Biometric Access Control
Controlled physical access for commercial environments.
Design selected biometric access solutions around identity, audit, privacy, integration and operational requirements.
Discuss this requirement →Start with the environment, risk and required outcome.
Design selected biometric access solutions around identity, audit, privacy, integration and operational requirements. Namandla Consultants begins with evidence and recommends a proportionate engagement rather than a generic technology package.
Connected expertise for the wider environment.
Clear steps. Visible decisions.
How biometric access control works
A biometric reader does not store your fingerprint. It stores a mathematical representation of specific features extracted from it, called a template, and compares a fresh reading against that template to produce a match score. Whether the score clears a configured threshold determines whether the door opens.
That distinction matters for three reasons. Templates cannot be reversed into the original image on any properly implemented system. Templates from one vendor are not portable to another. And a template is still personal information under South African law, which the next section deals with in detail.
The modalities, and where each one belongs
| Modality | Strengths | Constraints | Typical placement |
|---|---|---|---|
| Fingerprint | Low cost, small footprint, mature, fast | Degraded by wet, dry, worn or damaged fingers. Manual and industrial workforces have measurably higher failure-to-enrol rates. | Office doors, low-to-moderate traffic |
| Facial recognition | Contactless, fast, works with gloves and dirty hands, high throughput | Sensitive to lighting and to backlighting. Requires liveness detection to resist photographs. Higher cost. | High-traffic entrances, industrial and food-handling sites |
| Palm vein | Very low error rates, contactless, near-impossible to spoof, unaffected by surface hand condition | Highest cost per reader, smaller vendor ecosystem | High-security areas, server rooms, cash handling |
| Iris | Extremely accurate, contactless | Cost, user positioning, slower throughput | Rare outside specialist environments |
The common failure is specifying fingerprint everywhere on cost grounds and then discovering that a warehouse or workshop population produces a high failure-to-enrol rate. Manual work damages finger ridges. A site with a significant industrial workforce should assume facial or palm at the operational entrances and fingerprint only in the office areas.
The numbers that describe accuracy
Vendors quote accuracy in three ways and the third is the one that lets you compare.
False Acceptance Rate
How often the wrong person is matched. Low FAR means high security.
False Rejection Rate
How often the right person is refused. Low FRR means the queue moves.
Equal Error Rate
The point where FAR and FRR are equal. This is the honest single figure for comparing devices, because FAR and FRR trade against each other and a vendor can quote a spectacular FAR by setting a threshold that rejects a third of legitimate users.
Set the threshold to the security level of the door. A server room should tolerate rejections. A turnstile at shift change should not, and a strict threshold there produces a queue and, within a fortnight, a propped door.
Presentation attack detection, also called liveness detection, is what stops a photograph or a lifted print being accepted. The relevant standard is ISO/IEC 30107. Ask specifically whether a reader is tested against it. Facial systems without liveness detection can be defeated with a phone screen, which is a well-documented limitation rather than a theoretical one.
POPIA and biometric data
This is the section that most access control proposals in this market leave out, and it changes what you should buy.
Biometric information is special personal information
Section 26 of the Protection of Personal Information Act prohibits the processing of special personal information, and section 26(a) includes the biometric information of a data subject. Processing is only lawful where one of the general authorisations in section 27 applies.
The Act defines “biometric” broadly: a technique of personal identification based on physical, physiological or behavioural characterisation, including fingerprinting, retinal scanning, voice recognition and DNA analysis.
The practical position is that a fingerprint or facial access system is not an ordinary IT deployment. It processes a category of information the Act singles out for stricter treatment, and the default is prohibition with exceptions rather than permission with conditions.
What that means for a corporate deployment
Establishing your lawful ground under section 27 is a question for your information officer, not for your access control installer, and any installer who tells you otherwise is selling past their competence. What we can do is build the system so that whichever ground applies, the technical controls support it.
Six design decisions follow from the Act.
1. Offer a non-biometric alternative
Where consent is the ground relied on, consent must be voluntary. Consent from an employee whose alternative is not being able to enter the building is difficult to characterise as voluntary. Configuring card or PIN credentials alongside biometrics for anyone who declines removes that problem and costs almost nothing. We configure this by default.
2. Store templates, never images
A system that retains the source fingerprint image or facial photograph holds far more information than it needs. Template-only storage is the norm on current hardware and it should be verified rather than assumed, because some platforms retain enrolment images for re-enrolment convenience.
3. Decide where the template lives
On-device storage keeps templates on the reader. Centralised storage puts them in a server database. Distributed credential storage keeps the template on a card the person holds, so the system matches the presented finger against the card rather than against a database. Distributed storage is the strongest position under the Act because the organisation holds no biometric database at all. It costs more and it is worth discussing.
4. Encrypt at rest and in transit
Templates in a database must be encrypted. Reader-to-controller communication must be encrypted, which means OSDP with Secure Channel rather than Wiegand. More on that below.
5. Set a retention period and enforce it. Templates for people who have left must be deleted, not deactivated. Access logs need their own retention schedule. Most systems will hold both indefinitely unless configured otherwise, and an indefinite retention setting on special personal information is difficult to justify.
6. Control and log access to the biometric database. Who can enrol, who can export, who can view. Named accounts rather than a shared administrator login, with an audit trail.
The documentation we produce
Alongside the installation we deliver a processing record describing what is collected and why, a retention schedule, an enrolment and de-enrolment procedure, notice wording for enrolment and for signage, and a technical description of storage and encryption written so your information officer can assess it without needing to interpret a vendor datasheet.
That is operational documentation, not legal advice, and it does not replace a personal information impact assessment. It does mean the assessment has something accurate to work from.
Technical design
Wiegand is obsolete and most sites still run it
Wiegand is the legacy reader-to-controller protocol. It is unencrypted, unauthenticated and one-directional. Anyone with physical access to the cable between a reader and a controller can read credentials off it and replay them. The devices to do so are inexpensive and openly sold.
OSDP, the Open Supervised Device Protocol, replaces it. Version 2 with Secure Channel provides AES-128 encryption, mutual authentication, bidirectional communication and supervision, meaning the controller knows when a reader is disconnected rather than simply seeing no traffic.
If you are installing new, specify OSDP v2 with Secure Channel enabled. Note the last part. A great many OSDP installations run with Secure Channel available and switched off, which gives you the cable topology benefits and none of the security ones.
Controller architecture
Panel-based
Readers connect to a central controller that holds the decision logic and the credential database. Doors keep working if the network or the server goes down, because the controller is local. Well proven, and the cabling is heavier.
Edge or IP-based
Each door has its own networked controller. Simpler cabling, easier to extend one door at a time, and dependent on the network being available and properly segmented.
Reader-based decisioning
The biometric reader itself holds templates and makes the decision. Cheapest, and it distributes the biometric database across every device on the wall, which is the weakest position to be in under POPIA and the hardest to purge when someone leaves.
For corporate sites we generally recommend panel-based or edge controllers with centralised template management and a documented purge process, rather than templates scattered across readers.
Locking hardware and the fail-safe decision
Fail-safe locks unlock when power is lost. Fail-secure locks stay locked.
The choice is driven by fire regulation and by escape route design, not by security preference. Doors on a designated escape route must release on fire alarm activation. Getting this wrong is a life-safety issue and it is checked at inspection. We design to the fire strategy for the building and we will ask for it before specifying hardware.
Every access-controlled door on an escape route also needs a green break-glass emergency release, wired to cut power to the lock directly rather than through the access system.
The features that make the system useful beyond the door
Anti-passback
Prevents a credential being used to enter twice without an intervening exit, which stops one person badging a group in. Requires controlled exit readers as well as entry.
Tailgating detection
Optical or radar sensors, or turnstiles. Access control alone cannot stop someone walking in behind an authorised person, and on sites where that matters the answer is physical rather than logical.
Roll call and mustering
A live list of who is on site, available at the assembly point. This is frequently the feature that justifies the whole system to operations and to health and safety, and it is often not configured because nobody asked for it.
Time and attendance integration
Access events feed payroll and shift systems. Worth a specific POPIA note: using access data for attendance is a different purpose from using it for security, and purpose limitation applies. If both are intended, both must be stated in the notice from the outset.
Zone and time-based rules
Contractors restricted to specific areas within specific windows. Cleaning staff with after-hours access to office areas and no access to server rooms. This is where an access system starts doing real work.
What Namandla delivers
Site survey and door schedule, with each door classified by security level and by escape route status. Modality selection per position based on the population using it. Reader, controller and locking hardware specification. OSDP cabling design and installation. Enrolment process design and the enrolment itself. Integration with CCTV, alarm, intercom and time and attendance. POPIA documentation set. Ongoing management under the same agreement as the rest of your IT estate, covering firmware currency, controller health, database backup and the leaver purge process.
Onsite work is Gauteng. Design, configuration and system management run nationally.
We do not do residential or small-scale installation. This is specified for corporate offices, campuses, warehouses, distribution centres, manufacturing sites and multi-site estates.
Common questions about Biometric Access
Is biometric access control legal in South Africa?
Yes, and it is regulated more tightly than ordinary access control. Biometric information is special personal information under section 26 of POPIA, which prohibits processing unless one of the general authorisations in section 27 applies.
In practice that means you need an identified lawful ground, notice to the people enrolled, a defined purpose, a retention period and proper security over the templates. Your information officer establishes the ground. We build the system so the technical controls support it, and we supply the processing record, retention schedule and enrolment procedure that the assessment will ask for.
Can we require employees to use biometrics?
That is a question for your information officer and your employment law adviser, not for us. What we can tell you is that where consent is the ground relied on, consent has to be voluntary, and consent given under threat of not being able to work is hard to characterise that way.
Where practical, an alternative credential such as a card or PIN can reduce reliance on biometric processing and gives the information officer and employment adviser more options when assessing the lawful basis. We normally design that fallback into the system unless the agreed policy requires something different.
Does the system store our fingerprints?
A well-designed system should store a biometric template rather than a raw fingerprint or face image. A template is a derived representation used for matching, but it remains biometric personal information and must be protected accordingly.
Verify what the specific platform stores, whether enrolment images are retained, where templates are replicated and how they are deleted. Do not assume all vendors use the same format or that a template is risk-free simply because it is not a photograph.
Which is better, fingerprint or facial recognition?
Neither in general. Fingerprint is cheaper and well proven and it struggles with manual and industrial workforces because worn or damaged ridges raise the failure-to-enrol rate. Facial is contactless, faster at high throughput and unaffected by hand condition, and it costs more and needs controlled lighting.
Site population decides it. An office of two hundred desk workers is well served by fingerprint. A warehouse with a hundred and fifty pickers is not, and specifying fingerprint there produces daily queues and workarounds. Mixed sites usually get facial at the operational entrances and fingerprint in the office areas.
Can biometric readers be fooled?
Basic readers without presentation attack detection can be. Facial readers without liveness detection have been defeated with photographs, and simple optical fingerprint sensors with lifted prints. Readers tested against ISO/IEC 30107 are substantially harder.
Ask specifically whether the model quoted has presentation attack detection and whether it has been independently tested. It is a meaningful differentiator between devices that otherwise look similar on a datasheet, and it is usually not on the first page of one.
What is OSDP and do we need it?
OSDP is the reader-to-controller protocol that replaces Wiegand. Version 2 with Secure Channel provides AES-128 encryption, mutual authentication and supervision, so a disconnected reader is detected rather than simply silent.
You need it on any new installation. Wiegand is unencrypted and can be read off the cable with inexpensive equipment. If you have an existing Wiegand estate, converters allow a staged migration rather than a full replacement. When specifying OSDP, insist that Secure Channel is enabled at commissioning, because a large share of OSDP installations run without it.
Can access control integrate with our CCTV?
Yes, and it is the integration worth doing first. An access event calls up the associated camera and bookmarks the footage, so reviewing an event takes seconds instead of scrolling through hours.
It works cleanly where both platforms support open interfaces, ONVIF on the video side and a documented API or relay interface on the access side. Verify it at specification rather than after installation, because closed proprietary platforms on either side make it expensive or impossible. We handle both sides on /commercial-cctv/.
What happens during a power failure?
It depends on how the door is specified. Fail-safe locks release, fail-secure locks stay locked. Controllers should be on battery backup so that the access decision logic and the event log survive an outage.
The specification is driven by the building’s fire strategy, emergency-egress requirements and the applicable standards rather than by convenience. Emergency egress must not depend on the access-control application remaining available. We ask for the fire strategy and coordinate the lock mode and release interfaces with the responsible fire or building professional before specifying hardware.
How do we handle staff who leave?
Their template must be deleted, not just deactivated, and the deletion has to reach every location a template is held. That is straightforward with centralised template management and difficult where templates are distributed across individual readers.
This is the single strongest argument for centralised or card-based template storage over reader-based storage. A leaver process that requires visiting fourteen readers will not be followed reliably, and an undeleted biometric template of a former employee is a retention breach that is easy to find and hard to explain.
Can we use access data for time and attendance?
Technically yes and most platforms support it. Under POPIA it is a separate purpose from security, so it needs to be stated in the notice given to staff at enrolment and covered by your lawful ground.
The practical advice is to decide both purposes upfront and put both in the notice, rather than deploying for security and adding attendance six months later. Retrofitting a purpose to data already collected is the most common way organisations drift out of compliance with good intentions.
What does biometric access control cost?
Priced per door plus the central platform. The door cost is reader, controller share, locking hardware, cabling and installation. Facial and palm readers cost several times a fingerprint reader, so modality choice moves the total more than door count does at small scale.
The costs people underestimate are cabling and containment, escape-route locking hardware and the enrolment exercise itself, which for a thousand-person site is a real project rather than an afternoon. We quote those separately so you can see them rather than finding them in a contingency line.
When is biometric access control the wrong choice?
When card or PIN access would meet the requirement, when your site has a small and stable population who all know each other, or when the POPIA overhead is disproportionate to what you are protecting.
Biometrics solve a specific problem, which is that cards get shared, lent and lost. If that is not actually happening to you, a well-run card system with proper credential management is cheaper, simpler and carries none of the special personal information obligations. We would rather tell you that at survey stage than sell you a system you did not need. A useful middle position is biometrics on the few doors that genuinely warrant them and cards everywhere else.