Municipal building access control is a card- or QR-based entry system that keeps a town hall's public service floors open to residents while restricting archives, cash offices, server rooms and executive floors to authorised staff. The aim is not to lock the building down but to separate public from restricted areas and record who entered where and when.
Why a town hall is harder to secure than an office
A factory or a corporate office decides who comes through its doors. A municipal service building does not have that luxury: during opening hours its front door must stay open to everyone. Through the same lobby pass residents paying property tax, architects checking a planning file, council members, cleaners employed by a municipal company and a contractor's maintenance crew.
A security officer runs a bag scanner at the entrance, yet once inside anyone can move between floors. The planning archive is locked with a key, and nobody knows how many copies exist. Staff who retire or transfer to another department keep a working card for months.
Then there is the calendar. Wedding ceremonies run at weekends and council meetings in the evening, so a system configured for office hours either leaves doors propped open or relies on a guard to intervene by hand. If you are new to the building blocks, our card access control guide covers readers, controllers and credentials; this article applies the same principles to a building that must serve the public.
What is lost without municipal building access control?
The first loss is information security. Municipalities hold data about residents and about the city itself: land and planning files, welfare applications, tax records, CCTV archives. Some of it still sits in paper archives, and much of the rest runs in a server room somewhere in the same building.
According to ENISA's Threat Landscape 2025, public administration was the most targeted sector in the EU, accounting for 38.2% of incidents where the sector could be identified. (ENISA Threat Landscape 2025)
That figure is mostly about cyber attacks, but physical access is part of the same chain. Network security spending is undermined if anyone can walk into the comms room without a card; we cover how to protect those rooms in our guide to data centre access control.
The second loss is legal exposure. In Türkiye, municipalities are data controllers under the Personal Data Protection Law (KVKK, Law No. 6698), and visitor books, camera footage and staff entry logs are all personal data. The KVKK 2025 Annual Report shows that 2,838 complaints (22%) concerned the unlawful sharing of personal data with third parties, while 551 concerned the failure to erase, destroy or anonymise data. A visitor book full of ID photocopies, kept on a shelf for years, is exactly that risk.
The rules on cameras are equally clear. A KVKK announcement of 8 June 2026 calls for the purpose of workplace cameras to be clearly defined, access to footage limited to authorised people, and recordings kept for the shortest possible period with automatic deletion. We explain how to manage footage and entry logs together in CCTV recording and KVKK.
The third loss is operational. In an emergency nobody knows how many staff and how many residents are inside. The headcount is done by phoning each department.
How to set up municipal building access control: seven steps
- Divide the building into three rings. A public ring (lobby, cashier desks, service counter, wedding and council chambers), a staff ring (department offices, back corridors, staff canteen) and a critical ring (archives, server room, cash office, executive floor, CCTV control room).
- Leave the public ring open, but define its edge. Doors between public and staff areas should be card-controlled. A lobby turnstile usually creates queues in a service building; our turnstile types guide compares the mechanical options where one is justified.
- Assign roles by job, not by contract type. Whether someone is a civil servant, a direct employee or staff of a municipal company does not determine access; their department and duties do. Cleaning, maintenance and contractor staff need their own roles with time-limited permissions.
- Bring booked visitors into the record. Give anyone entering staff areas, such as a planning meeting or an appointment with the mayor's office, a time-limited, single-use QR code instead of photocopying their ID. Our QR code visitor access guide explains the method.
- Write calendar rules up front. Council meetings, weekend weddings, election periods and holiday rotas should be scheduled rules, not ad hoc exceptions.
- Stop credential sharing at critical doors. At archives and the server room, an anti-passback rule combined with a door-contact alarm stops one card letting two people through; add a second factor where the risk justifies it.
- Test emergencies and outages. Escape doors must release on a fire alarm, and a list of who is still inside must be available after evacuation; we cover how to wire that up in access control and fire alarm integration. What the doors do when the network drops is covered in access control offline mode.
Example permission matrix by ring
| Area | Residents | Staff | Contractors | Control method |
|---|---|---|---|---|
| Lobby, cashier, service counter | Open during hours | Open | Open | Security point, CCTV |
| Department offices | With booked QR | Own department | Time-limited, task-based | Card-controlled door |
| Council and wedding chambers | Open per schedule | Duty staff | Technical crew, time-limited | Calendar rule |
| Planning and records archive | None | Archive staff only | None | Card + door alarm + log |
| Server and CCTV rooms | None | IT team | Escorted, time-limited | Card + anti-passback |
| Cash office | None | Cash officer | None | Card + second factor |
Treat the table as a starting point, since every municipality's departments and floor plans differ; what matters is that each cell maps to a written, approved rule.
Satellite buildings, attendance and public procurement
Few municipalities work from a single building. Depots, municipal police offices, cultural centres and neighbourhood service points sit elsewhere. A separate system at each site means staff carry several cards and reports are merged by hand; we cover central permissions with site-level separation in multi-site access control.
Staff attendance can come from the same card read. Instead of a separate fingerprint terminal, the door reader's event is matched to the shift plan and becomes a timesheet; our time and attendance guide explains the concept. Attendance rules for public employees vary between institutions, so agree early with HR which record counts for what.
On the purchasing side, Turkish municipalities are, as a rule, subject to Public Procurement Law No. 4734, and Article 12 of the Law restricts technical specifications from naming a particular brand or model or pointing to a specific supplier. Requirements therefore need to describe behaviour, not products: "the archive door keeps working with its last permission list when the network is down", for example. We explain the approach in writing technical specifications, and how to compare the resulting bids on a like-for-like basis in access control quote evaluation.
How Digital Bridge runs municipal access control projects
We start by walking the building. During the survey we list every door, existing reader, cable route and critical room, then talk to each department about who needs to go where and why. The output is a permission matrix by ring and role, plus a door schedule. This work sits within our public sector and municipal solutions, and can include specification support ahead of a tender.
The second step is a pilot. We usually pick the most critical few doors, such as the archive and server room, plus one department floor; rules are tested in daily use and exceptions are written down. On the hardware side the same team installs the card access control system, keeping existing locks and cabling wherever practical.
The third step is integration. Access events can be linked to IP camera monitoring, so a denied attempt at a critical door opens the relevant camera view on the same screen. Retention periods, privacy notices and access rights are documented with our data protection compliance service. For how this fits a wider modernisation plan, see digital transformation for municipalities.
A day in a town hall with SmartPass
SmartPass combines card access control, time and attendance and canteen meal counting in one system. In the morning a member of staff presents their 13.56 MHz card at the department door: the door opens and an attendance record is created. At lunch the same card deducts their meal entitlement in the canteen. No separate attendance terminal is needed; timesheets follow the shift plan and reports can be exported to payroll.
In the afternoon a citizen with an appointment at the planning department is pre-registered; on arrival they receive a temporary card and the responsible member of staff is notified by e-mail. The card's permissions are limited to the visit's access group and time window, and once the visit expires it opens no door. No ID number is collected from visitors. On the staff side, people belong to access groups: the IT team's group, for example, is linked to the server room zone, with an optional weekly time profile and public holiday rule. A permission change made in the panel applies at every door straight away.
The lobby, department floors, archive and server room are defined as separate zones, and the dashboard shows how many staff, contractors and visitors are inside right now, alongside a live access feed. An access point can be locked from the panel or switched to emergency mode, in which exits are freed, entries are closed and the organisation's notification recipients receive an e-mail. A separate body such as a municipal company can be opened as its own SmartPass organisation with its own database, and authorised users switch between organisations from the "My organisations" list without re-entering a password.
On data protection, SmartPass does not store card numbers: each number is turned into a one-way hash the moment it is read. Access records past their retention period lose the fields that identify a person, and every change is written to the audit log with its previous and new values. With 43 separate panel permissions, a narrow role that opens only the reports needed can be granted for internal audit or inspection. Erasure requests take one step too: deleting a person in the Smart360 platform removes their name and personal details from SmartPass and cancels their card, while the counts remain.
Next step
Let's work out together which doors in your service building are critical and how much of the existing infrastructure can be kept. Send us a door list, a floor plan or a draft specification via our contact page and we will arrange a site survey. For more guides, browse our access control and attendance articles.