GDPR-Compliant Access Control on the Construction Site - Data Protection

Access control data protection on the construction site made easy: how consent and liability arrangements work with the Bausicht platform

(Important note: This post does not replace legal advice. It contains general information and non-binding recommendations)

The management of construction sites and construction projects is becoming increasingly complex – and at the same time, data protection requirements are rising. Especially when creating employee and subcontractor data in digital tools, the question often arises as to who is responsible for GDPR compliance and how liability risks can be minimized.

In this post, we show you – purely for information purposes and without legally binding advice – how this can be achieved simply and in a data-protection-compliant manner with the Bausicht platform, using construction site access control as an example.

The Bausicht Data Protection Concept for Access Control: How It Works

One of the main goals in developing our platform was to make handling data protection issues as easy as possible for our customers. To this end, we worked together with data protection experts to develop a concept that gives you greater security while minimizing the administrative burden. This results in two options for ensuring GDPR-compliant access control for construction companies:

Two Paths to Data-Protection-Compliant Consent for Access Control on Construction Sites

1. Individual Bausicht invitation by email

With this option, you invite your employees, subcontractors or other parties directly by email to register on the platform. In detail, the process looks like this:

• Invitation email: The person receives an email with a link to the Bausicht platform
• Checkbox click: When logging in for the first time, they must agree to the privacy policy and the data processing agreement (DPA) with Bausicht.
• Greater legal certainty: Through this confirmation, a separate DPA is concluded with Bausicht – the user is thus responsible for the data they themselves enter into the system.

Advantages:

• Automated process: Perfect for companies that involve many sub-subcontractors or want to simplify their administration.

• Complete traceability: Every person who enters data into Bausicht has previously agreed to a DPA, which offers the customer greater legal certainty.

Our tip:

To enter employee data, companies can, for example, invite all employees via email. During the invitation process, the invited persons digitally sign the consent as well as the data processing agreement (DPA).

2. Sample consent form (e.g. for persons without an email address)

An individual invitation is not always possible. On a large construction site, not every foreman, subcontractor or individual fitter is invited by email. For this purpose, we offer a sample consent form that is filled out and signed on site (on paper or digitally). In it, the persons declare:

• that they agree to the processing of their data on the Bausicht platform,
• which data is stored (such as name, contact details, attendance times),
• and that this data can be viewed by authorized persons (client, project manager, foremen, etc.).

Advantages:

• A practical solution for anyone who does not have an email address or who, for other reasons, does not wish to work via the invitation system.

• Easy handling: obtain the signature, file the consent, done.

Who is liable in the event of a data protection breach?

In practical terms, a chain is established: whoever creates a person in the Bausicht platform is also liable for GDPR compliance. If the invited person in turn creates additional persons, they too bear the data protection responsibility for the data they add. This protects the original inviter.

Since subcontractors conclude the DPA directly with Bausicht, logistics providers and general contractors are protected if subcontractors enter data that is not GDPR-compliant.

Conclusion: A Simple and Legally Secure Access Control Solution for Everyone on the Construction Site

With the Bausicht platform and the appropriate sample documents, two paths are available for integrating employees and subcontractors in a data-protection-compliant manner:

Direct invitation via email with automated consent to the DPA and privacy policy

Consent form on paper or electronically for persons who cannot be invited by email

This way, you always know who is present on the construction site while staying on the safe side of the GDPR. Every person who enters data independently concludes a data processing agreement with Bausicht and thus bears the responsibility for the lawfulness of the data processing. The result: a lean, efficient process that largely spares you trouble with fines and liability issues – and makes everyday work on the construction site considerably easier.

See for yourself and test it free for 14 days!