Physical access control prevents unauthorised persons from physically entering premises and facilities in which personal data is processed.
Typical measures
- locking systems with key or card management
- secured server rooms with restricted access
- visitor rules and escort requirements
- alarm systems and, where appropriate, video surveillance
Classification
Physical access control comes from the catalogue of control objectives in the former BDSG and is still used today to structure technical and organisational measures. In more recent catalogues, such as Section 64(3) BDSG, it is covered by access control for processing equipment.
It also remains relevant for cloud services: here, the provider must demonstrate how its data centres are physically secured.
Legal provisions
- Art. 32 GDPR
- Security of processing.
- Section 64(3) BDSG
- Catalogue of control objectives as guidance.
Related terms.
Data access control Data access control ensures that authorised persons can only access the data they need for their tasks. Art. 32(1)(b) GDPR 
Technical and organisational measures (TOMs) Technical and organisational measures are the specific precautions a company takes to protect personal data. Art. 32 GDPR Video surveillance Video surveillance is the monitoring of rooms or areas using optical-electronic equipment, and it is permitted under data protection law if it is necessary and proportionate. Art. 6(1)(f) GDPR
All terms from A to Z Technical and organisational measures (TOMs) Technical and organisational measures are the specific precautions a company takes to protect personal data. Art. 32 GDPR Video surveillance Video surveillance is the monitoring of rooms or areas using optical-electronic equipment, and it is permitted under data protection law if it is necessary and proportionate. Art. 6(1)(f) GDPR 