Security Considerations in Workplace Management Systems

Every time employees use an app to reserve desks, meeting rooms, or parking spaces, they create personal data. A Workplace Management System has to protect this data reliably.

Security in a Workplace Management System covers five areas: data protection and the GDPR, access control, cloud and IT infrastructure, physical security in the building, and employee co-determination. Who can see which data, and when? How is employee privacy protected? And how do you make sure a cloud-based tool doesn't become a weak spot in your IT?

In this article, we look at each of these five areas and show what companies should look for when choosing a provider.

Contents

• Data Protection and the GDPR: Trust as the Foundation for Desk Sharing
• Access Control in the Workplace Management System: Who Can See What?
  
• IT Infrastructure and Cloud Security 
  
• Physical Security: The Bridge Between the Digital and Real Worlds
• Legal Compliance and Employee Participation 
• Checklist: Security Features to Consider When Selecting a Provider
• Our Conclusion

Data Protection and the GDPR: Trust as the Foundation for Desk Sharing

When employees book desks and parking spaces or log their work-from-home days, they create personal data that reveals attendance patterns. Any company processing the data of employees in the EU must comply with the General Data Protection Regulation (GDPR). In Germany and several other European countries, employee representatives also have a say, because a system like this could in principle be used to monitor employees.
A secure Workplace Management System therefore supports "privacy by design" and "privacy by default". In practice, this means:

• Data minimization: The system collects only the data needed for booking and planning. Monitoring features such as movement profiles are not part of it.
• Anonymization: Bookings can be anonymized so that colleagues don't see names. Aggregated data is enough to analyze occupancy. What matters is that the analysis doesn't allow conclusions about individuals, even in small teams.
• Clear retention periods: Booking data isn't stored indefinitely. Companies decide how long they need booking histories, and the data is deleted after that.
• EU hosting: Data is stored in certified data centers in Europe, and a data processing agreement (DPA) defines what the provider may do with it.

Access control in the workplace management system: Who is allowed to see what?

Not everyone in the company needs the same permissions. Office managers handle locations, rooms and desks. Employees see what they need to plan their office days and manage their own bookings.

Role-based access management ensures that users only access the features and data they need for their work.

Single sign-on (SSO) is another key building block. By connecting to existing identity providers such as Microsoft Entra ID or Google Workspace, employees don't need an extra password. That's more convenient and lowers the risk of weak or reused passwords. The central login itself then needs strong protection, for example with multi-factor authentication.

When someone leaves the company, their access to the Workplace Management System should end immediately. The most reliable way is automated user provisioning, for example via SCIM or an HR integration: once a person is deactivated in the central system, their account in the Workplace Management System is deactivated too.

IT Infrastructure and Cloud Security 

Workplace Management Systems usually run as Software-as-a-Service (SaaS) in the cloud. This means companies don't need to run their own servers but it doesn't change who is legally responsible. Under the GDPR, the company remains the controller of its employees' data. When choosing a provider, look for:

• Server location: Hosting in Germany or the EU makes GDPR compliance easier. Just as important is which subprocessors the provider uses and where they are based.
• Encryption: Data should be encrypted in transit and at rest using current standards.
• Certifications: An ISO 27001 certification shows that the provider runs an information security management system that is audited externally on a regular basis. Check whether the certificate covers the provider itself or only the data center it uses.

Physical Security: The Bridge Between the Digital and Real Worlds

Workplace management systems not only control digital processes but also have a direct impact on physical security within the building. Through interfaces, they are often connected to access control systems, digital room signs or other building systems. Each of these connections is a potential point of attack. That's why interfaces should be encrypted, properly authenticated and limited to the permissions they actually need.

Booking data can also support emergency planning. During an evacuation, it shows fire wardens which desks and rooms were booked that day. This doesn't replace the headcount at the assembly point, but it gives a quick first overview. The prerequisite: the data is up to date and access is clearly regulated.

Legal Compliance and Employee Participation 

In Germany, a company that introduces software technically capable of monitoring employee behavior or performance needs the approval of the works council. Whether the company actually intends to use this capability doesn't matter. Other European countries, such as Austria, also give employee representatives a say. Successful implementation therefore requires involving them early and transparently. Learn more in our article “Desk Sharing and the Works Council”.

These points make the process easier:

• Works agreement: It defines what the system is used for, who can see which data, how long data is stored, and that the system won't be used to monitor performance or behavior.
• Documented technical limits: If the system can't create movement profiles and analytics are only available in anonymized form, you can show this to the works council in concrete terms. This doesn't replace co-determination, but it makes negotiations much easier.

Checklist: Security Features to Consider When Selecting a Provider

These points summarize what companies should consider when selecting a workplace management system: 

• Data minimization: only data needed for booking and planning is collected
• Anonymized analytics: occupancy statistics don't allow conclusions about individuals
• Defined retention periods: booking histories are deleted after a set period
• Data processing agreement and a transparent list of subprocessors
• Role-Based Access Management: Users see only the data they need for their work
• Single Sign-On: Integration with existing identity management systems such as Microsoft Entra ID or Google Workspace
• Automated user provisioning, for example via SCIM, so access ends immediately when someone leaves
  
• Server location in Germany or the EU
• Encryption in transit and at rest
• ISO 27001 certification of the provider itself
• Secured interfaces to access control, room signs and other building systems

Our Conclusion

The success of a flexible workplace model depends on employee acceptance. If employees feel that their data isn't safe or that they are being monitored, they will reject the system. Security is therefore not an add-on but a prerequisite for success. Companies that compare providers against clear criteria and involve employee representatives early lay the foundation for a system everyone can trust.

On our data protection page, we show how desk.ly, an ISO 27001-certified provider based in Osnabrück, Germany, puts these points into practice. Feel free to hold us to this checklist, too.