Replacing a legacy access control system means swapping out old readers, controllers and software while carrying doors, staff cards, permission rules and attendance data across without a break. Done well, staff barely notice. The method: take an inventory, rewrite the permission rules, pilot one zone at a time and keep old records accessible for their retention period.
Why an ageing access control system eventually lets you down
In many businesses the access control system was installed a decade ago by a supplier who has since vanished or stopped offering support. The software runs on a single PC whose operating system can no longer be updated, and nobody backs it up. When the one person who knows how to enrol cards goes on leave, new starters wander around on visitor passes for days.
The symptoms are familiar: a failed reader whose part is discontinued, an attendance export corrected by hand every month, leavers' cards never cancelled. Years of exceptions also mean nobody can explain who can open which door, or why. The question is no longer whether to replace the system but how to do it without disrupting production and shifts.
Before you start, it helps to recall the layers an access control system is built from; we cover them in our guide to card access control systems. Each layer needs its own decision in a replacement project: do the cards stay, do the readers change, does the cabling need replacing, and where do the historical records go?
The cost of putting it off
You are not the only one living with old technology. HID Global's 2024 survey of more than 1,200 respondents found that one in three companies still supported 125kHz low-frequency proximity cards, and nearly 30% still had systems using magnetic stripe cards (HID 2024 State of Physical Access Control Report, as reported by CampusIDNews). Most of these cards carry no encryption and are easy to clone; we explain the difference in 125kHz vs 13.56MHz access cards.
According to HID Global's 2024 report, 39% of respondents actively use mobile identities, and between 80% and 94% of organisations are expected to deploy mobile IDs over the next five years. (HID Global, 2024 State of Physical Access Control)
The wider market is moving the same way. MarketsandMarkets forecasts that the global access control market will grow from USD 10.62 billion in 2025 to USD 15.80 billion by 2030 (MarketsandMarkets, Access Control Market – Global Forecast to 2030), with growth driven by IoT-based security systems and cloud platforms. With investment shifting to the new generation, spares and updates for the old one will only get harder to find.
The hidden cost of waiting sits in payroll. If door events and attendance records live on separate devices, someone reconciles them at every month end and overtime becomes an argument. We show how that calculation works under Turkish labour law in overtime calculation and timesheets.
Replacing a legacy access control system: the 7-step plan
- Take an inventory. List every door, turnstile and barrier, with the reader model, lock type, cabling and network connection at each. Record the number of active cards, the card technology (125kHz, 13.56MHz, magnetic stripe) and your stock of visitor cards.
- Find out who holds the data, and in what format. Where do the staff list, card numbers, permission groups and historical events live? Can they be exported? If the original installer cannot be reached, this is usually the slowest step.
- Rewrite the permission rules rather than copying them. Moving hundreds of legacy groups and exceptions across also moves the mess. Define roles and zones from scratch, in plain sentences.
- Decide your card strategy. Existing cards can stay if the new readers support them. If you are moving away from 125kHz or magnetic stripe, plan the card swap shift by shift and track issue against a signature or a system record.
- Choose a pilot zone. Start with a handful of doors, such as the office entrance. During the pilot, check the permission rules, the attendance output and offline behaviour under real use.
- Run in parallel, then migrate in stages. Produce attendance from both systems for at least one full pay period and compare them. As the differences close, move doors across zone by zone, with a written rollback plan at every stage.
- Retire the old data, but do not delete it straight away. Move historical access events to an accessible archive for the period set in your retention policy, then dispose of them. Decommission the PC that ran the old software in a controlled way.
What stays and what goes?
| Component | Can it usually be kept? | Deciding factor |
|---|---|---|
| Turnstiles, barriers, door frames | Often yes | Is the mechanism sound, and does its lock interface suit the new controller? |
| Magnetic locks, door hardware | Often yes | Are the power supply and fire-alarm release connection in good order? |
| Cabling | It depends | Do the distances, cable type and network carry the new devices? |
| Readers | Usually no | If the card technology changes, the readers change too |
| Controllers and software | No | This is what the project replaces |
| Cards | It depends | Encrypted 13.56MHz cards may stay; 125kHz and magstripe usually go |
The table also shows where the budget goes; we break down each line in what an access control system costs. To compare replacement quotes from different suppliers on the same scope, use our access control quote evaluation checklist.
Four common migration mistakes
Switching everything overnight. Expecting every door to open on the new system at 7am on Monday is the quickest way to leave the morning shift queuing at the turnstiles. A staged migration looks slower but limits the risk to one zone at a time.
Ignoring network outages. If the new system depends on a server or the cloud, test how the doors behave when the connection drops before go-live. We walk through that scenario in access control offline mode.
Leaving integration to the end. How attendance reaches payroll and how the staff list flows from HR should be designed on day one, or the new system becomes another data island. You can map which data flows in which direction, and how often, with the framework in API integration explained.
Forgetting the old records. Access logs are personal data. Write down how long the old system's records will be kept, on what basis, and how they will be destroyed; our data retention and disposal policy guide explains how under Türkiye's data protection law, KVKK.
How we run a replacement project at Digital Bridge
We treat an access control replacement as a small migration project, not a hardware sale:
- Site survey and requirements analysis. We inspect doors, locks and cabling on site or remotely and work out, together with our card access control team, which hardware can be kept. Technical feasibility for hardware is free of charge, and the result becomes a written proposal setting out scope, phases and cost.
- Data migration and integration. We extract the staff and card lists from the old database, clean them and load them into the new system. We build the flow of attendance to payroll and staff data from HR as part of our system integrations work and, where needed, address the HR, payroll and personnel management software side too.
- Pilot and staged cut-over. We recommend starting in one zone, comparing attendance in parallel and then moving the remaining doors zone by zone.
- Data protection. Our data protection compliance service covers privacy notices, retention periods and disposal of the old records.
With software and hardware from one team, a single party answers for readers, controllers and software working together. We serve every province in Türkiye remotely and on site, with 24/7 technical support. If you are planning a new building rather than a replacement, our guide to access control system installation covers the process from start to finish.
What changes after migrating to SmartPass
Our own product, SmartPass, brings the scattered pieces of an old installation into one system. Card access control, time and attendance and canteen meal counting work together: a single card read opens the door, creates the attendance record and, where the person is entitled, deducts a meal. No separate attendance device is needed; timesheets follow the shift plan and reports can be exported to payroll.
The feature that helps most in a migration is keeping existing hardware: SmartPass's fixed terminal is vendor-neutral and works with OSDP readers and dry-contact relays, so turnstiles, door locks and barriers that can be triggered by a relay input can stay in place. Every reader and relay is bench-tested before installation, and staff and contractor lists are uploaded from Excel or CSV with a preview first; uploading the same file again does not duplicate records.
SmartPass works with cards readable over 13.56 MHz MIFARE and NFC, and your existing cards are assessed during the survey. Visitors receive a temporary card limited to the visit's time window. On the data protection side, card numbers are not stored but turned into a one-way hash as they are read, records past their retention period lose the fields that identify a person, and the audit log keeps previous and new values. If you run several sites you can migrate them one by one as separate SmartPass organisations; because the panel is reached with SmartID, the single identity of the Smart360 product family, users switch between sites from the "My organisations" list without re-entering a password.
Next step
Before you decide, put together a one-page inventory: number of doors, card technology, active card count, how attendance is produced today and whether data can be exported from the old software. Then get in touch. We will work through the requirements with you and show how your access groups and time profiles would be set up in SmartPass. For more guides, visit our Access Control & Attendance hub.