Access Control & Privacy • NSW • 2026
Access Control Logs Are Personal Information — What the Privacy Act Means for NSW Businesses
Someone asks “who was in the building on Saturday night?”, the office manager opens the access control software, filters by date, and there it is: names, doors, times. It is a useful answer. It is also a record about identifiable people, and that is where the access control logs privacy question starts. This guide covers when a swipe, fob or biometric log is personal information under the Privacy Act 1988 (Cth), why biometric templates are “sensitive information”, what the employee records exemption does and does not cover, which Australian Privacy Principles (APPs) apply at each stage, how the NSW Workplace Surveillance Act 2005 touches door logs, and what a system set up to comply looks like. It is written for the HR lead, office manager or IT lead who holds the login. It is not legal advice; check the points that matter to your business with your privacy adviser.
The Short Answer: Are Access Logs Personal Information?
- Yes, once an entry can be linked to a person, which it can the moment a credential is registered to a name.
- Fingerprint and face templates are sensitive information, which adds a consent requirement.
- The employee records exemption narrows your obligations for your own staff. It does nothing for contractors, visitors, tenants or job applicants.
- You must tell people the log exists (APP 5), use it for the purpose you collected it for (APP 6), keep it secure and delete it when no longer needed (APP 11), and let people see their own entries (APP 12).
- Whether the NSW Workplace Surveillance Act treats a swipe log as "tracking surveillance" is unsettled. Give written notice as if it does.
Why a Door Log Is Personal Information
A log entry is personal information as soon as it can be tied to a person. The Privacy Act defines personal information as information or an opinion about an identified individual, or an individual who is reasonably identifiable. A door event on its own is a credential number, a door name and a timestamp. Sitting next to the cardholder register in the same database, it is a record that a named person was at a specific door at a specific time. That is personal information about every person who taps, not only your staff.
The Act applies to APP entities, which covers most private-sector businesses above the small business threshold. Businesses under the annual turnover threshold are generally exempt, but do not stop reading on that basis: the exemption is under review, some small businesses are covered anyway (contracted service providers to the Commonwealth, for example), your lease or client contracts may impose privacy obligations regardless, and the NSW notice rules below apply whatever your turnover. The OAIC publishes the current threshold and the exceptions; check your own position with your privacy adviser.
Biometrics Are Sensitive Information
A fingerprint or face template is sensitive information, not just personal information. The Privacy Act lists biometric information used for automated biometric verification or identification, and biometric templates, as sensitive information — the same category as health information, with a higher bar than a card number.
Collection generally requires consent, and must be reasonably necessary. Under APP 3, an organisation must not collect sensitive information unless the individual consents and the information is reasonably necessary for one of its functions or activities. Consent has to be informed, voluntary, specific and current: a written notice explaining what is captured, where the template is stored, who can access it and when it is deleted, signed before enrolment. Voluntary also means a genuine alternative exists, so a staff member who declines a fingerprint reader is issued a card or mobile credential without penalty. Check the enrolment wording with your privacy adviser before the reader goes live.
Necessity is easier to show on a few doors than on every door. The technical comparison of biometrics against the other credential types is in our guide to fob, card and mobile access control credentials; this post is the obligations side of the same decision.
The Employee Records Exemption — and Who It Leaves Out
The exemption is narrower than most HR teams assume. An act or practice of a private-sector employer is exempt where it is directly related to a current or former employment relationship and to an employee record the employer holds about that person. A door log for your own employee, used to resolve an attendance dispute or investigate misconduct, will usually sit inside that. The exemption is under review, and the OAIC’s guidance suggests it does not clearly cover the act of collecting the information in the first place, so treat it as a limit on what you must do with an existing staff record rather than a blanket pass. Read the OAIC’s employee records exemption guidance and check the edges with your privacy adviser.
It only ever applies to your employees. Everyone else who taps a reader on your site is outside it, and the full APPs apply to their entries.
| Person type | Exemption applies? | What you must do |
|---|---|---|
| Your own current or former employees | Generally yes, where the handling is directly related to the employment relationship | Give notice under the NSW Act, keep the log secure, follow your own policy on access and retention |
| Job applicants on a site tour or trial shift | No — no employment relationship yet | Full APPs: notice, purpose limits, security, deletion, access |
| Contractors, consultants and labour-hire workers | No — labour-hire staff are employed by the agency | Full APPs, plus a privacy clause in the engagement terms |
| Visitors and delivery drivers | No | Full APPs, with the notice on the sign-in screen or visitor pass |
| Other tenants' staff in a shared building | No | Full APPs; the building operator, not each tenant, usually holds the record |
| Residents in a strata scheme | No — the owners corporation is not their employer | Full APPs where the scheme is an APP entity; see our guide to strata fob by-laws in NSW for how the register should be held |
| NSW public-sector staff | Not applicable | PPIP Act (NSW) governs instead |
Collection Notice: What to Tell People (APP 5)
Tell people at or before their first tap. APP 5 requires reasonable steps to notify an individual, at or before collection or as soon as practicable afterwards, of a set list of matters. For a door log the notice can be a paragraph rather than a document.
- Who you are and how to contact you about the record.
- That door events are recorded, and which credential types are logged.
- Why: building security, safety, access management, and any other purpose you actually intend, such as attendance.
- Who the records may be disclosed to — a building manager, landlord, insurer or law enforcement where that is realistic.
- How long the records are kept.
- That your privacy policy (APP 1 requires one that is clear and current) explains how to request access or complain.
Put the notice where each group will see it. Staff: the employment contract or induction pack. Contractors: the engagement terms. Visitors: the sign-in screen or the pass the receptionist hands over. A notice nobody was shown is not a notice.
Use and Disclosure: Landlord, Police, Insurer (APP 6)
The primary purpose is building security and access management, so that is what the log is for. APP 6 lets you use or disclose personal information for the purpose you collected it for, and for a secondary purpose only where the person consents, where they would reasonably expect it and it is related to the primary purpose (directly related, for sensitive information), where the law requires or authorises it, or where another listed exception applies. The three requests that land on an office manager’s desk fall out differently.
- A landlord or building manager asks for your tenancy's log. There is no automatic right to it. Unless the lease and your collection notice already cover that disclosure, the safe answer is de-identified counts or a request for consent, not the raw export. Check with your privacy adviser.
- Police ask for Saturday night's entries. APP 6 generally allows disclosure to an enforcement body where you reasonably believe it is reasonably necessary for that body's activities, and the Act expects you to keep a written note of any disclosure made on that basis — check the wording of that note with your privacy adviser. A request is not a legal compulsion; you may disclose, but ask for it in writing, limit the export to the relevant window, and record what you handed over.
- Your insurer asks after an incident. Disclosure about the event you are claiming on is likely to be within what people would reasonably expect, provided your notice mentioned insurers. Keep it to the incident window and the doors involved.
Security and Retention (APP 11)
You must take reasonable steps to protect the log. APP 11 requires an organisation to protect personal information from misuse, interference, loss, unauthorised access, modification and disclosure. For an access control database that means named operator accounts, multi-factor authentication on the management interface, current firmware on the controller, and no spreadsheet exports sitting in inboxes.
You must destroy or de-identify what you no longer need. APP 11 also requires reasonable steps to destroy or de-identify personal information once it is no longer needed for any purpose for which it may be used or disclosed under the APPs, unless a law or court order requires you to keep it. The Privacy Act does not set a number of months, and “as long as the software keeps it” is not a retention policy.
Our practice recommendation, not a legal requirement: pick a period, write it down, and set the system to it. Organisations we work with typically settle somewhere between three and twelve months for routine door events, matched to how long an incident realistically takes to surface. Records pulled for a specific incident, dispute or claim go to that file under its own retention rule. Confirm the period with your privacy adviser, particularly if industry-specific laws require longer.
Access Requests (APP 12)
People can ask to see their own entries. APP 12 requires an organisation to give an individual access to the personal information it holds about them on request, within a reasonable period and in the manner requested where reasonable, subject to listed exceptions. Any charge must not be excessive, and a refusal must be explained in writing. For a current employee, the employee records exemption may mean the request is not strictly an APP 12 request, but most employers provide the export anyway and it is the better position; check with your privacy adviser before refusing one.
Export their entries, not everyone’s. The common mistake is running a raw door report for the period and handing it over, which discloses every other person’s movements. Filter by cardholder first and check the export before it leaves the building.
The NSW Workplace Surveillance Act Question
The Workplace Surveillance Act 2005 (NSW) regulates three kinds of surveillance of employees at work: camera, computer and tracking. The camera rules, including signage and notice for cameras in a workplace, are covered in our guide to workplace surveillance camera laws in NSW; this section is only about the door log.
Whether a swipe log is “tracking surveillance” is unsettled. The Act describes tracking surveillance as surveillance by an electronic device whose primary purpose is to monitor or record geographical location or movement. A reader’s primary purpose is to decide whether a door opens; the log is a by-product, which argues against the category. Using the log to reconstruct where a person went during the day argues for it. We are not aware of a clear ruling that settles the point, and your privacy adviser may take a different view of your particular use.
Give notice anyway. The cost of treating it as covered is a paragraph in the induction pack. The Act’s notice regime asks for written notice at least 14 days before surveillance starts (less if the employee agrees), and before a new employee starts work, describing the kind of surveillance, how it is carried out, when it starts, whether it is continuous or intermittent, and whether it is ongoing or for a limited period. Write that paragraph for door events, issue it to every employee, and the unsettled question stops mattering. Visitors and contractors generally sit outside this Act’s employee-surveillance regime — confirm with your privacy adviser — and the APP 5 notice above is what protects you there.
What a Compliant System Looks Like
Most of the obligations above are settled by how the system is configured, not by a policy document. The platforms we install — Inner Range Integriti and Inception, and SALTO — all support the controls below; the difference between a compliant site and an exposed one is whether anyone set them at commissioning.
- Named operators with role-based permissions. Reception can issue a visitor card and cannot open the event history. The security manager and HR lead can view history. One person holds administrator rights, and nobody shares a login.
- A retention setting that matches the written policy, not the software default.
- Export controls. Only designated operators can export, exports are filtered by person or window, and they are saved to the incident file rather than an inbox.
- Consent records stored with the biometric enrolment, so the signed form can be produced for any template on the system.
- A one-page access records policy covering purpose, who can view, retention, disclosure decisions and how to request your own entries, referenced from the privacy policy.
If you are specifying a new system, our page on office access control with a proper audit trail covers how operator roles and reporting are set up on a working tenancy, and the access control systems overview lists the platforms across every site type.
Frequently Asked Questions
Are swipe card and fob logs personal information under the Privacy Act?
Yes, once an entry can be linked to a person, which it can as soon as the credential is registered to a name in the same system. The Privacy Act covers information about an individual who is reasonably identifiable, not only information that names them outright, so the log is personal information about staff, contractors, visitors and anyone else issued a credential.
Does the employee records exemption cover door access logs?
For your own current or former employees, where the handling is directly related to the employment relationship, generally yes. It does not cover contractors, labour-hire workers, visitors, job applicants, tenants or strata residents. Treat it as a limit on your obligations for staff records, not as permission to ignore the APPs, and check the edges with your privacy adviser.
Do we need written consent to use fingerprint or face readers?
Biometric information used for automated verification or identification, and biometric templates, are sensitive information under the Privacy Act. Collection generally requires consent and must be reasonably necessary for your functions or activities. Written, informed consent before enrolment, with a card or mobile credential offered to anyone who declines, is the practical standard. Confirm the enrolment wording with your privacy adviser.
How long should we keep access control records?
The Privacy Act does not set a period. APP 11 requires you to destroy or de-identify personal information once it is no longer needed for a purpose you are allowed to use it for, unless another law requires you to keep it. As a practice, choose a defined period for routine events, commonly between three and twelve months, write it into your policy, and set the system to match. Keep incident exports under the incident file's own rule.
Do we have to tell staff their door swipes are logged?
Yes, on two fronts. APP 5 requires notice of the collection, its purpose, likely disclosures and how to seek access. Separately, the NSW Workplace Surveillance Act may treat a swipe log as tracking surveillance; the point is unsettled, so give the Act's written notice before the logging starts and before each new employee begins. A paragraph in the induction pack covers both.
Can an employee ask to see their own access history?
Yes. APP 12 gives individuals a right to access the personal information an organisation holds about them, within a reasonable period and without an excessive charge. The employee records exemption may mean a current employee's request is not strictly an APP 12 request, but providing it is the better position and most employers do. Export that person's entries only, never the full door report for the period.
Related Reading
Need a quote on your access control system?
A door log answers "who was in the building on Saturday night?" and, in the same moment, becomes a record about people that the Privacy Act governs. Tell people it exists, use it for security and access management, keep it locked down and time-limited, give people their own entries when they ask, treat biometric templates as sensitive information, and give NSW employees written notice whether or not the Workplace Surveillance Act strictly requires it. Nearly all of that is a configuration job on the system you already own.