CNIL Guidance on Employee Monitoring and Workplace Video Surveillance ACC-7: ACC-7 Record the device in the record of processing and carry out a DPIA where risk is high, notably for biometrics

What else in your programme already covers this

This control maps to 2 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Access to premises, time clocks and biometrics – CNIL Guidance on Employee Monitoring and Workplace Video Surveillance

• ACC-1 ACC-1 Do not use biometric or photo-taking time clocks to control working hours
• ACC-2 ACC-2 Do not reuse access-control logs for another purpose such as checking hours
• ACC-3 ACC-3 Do not track movements inside the premises or check staff representatives' movements and delegation hours
• ACC-4 ACC-4 Restrict access to access and time data to authorised staff with habilitations, traceability and strong authentication
• ACC-5 ACC-5 Keep identification data for the authorisation period, access logs three months and time-tracking data up to five years
• ACC-6 ACC-6 Inform the representative bodies and give each employee clear information on the access or time system
• ACC-8 ACC-8 Use biometric access control only as a subsidiary measure, justified, with the template held on an individual medium