Access control system installation means fitting readers, locks and controllers to doors and turnstiles, connecting them to software, issuing cards or QR codes and switching on permission rules. It starts with the site survey, not the drill. First write down who may enter where and when; cabling, lock type, emergency behaviour and data protection duties follow.
Why installations usually go wrong at the survey, not on fitting day
Most problems seen on access control projects come from poor planning rather than faulty devices. A lock that does not suit the door frame, a magnetic lock never connected to the fire alarm, a reader too far from the network switch, a morning shift queuing at a single turnstile: each is the on-site result of a question nobody asked during the survey.
The second big problem is permission design. The installers fit the devices and the question of who opens which door is left for "later". The result is one broad group that opens every door. If you have not yet looked at how card access works, start with our guide to card access control systems; this article picks up from there and concentrates on the installation sequence.
The cost of a poorly planned installation
Access control is a security investment, but it is also a system that processes personal data. Who went through which door, and when, is personal data under Türkiye's data protection law (KVKK), so a badly configured system creates a compliance risk as well as a security gap. According to the Turkish Data Protection Authority's 2025 Annual Report, the Authority received 328 data breach notifications and 12,512 complaints and reports in 2025.
A Turkish Data Protection Authority announcement of 8 June 2026 states that the purpose of workplace security cameras must be clearly defined; monitoring employee productivity or discipline is not a legitimate purpose, and footage should be kept for the shortest possible period with automatic deletion. (KVKK announcement on the use of workplace security cameras)
The announcement covers cameras, but the principle applies equally to access logs: define the purpose in advance, restrict access to authorised people and set a retention period. Adding those decisions after go-live is harder than building them in from the start.
Security hardware is now part of the network, too. Eurostat data on the use of the Internet of Things in enterprises shows that in 2021, 72% of EU enterprises using IoT used it to secure their premises. The reader on your door is a networked device as well, so network design, updates and cyber security are part of the installation too.
Access control system installation: the 9-step plan
- Requirements and site survey. Mark every access point on the floor plan: external doors, the gatehouse, turnstiles, vehicle entrances, the server room, stores. For each, note daily traffic and the current condition of the door.
- Permission map. List roles (production, office, maintenance, contractors, visitors) and zones, then map which role may enter which zone at what times. This table becomes the draft rule set.
- Credential method. Card, time-limited QR code, fingerprint or a combination; we weigh them up in fingerprint vs card vs face recognition. When choosing a card technology, consider the difference between 125kHz and 13.56MHz cards.
- Physical barrier. Door, tripod turnstile, speed gate, full-height turnstile or vehicle barrier, not forgetting accessible lanes for disabled people. We compare the options in our guide to turnstile types.
- Lock and emergency behaviour. Should the door stay open or locked when power fails? Doors on escape routes should release on a fire alarm while keeping outside-in security. Record this decision door by door, taking fire regulations and your fire safety adviser's view into account. How locks and turnstiles connect to the fire panel is covered in detail in access control and fire alarm integration.
- Cabling, power and network. Plan reader-to-controller distances, cable type, uninterruptible power and switch locations. Decide here how each door behaves if the connection drops.
- Software configuration. Set up the zone hierarchy, shift patterns, rules and user roles; import the staff list and link cards to people.
- Testing and pilot. Test every door with authorised, unauthorised and expired cards, and with network loss, power failure and fire alarm scenarios. Take one zone live first and watch it for a while.
- Training, privacy notice and handover. Show security and HR how to enrol cards, pull reports and run emergency actions. Give staff a KVKK privacy notice and put retention periods in writing.
Decisions to settle before installation
| Decision | Options | What it affects |
|---|---|---|
| Credential | Card, time-limited QR, biometrics | Cost, data protection burden, visitor flow |
| Door on power failure | Fail-safe (opens) / fail-secure (stays locked) | Balance of life safety and property security |
| On network loss | Local decisions continue / doors stop | Whether the morning shift queues at the gate |
| Card sharing control | Anti-passback on / off | Reliability of logs and attendance |
| Attendance | Separate device / same card read | Month-end reconciliation workload |
| Record retention | Period and disposal method | KVKK compliance and audits |
We explain the card-sharing rule in anti-passback explained and network-loss behaviour in access control offline mode.
Five details that are easy to miss on site
Visitor flow. A system designed around staff often falls back to a paper book at reception when visitors arrive. Issuing visitors a time-limited QR code closes that gap; see QR code visitor management.
The emergency list. In an evacuation, the answer to "who is still inside?" comes from the access logs. If this is not tested at installation it may not work when needed; our emergency muster report guide covers drills.
Pairing with cameras. Reviewing an access event alongside camera footage at critical doors shortens any investigation. For running mixed-brand cameras from one place, see ONVIF IP camera management.
A clear specification. If you are collecting quotes from several suppliers, put the door list, lock types, software requirements and acceptance tests in writing. Our guide to writing technical specifications shows how. To read the quotes that come back against the same criteria, see our access control quote evaluation checklist.
Data protection paperwork. Privacy notices, retention periods and access rights should be prepared alongside the installation; for the overall framework read KVKK compliance in Turkey.
How we install access control at Digital Bridge
We do not install off-the-shelf packages; every project starts with a requirements analysis:
- Survey and written proposal. We inspect doors, locks, cabling and network on site or remotely. Technical feasibility for hardware is free, and the result becomes a written proposal setting out scope, phases and cost.
- Hardware selection and fitting. We use our card access control solutions for doors and turnstiles and our barrier and parking systems for vehicle entrances. Electronics design, mechanical enclosures and embedded software sit in the same team, so we can solve site-specific problems.
- Cameras and integration. We bring mixed-brand ONVIF cameras covering critical doors onto a single screen with IP camera monitoring, and build the flow of attendance to payroll and staff data from HR as part of our system integrations work.
- Pilot, training and data protection. We pilot one zone before bringing every door live, and our data protection compliance service covers privacy notices, retention periods and, where required, updating the VERBIS (data controllers registry) entry.
We serve every province in Türkiye remotely and on site, with 24/7 technical support. Replacing an existing system follows a slightly different order; we cover the differences in replacing a legacy access control system. For a gated residential site, resident, guest and vehicle flows are covered in residential complex access control.
What SmartPass makes easier during installation
Our own product, SmartPass, is rolled out in six steps: survey, hardware, installation, definitions, people and cards, and go-live, with the first month-end close done together. For permission design, people belong to access groups and each group is linked to one or more zones with an optional weekly time profile; the maintenance team's group, for example, can be linked to the Production zone with a weekend profile. Before installation, every reader and relay is bench-tested without connecting to the server.
Location, access point (turnstile, door, barrier, canteen) and zone definitions mirror your permission map directly. Staff carry 13.56 MHz cards; visitors receive a temporary card limited to the visit's time window and access group. A single card read opens the door, records attendance and, where the person is entitled, deducts a canteen meal, so there is no separate attendance device to install. Staff and contractor lists are uploaded from Excel or CSV with a preview, and nothing is saved without confirmation.
In an emergency an access point is switched to emergency mode: exits are freed, entries are closed and the organisation's notification recipients receive an e-mail, while the dashboard shows how many staff, contractors and visitors are inside. For data protection, card numbers are not stored but turned into a one-way hash as they are read, records past their retention period lose the fields that identify a person, and the audit log shows previous and new values. The fixed terminal is vendor-neutral and works with OSDP readers and dry-contact relays; how long installation takes depends on the number of access points, whether the hardware is ready and the state of the people list.
Next step
Before installation, prepare your floor plan, a list of access points and a rough permission table by role. With those documents, contact us; we will plan the survey with you and show SmartPass running with your own zones and rules. More guides are on our Access Control & Attendance hub.