A card access control system is an electronic system that controls who may pass through a door, turnstile or barrier, and when, using a credential issued to each person — usually an RFID card, sometimes a QR code. When a card is presented, the system checks the holder's permissions, releases or refuses the lock, and logs the time, date and door.
Key takeaways
- A card access control system has five parts: a credential (card), a reader, a controller, a lock or turnstile, and management software.
- A lost card or a leaver's access is switched off centrally in one step; unlike a key, no locks need changing.
- Fixed-number 125 kHz cards are easy to copy; 13.56 MHz smart cards can mutually authenticate with the reader.
- Set up well, one card read opens the door, creates the attendance record and counts the canteen meal.
- Access logs are personal data under KVKK in Türkiye; retention and viewing rights should be settled before choosing a system.
Beyond controlling doors, the same card infrastructure can feed time and attendance (PDKS) records and canteen meal counts. This guide covers the building blocks of a card access control system, why keys and sign-in books stop working as a site grows, what drives the cost, the seven questions to settle before you request quotes, and the data protection side, including Türkiye's Personal Data Protection Law (KVKK). Every related article sits in our access control and attendance hub.
How does a card access control system work?
Five components work together at every entry point. The weakest one sets the reliability of the whole system.
| Component | What it does | What to check |
|---|---|---|
| Credential | Represents the person: RFID card, key fob, time-limited QR code or biometric template | How hard is it to clone? How quickly can it be revoked when lost? |
| Reader | Reads the card or QR code and passes the identity on | Compatibility with the card technology, suitability for outdoor use |
| Controller | Applies the rules and tells the lock to open or stay shut | Where the rules are stored, how it talks to the central system |
| Lock / turnstile / barrier | Provides the physical barrier | Behaviour in a fire or emergency, throughput at peak times |
| Software | Manages people, permissions, zones and reports | How readable the rules are, how reports reach HR and payroll |
The flow itself is simple: the card is presented, the identity reaches the controller, the controller checks whether that person may enter that zone at that time, a decision is made and the event is logged. The difference lies in how clearly the rules are written. The anti-passback rule that stops card sharing is part of the same rule set.
Why the card technology matters in card access control
Most card access control systems use RFID (radio-frequency identification) cards. As of 2026, many sites still run 125 kHz proximity cards, which typically carry nothing more than a fixed number that is relatively easy to copy. 13.56 MHz smart cards support mutual authentication with the reader and give a far more secure foundation.
For visitors and contractors, a QR code valid for a set period avoids the familiar problem of cards that never come back. We compare the two card types in detail in our 125 kHz vs 13.56 MHz guide. How a fixed-number card gets copied, and how to spot and shut down a clone, is covered in access card cloning risk.
Why are keys, sign-in books and a guard not enough?
The traditional methods that a card access control system replaces work at small scale. As a site grows, keys and a visitor book run into three problems:
- Keys get copied and cannot be recalled. A key held by a former employee stays valid until the lock is changed. A card can be switched off centrally in one step; tying that to closing IT accounts is covered in physical access and cyber security.
- A book cannot tell you who is inside. During a fire drill — or a real evacuation — handwritten lists are rarely up to date.
- The rules are not written anywhere. "Only the warehouse team enters the warehouse during their shift" lives in a guard's memory; it cannot be audited or reported on.
Organisations are investing to close these gaps. Market research firm MarketsandMarkets forecasts that the global access control market will grow from USD 10.62 billion in 2025 to USD 15.80 billion by 2030 (MarketsandMarkets Access Control Market report). The European picture points the same way:
According to Eurostat, 29% of EU enterprises with 10 or more employees used Internet of Things devices in 2021, and 72% of those used them to secure their premises. (Eurostat — Use of Internet of Things in enterprises)
There is also a personal data angle. Access logs show who was where, and when — that is personal data. In Türkiye, the Personal Data Protection Authority (KVKK) received 12,512 complaints and reports in 2025 alone (KVKK 2025 Annual Report).
What types of card access control system are there?
Card access control systems are usually built at one of three scales:
- Standalone, single door. Reader and controller share one unit and the log stays on the device. Fine for a small office, but reporting and central management are limited.
- Networked, single site. Every door connects to central software; permissions are granted in one place and activity is monitored live. This is the norm in factories, hospitals and office buildings, and school campus access control follows the same pattern.
- Multi-site with central management. Each site keeps its own records while head office receives consolidated reports. A good fit for groups and chains; we cover the model in detail in our multi-site access control guide.
The setting matters as much as the scale. On a building site whose gate moves every few months, construction site access and attendance are planned together; in a factory, linking contractor health and safety compliance to the card is usually the priority.
Multi-tenant office buildings and gated residential complexes bring very different people to the door; we cover them separately in office building access control and residential complex access control. Public buildings and hospitality sites have their own rules too: for buildings where citizens walk in freely but archives and server rooms stay closed, see municipal building access control; where guests and staff share one building, see hotel staff access control.
The verification method is chosen door by door. We compare speed, security and data protection burden in our fingerprint vs card vs face recognition table. Staff entrances need the right turnstile type, and high-security rooms often combine card and biometric verification through fingerprint access.
Where fingerprints are chosen, the most common complaint on site is fingers that will not read; we gather the causes and fixes in fingerprint reader not recognising. Staff cards can be read on the company shuttle as well as at the door; for boarding roll-call, see staff shuttle attendance tracking.
Where hygiene and contamination rules apply, the door controls not only who enters but in what order and after what preparation; we explain the set-up in cleanroom access control and food factory hygiene access control.
Vehicle entrances swap the card reader for barrier and parking systems; our parking management system guide shows how staff and visitor vehicles follow the same permission rules. In office towers and multi-storey buildings, access events can also be linked to lighting, HVAC and fire scenarios through a smart building management system (BMS).
How number plates, cards and appointments come together at the gatehouse is covered in our vehicle access control system guide; for sites where lorries, drivers and shift staff share one gate, see warehouse and logistics access control.
How do you choose a card access control system? Seven questions
Settle these questions before requesting quotes for a card access control system:
- Which zones exist, and who needs to enter each one? List the gatehouse, production, warehouse, offices, server room and the roles that use them. Our examples of zone-based access in factories and data centre access control show how such a map is drawn.
- Can a manager read the rules, and what happens when two conflict? If permissions only make sense to the installer, explaining them to an auditor becomes hard. When "production may enter the warehouse" meets "the warehouse is closed at weekends", you should be able to see which rule wins.
- What does the door do if the internet goes down? The controller should decide locally, keep its log and upload it once the link returns. We explain this behaviour in how access control works in offline mode.
- How will visitors and contractors get in? Permanent card or QR code visitor access? Both should follow the same permission rules.
- Will attendance and the canteen need separate devices? If one person taps three different terminals a day, the data ends up in three different places. We explain how a time and attendance system works separately, and list the questions to ask vendors in choosing time and attendance software.
- What happens in an emergency? You should be able to lock every door in one action and pull a zone-by-zone list of who is on site right now — in practice, an emergency muster report. How doors release during a fire is decided by access control and fire alarm integration.
- How long are logs kept, and who sees them? Retention, anonymisation and an audit trail need to be designed in from the start.
What does a card access control system cost?
The cost of a card access control system comes from the site's needs rather than a single package price. These are the items that decide it:
| Item | How it affects cost |
|---|---|
| Number of entry points | Every door, turnstile or barrier needs a reader, a controller connection and cabling. |
| Number of people | Sets the number of cards and the volume of records the software manages. |
| Existing hardware | If current turnstiles and locks can be reused, less new hardware is needed. |
| Scope | Whether attendance, canteen and visitor management share the same system changes how many devices you need. |
Each of the seven selection questions also shapes the budget; to compare quotes line by line, see what drives access control system cost. Once quotes arrive, use our access control quote evaluation checklist to catch scope gaps.
What should you watch for on data protection with access logs?
Access logs from a card access control system fall under data protection law wherever you operate. In Türkiye that is Law No. 6698 on the Protection of Personal Data, known as KVKK — broadly comparable in spirit to the GDPR. In practice, four principles matter most: logs are visible only to people with a legitimate need, a retention period is defined and expired records are destroyed or anonymised, changes to records are traceable, and employees are properly informed. Biometric data such as fingerprints or facial templates counts as a special category of personal data and needs extra care; we summarise the regulator's current position in our biometric attendance and data protection article. Access logs are one part of an organisation's wider KVKK compliance programme; handling them through data protection compliance consultancy while the system is being installed is far easier than retrofitting it later.
How we deliver card access projects at Digital Bridge
We do not sell a boxed package and walk away. A card access control project with us follows these steps:
- Needs analysis and site survey. We review zones, the number and type of entry points (turnstiles, barriers, door locks), cabling and network, on site or remotely.
- Permission map. Together we write down which role may enter which zone and when; this document becomes the draft rule set.
- Written proposal. Scope, phases and fees are set out clearly.
- Installation and commissioning. Because software and hardware come from the same team, responsibility for making readers, controllers and software work together stays in one place. We set out the full sequence in our access control system installation guide, and a staged cut-over from an old system in replacing a legacy access control system.
- Integration. When attendance data needs to reach HR or payroll, our system integration team takes it on; the steps are set out in time and attendance payroll integration.
- Support. We work remotely and on site across all 81 provinces of Türkiye, with technical support available 24/7.
SmartPass: door, attendance and canteen in a single card read
SmartPass, our own product, combines card access control, time and attendance, visitor management and canteen meal counting in one panel. Here is what a typical morning looks like:
At 07:52 a production worker taps their card at the gatehouse turnstile. One read opens the turnstile, creates the attendance record and starts their timesheet according to the shift plan; at month end, that record is the raw input for timesheet and overtime calculation.
At lunch, they tap the same card in the canteen and, if they are entitled to a meal that day, the meal is deducted, as described in our canteen meal counting automation guide. A supplier arriving the same morning is pre-registered at reception and receives a temporary card; its permissions are limited to the visit's access group and duration, and once the visit ends the card no longer opens any entry point.
What SmartPass brings:
- 13.56 MHz MIFARE and NFC cards, plus a mobile terminal. Only the card's ID number (UID) is read and nothing is written to the card; an Android phone with near-field communication (NFC) can also act as an entry point. For phone-based options, see mobile access control.
- Access groups and time profiles. A person's permissions are the union of the access groups they belong to; each group is linked to zones with an optional weekly time profile. Every refused pass is logged with its reason (for example no zone permission, or outside permitted hours), and a rule changed in the panel applies at every door at once.
- Zones and live monitoring. Gatehouse, production, warehouse, offices and more. An entry point in emergency mode frees exits, closes entries and emails the organisation's notification recipients; the dashboard shows how many staff, contractors and visitors are inside right now.
- Doors keep working when the internet drops. Every door and mobile terminal holds a copy of the permission list signed by the server; when the link is lost, decisions are made from that list under the same rules, and passes are queued and uploaded in full once the connection returns.
- No separate attendance device. Timesheets follow the shift plan and reports can be exported to payroll; night and rotating shifts are covered in shift attendance tracking.
- Designed with data protection in mind. Card numbers are not stored: they are turned into a one-way hash on the device, and only the hash and last four digits are kept. Once the retention period ends, fields that identify the person are deleted automatically; every change is logged with its previous and new value; 43 separate panel permissions decide who sees what.
- Built for multiple sites. Each site can be opened as a separate SmartPass organisation with its own database, and authorised users switch between sites from the "My organisations" list without re-entering a password.
SmartPass is part of the Smart360 product family: you sign in to the panel with your Smart360 identity (SmartID), so there is no separate SmartPass password. When a departing employee is deleted in Smart360, their name and personal details in SmartPass are erased and their card is cancelled, so access is closed in one place rather than lock by lock.
Next step
Put three things on a single page: how many entry points you have, who needs to go where, and how attendance is recorded today. Get in touch with that list and we will run the needs analysis with you and show how SmartPass would work with your own rules. To buy SmartPass, fill in the SmartPass quote form; pricing depends on the number of entry points, the number of people and the hardware required.