural person). The AEPD has issued multiple resolutions (PS/00152/2021, PS/00078/2022) sanctioning employers who deployed biometric access control without valid consent under RGPD Article 9.2(a) or demonstrating substantial public interest under Article 9.2(g). Biometric access control requires a Data Protection Impact Assessment (DPIA/EIPD) under RGPD Article 35, given the AEPD's criteria for high-risk processing activities.

The Estatuto de los Trabajadores (ET) Article 20.3 grants employers the right to adopt surveillance measures proportionate to the control of employees' work activity, but requires that workers and their representatives (comités de empresa, delegados de personal) be previously informed about the nature and extent of monitoring measures. The Tribunal Constitucional has addressed access monitoring in multiple judgments — STC 98/2000 and STC 186/2000 — establishing the proportionality test: monitoring measures must be appropriate (idónea), necessary (necesaria), and strictly proportionate (proporcional en sentido estricto) to the legitimate aim pursued.

The access control register as a data processing activity must be documented in the Registro de Actividades de Tratamiento under RGPD Article 30, specifying the purpose, legal basis, data categories, retention period, security measures, and any data processors (e.g., external security companies or access control system providers). Retention periods for access control logs are a frequent subject of AEPD inspection — the AEPD considers 30 days a reasonable maximum for general access control logs, with longer periods permissible only when documented security incidents or ongoing investigations justify extended retention.

An Access Control Register Spain is needed when any company, public body, or organisation in Spain implements a physical or electronic system for monitoring and recording access to its premises, restricted areas, or information systems — given that such monitoring constitutes personal data processing subject to LOPDGDD and RGPD obligations.

The register is needed in workplaces with physical security installations — RFID card readers, turnstiles, electronic locks, intercom systems with identification — where employee, visitor, and contractor entry logs are generated automatically. Without a formal register governing the processing, the organisation lacks the RGPD Article 30 documentation required during AEPD inspections.

Access control registration is needed in offices, factories, and warehouses where the employer wishes to exercise its ET Article 20.3 monitoring rights — verifying employee attendance, controlling entry to restricted production areas, or documenting access to server rooms and data centres. The register formalises the monitoring scope and confirms the proportionality requirements of LOPDGDD Article 89 are met.

The register is required in organisations handling classified information, financial records, or health data — banks, insurance companies, hospitals, pharmaceutical manufacturers — where sector-specific regulations (LSSICE, Ley 44/2003 de Ordenación de Profesiones Sanitarias) mandate documented access controls as part of information security management.

A formal access control register is essential when engaging external security companies (empresas de seguridad privada) under Ley 5/2014 de Seguridad Privada, as these companies act as data processors under RGPD Article 28 and a Data Processing Agreement (contrato de encargo de tratamiento) must accompany the documented access register.

The register is required before deploying biometric access control systems — particularly fingerprint or facial recognition readers — given that biometric data processing requires RGPD Article 9 compliance, a DPIA under Article 35, and explicit consent or a substantial public interest legal basis. The AEPD has sanctioned multiple Spanish employers for biometric access control without adequate prior documentation.

Parties in Spain should prepare a Access Control Register Spain (Registro de Control de Acceso) proactively rather than waiting for a dispute to arise. Courts interpret agreements based on the written terms rather than oral representations. Under the Estatuto de los Trabajadores (ET) RDL 2/2015, Spanish employment law governs contracts, dismissals, and working conditions. The Tesorería General de la Seguridad Social (TGSS) administers social security contributions. The Servicio Público de Empleo Estatal (SEPE) manages unemployment benefits. The Inspección de Trabajo y Seguridad Social enforces labour compliance. The Juzgados de lo Social hear employment disputes under the Ley Reguladora de la Jurisdicción Social (Ley 36/2011). Where the transaction involves regulated activities, prior approval from the relevant authority may be required before execution.

A valid Access Control Register Spain under LOPDGDD Article 89 and RGPD Article 6 must contain the following essential elements to satisfy AEPD inspection requirements and demonstrate lawful processing.

Identification of the Data Controller: Full name, NIF/CIF, address, and legal representative of the organisation responsible for the access control processing. If an external security company operates the access control system, the RGPD Article 28 relationship — data processor vs. data controller — must be clearly defined, with a Data Processing Agreement (DPA/contrato de encargo de tratamiento) in place.

Scope and Purpose of Monitoring: A clear description of which premises, areas, or systems are subject to access control — building entrance, server room, production floor, restricted data zones — and the specific purpose of monitoring: safety under LPRL Article 14, security of confidential information, verification of attendance, compliance with Ley 8/2011 critical infrastructure requirements. The purpose must be specific and documented.

Legal Basis for Processing: The applicable RGPD Article 6.1 ground — performance of the employment contract (6.1.b), legal obligation (6.1.c), or legitimate interests (6.1.f). For biometric data, the additional RGPD Article 9.2 ground must be documented. Where legitimate interests form the basis, a documented balancing test (test de proporcionalidad) is required under LOPDGDD Article 89.1.

Categories of Data Subjects and Data Processed: A complete list of who is monitored — employees, external contractors, visitors, delivery personnel — and what data is collected: name, identity document, access card number, timestamp, location accessed, duration, and any biometric identifiers. The level of detail collected must be proportionate to the security objective.

Retention Period: The defined maximum period for which access logs are retained — typically 30 days for routine access control per AEPD guidance, extendable when a security incident investigation is active or contractual obligations with clients (e.g., ISO 27001 audit requirements) require longer retention. The retention period must be documented and technically enforced through automatic deletion.

Information to Workers and Representatives: Evidence that employees and their representatives (comités de empresa, delegados de personal under ET Articles 61–68) have been informed of the access control monitoring in advance, as required by LOPDGDD Article 89.1 and RGPD Article 13. The prior information notice must state the purpose, legal basis, data categories, retention period, and data subject rights.

Security Measures: Technical and organisational measures protecting access control data — encrypted storage, access controls limiting who can query the logs, audit trails for log access, procedures for data breach notification under RGPD Article 33. For biometric systems, additional measures include template protection, liveness detection, and alternative authentication options for data subjects who withdraw consent.

forms-legal.com provides this Access Control Register Spain template as a practical compliance tool for Spanish employers managing workplace security systems. Given AEPD's active enforcement in this area — with sanctions averaging €50,000–€150,000 for LOPDGDD violations in access monitoring — consulting a qualified abogado especialista en protección de datos or a certified DPO is strongly recommended before deploying biometric or extensive access control systems.

Key Spanish statutory references: LOPDGDD art. 89 — workplace monitoring. RGPD arts. 6, 9, 13, 28, 30, 35 — legal basis, special data, transparency, processors, register, DPIA. ET art. 20.3 — employer monitoring rights. LPRL art. 14 — workplace safety. Ley 5/2014 — private security companies. STC 98/2000 and 186/2000 — proportionality doctrine.

Additional compliance elements for a Access Control Register Spain (Registro de Control de Acceso) used in Spain include: Under the Estatuto de los Trabajadores (ET) RDL 2/2015, Spanish employment law governs contracts, dismissals, and working conditions. The Tesorería General de la Seguridad Social (TGSS) administers social security contributions. The Servicio Público de Empleo Estatal (SEPE) manages unemployment benefits. The Inspección de Trabajo y Seguridad Social enforces labour compliance. The Juzgados de lo Social hear employment disputes under the Ley Reguladora de la Jurisdicción Social (Ley 36/2011). Forms-legal.com provides this template as a starting point for Spain-compliant documentation.