Guide
Fob, biometrics, card or mobile: which access control credential?
Updated
The credential decision quietly sets your running cost for the next ten years, and it is the one part of the specification a non-specialist can genuinely judge.
The five options
| Credential | Strength | Weakness |
|---|---|---|
| Keypad or PIN | Cheapest per door, no credentials to issue or lose | Codes get shared, so there is no meaningful audit trail of who entered |
| Proximity fob | Cheap, robust, familiar, easy to issue and revoke | Easy to lose and, on older low-frequency technology, easy to clone |
| Smart card | Doubles as photo ID, supports encrypted credentials | Printing and reissuing cards is an ongoing cost and an admin job |
| Mobile credential | Nothing to issue or collect back, instant revocation, works well across sites | Per-user licence, and you need a policy for staff who will not use a personal phone |
| Fingerprint or face | Nothing to lose or lend, strongest link between person and entry | Highest cost per door and it processes biometric data, which is special category personal data |
The question that decides it
How often do people join, leave or lose things? A stable office of thirty with low turnover is well served by fobs. A warehouse with agency staff, a school with visitors and contractors, or a five-site business spends more on fobs than mobile licences. Work out annual churn and the true cost per credential, admin time included.
Encryption is not optional any more
Older 125kHz proximity technology can be copied with equipment that costs very little, which matters if the door protects stock, cash, controlled drugs or personal data. Modern encrypted 13.56MHz credentials and secure reader-to-controller protocols are the standard answer. Ask any installer, in writing, which credential technology and which reader-to-controller protocol they are proposing, and whether it is encrypted.
Biometrics: read this first
Fingerprint and facial recognition readers process biometric data used to uniquely identify a person, which is special category data under UK data protection law. You need an Article 9 condition as well as a lawful basis, and a genuine answer for staff who object.
You will normally need a data protection impact assessment, because you are monitoring people at a workplace. The ICO's surveillance guidance says a DPIA is required for processing likely to result in high risk, including monitoring individuals at a workplace (ICO). None of that makes biometrics wrong; it makes them a decision, not a default.
Mixing credentials
Most systems read more than one credential type. You can put mobile on the front door for staff, fobs on the loading bay for drivers and a keypad on the bin store. Ask whether the proposed readers support more than one technology, because adding a second credential later means changing readers.