Site access control: physical access systems, the law, and biometrics in 2026

Access control defines who may enter which construction site zone and when. The access control system enforces these rules and records entry events. For a general contractor with multiple sites, it is important to link subcontractor requests, access periods, documents, and 1C records; otherwise, manual reconciliation simply moves from the checkpoint to the office.

Passing through a turnstile does not equal a completed shift, and biometrics cannot be reduced to a single data storage model. Below is what to check before purchasing equipment, how to build data exchange with the accounting system, and how to accept the implementation results.

For construction work at an operating site, clause 17 of Rules No. 883n provides for a work permit certificate. Clauses 19–20 regulate cooperation between parties working together. The required documents depend on the site conditions: one certificate should not be treated as a universal requirement for every visitor, nor should an electronic application be considered a replacement for occupational safety documents.

The access control policy should separately define identity checks, permitted zones, access validity periods, required briefings, and visitor escort procedures. Fire lanes, evacuation, and emergency response should be agreed with safety officers: a communications or reader failure must not leave security without clear instructions.

An access control system combines controllers, readers, turnstiles or barriers, and an event log. Cards, QR codes, and facial recognition serve different purposes: the choice depends on pedestrian flow, outdoor conditions, identification requirements, and the organization's ability to maintain the system. Recognition speed and the number of false rejections are tested on site, including with workers wearing helmets and in poor lighting.

Integration links the employee, contractor, site, and access period using stable identifiers. Transfers to 1C require duplicate protection, handling of delayed events, and an error log. Internet outages, contractor changes, and event corrections must have agreed procedures. Local storage of technical events and biometric data should be designed separately.

Article 13 of Law No. 572-FZ provides for the use of the Unified Biometric System at checkpoints, as well as options involving regional segments and accredited information systems that use Unified Biometric System vectors, subject to the conditions established by law. The feasibility of a specific option depends on the site's category and the parties involved in processing. This provision does not establish a universal 24-hour period for all sites or authorize any local facial database.

Before purchasing, map the data: what the camera and terminal collect, where matching occurs, what each party stores, on what legal basis, and how it is deleted. The supplier must substantiate the selected model with documents and data-flow descriptions, not merely claim compliance with Federal Law No. 572-FZ. Verify the specific site together with those responsible for personal data and information security.

If physical characteristics are used to identify a person, the rules for biometric personal data apply. Article 11 of Federal Law No. GDPR requires written consent, subject to statutory exceptions. A detailed review of the legal grounds for processing is provided in the article about The requirements of Law No. GDPR concerning personal data.

OVISION describes an update to the 10D Pass module of the Samolet Group: facial access, integration with a regional segment of the Unified Biometric System, and the Builders Register of the Digital Twin AIS. The supplier's publication lists application approval, attendance tracking, and event recording. This is an example of a specific integration scheme; its applicability to another site must be assessed separately.

The publication does not provide a comparable calculation of total labor effort before and after implementation. Therefore, it cannot support a promise of reducing office workload by 90% or applying its pass-processing times to every site. Use the metrics in the table above for your pilot.

If you need to link applications, access periods, and records across multiple sites, see access control automation and ACS integration. For discussion, prepare a list of sites, current systems, and exceptions currently handled manually.