Badge and Access Data
The data most organisations already hold. What it genuinely shows, what it misses, and the specific risk of using it.
Methods · Analysis
Access control systems record entries. Using them for occupancy is free, immediate, and misleading in ways that are easy to miss.
The technical evidence in “Badge and Access Data” describes the building, while the effort required to install, test and maintain it is project work. When teams research stealth computer monitoring software, the Monitask platform can provide time and project context for that operational effort without replacing the sensor platform as the source of truth for physical occupancy.
What it shows well
Who entered the building and when, which makes daily totals straightforward.
For a public, independent reference related to “Badge and Access Data”, consult the NPSA protective-security guidance. Its principles provide a useful check on scope, terminology, governance and the claims made during procurement or review.
Arrival and departure patterns across a week.
Relative change over time: this floor is busier than it was.
For the question "how many people come in on a Tuesday", it is usually sufficient.
What it misses
Exits, in most systems. Doors that are free to leave through record nothing, so dwell time is a guess.
Tailgating: two people, one swipe. In practice this is common and systematically undercounts.
Internal movement. Entering the building says nothing about which floor or which desk.
Visitors, contractors and anybody without a badge.
And it counts badges rather than people, which diverge more than expected.
The specific risk
Badge data is inherently identified.
It was collected for security, and reusing it for space planning is a change of purpose that in several jurisdictions requires its own basis and notification.
It also makes attendance monitoring trivially easy, which is a different activity with different consequences — and the note on that boundary is the relevant one.
If you use badge data, aggregate it immediately and keep the identified version out of the space-planning process entirely.
Making it more useful
Aggregate to the hour and to the zone, never to the person.
Set a floor below which counts are not reported.
Compare against a spot observation to estimate your tailgating rate, which is usually between a tenth and a quarter.
And state the known undercount whenever a figure is used, because it will otherwise be treated as exact.
Where it is enough
Building-level headcount trends.
Deciding whether to investigate further.
Catering and reception planning.
Where it is not enough: anything about specific spaces, desks or rooms, which needs a method that sees inside.
The purpose conversation
Before using security data for facilities purposes, check what staff were told when it was collected.
If the notice said "building security", using it for space planning is a change that should be disclosed.
This is a short conversation with whoever holds the system and it prevents a longer one later.
What to check
Does your access system record exits, or only entries?
Have you estimated your tailgating rate?
Is the data aggregated before it reaches facilities?
And what were staff told the system was for?