See what contractor access control is, what Brazil's Law 6,019 requires of the contracting company, what to check before granting entry and how to use biometrics in line with the LGPD.
By: Vitória Willemann
Content based on Law No. 6,019/1974 and Brazil's General Data Protection Law (LGPD, Law No. 13,709/2018), consulted on 06/11/2026.
Contractor access control is the process that defines which professionals from contracted companies can enter the company, which areas they can access and for how long. Entry is only granted to those whose documents and training are up to date. Under Brazil's Law No. 6,019/1974, the contracting company is responsible for the safety conditions of contractors working on its premises.
| Topic | What the law says |
|---|---|
| Contractor safety | The contracting company must ensure safety, hygiene and health conditions when the work is carried out on its premises (Law 6,019, art. 5-A, § 3) |
| Labour obligations | The contracting company is secondarily liable for the period in which the service is provided (art. 5-A, § 5) |
| Contractor's activity | Using contractors for activities other than those set out in the contract is prohibited (art. 5-A, § 1) |
| Biometrics | Biometric data is sensitive personal data (LGPD, art. 5, II) |
| Using biometrics without consent | Allowed when essential to comply with a legal obligation or for fraud prevention and the data subject's security in identification and authentication (LGPD, art. 11, II, a and g) |
It is the set of rules and tools that decides, at the gate, whether a service provider can enter or not. Good control answers three questions: who the person is, whether they are qualified to do that job, and which areas and times they are allowed to be on site.
This applies to any contractor: maintenance, cleaning, construction, industrial assembly or teams hired for a plant shutdown.
Because the law places part of the responsibility on it. Article 5-A of Law No. 6,019/1974, added by Law No. 13,429/2017, states that:
In practice, letting someone in without training or with an expired document means taking on a risk the company could have avoided at the gate. See also how Brazil's Outsourcing Law handles secondary liability.
The exact list depends on the activity and the standards that apply to it. In general, the company checks:
For the full list, see which documents to require in third-party management.
| Method | How it works | Limitation |
|---|---|---|
| Gate with a list or spreadsheet | The gatekeeper checks the name against a list sent by the department | Does not show whether a document expired yesterday |
| QR Code badge | The badge is scanned in the field and shows the professional's status | Depends on someone scanning the code |
| Turnstile with facial recognition | The turnstile only lets in those cleared in the system | Involves biometric data and requires care with the LGPD |
The safest methods have one thing in common: entry depends on the real-time status of the documentation, not on a list made days earlier.
The LGPD classifies biometric data as sensitive personal data (art. 5, II). This type of data may only be processed in the cases set out in art. 11.
Without the data subject's consent, its use is allowed when essential, among other cases, to comply with a legal or regulatory obligation (art. 11, II, a) or for fraud prevention and the data subject's security in identification and authentication processes (art. 11, II, g). The company must define the legal basis, limit who can see this data and record who accesses it.
GAP's Third-Party Management links document review to entry at the gate:
Want your gate to let in only contractors with up-to-date documentation? Schedule a demo of GAP's Third-Party Management.
Yes, when the work is carried out on its premises or at a location agreed in the contract. Article 5-A, § 3 of Law No. 6,019/1974 states that the contracting company is responsible for ensuring safety, hygiene and health conditions for these workers.
No. Paragraph 1 of art. 5-A of Law No. 6,019/1974 prohibits the contracting company from using workers for activities other than those set out in the contract. That is why access control should also take into account the activity and area cleared for each person.
Yes, as long as the company complies with the LGPD. Biometric data is sensitive (art. 5, II) and may only be processed in the cases set out in art. 11, such as compliance with a legal obligation or fraud prevention and the data subject's security in identification processes.
Third-party management covers the whole relationship with contracted companies: documents, training, evaluation and compliance. Access control is the part that turns that analysis into a decision at the gate: in or out.
Ideally, access should be blocked automatically until the contractor sends the renewed document. With spreadsheet-based control, this expiry often goes unnoticed; with real-time status, the gate itself is informed.
Understand what MoC (management of change) is, what Brazil's NR 20 and NR 13 require when something changes in the operation, and how to build a 7-step MoC process.
Understand what NR 29 is, who it applies to, the role of the OGMO, SESSTP and CPATP, the inspection of lifting equipment and the rules for dangerous cargo.
Understand what NR 28 is, how labour inspection works, how fines are calculated (I1 to I4), the criteria for shutdowns and the standard's update for agribusiness.
Understand what NR 26 establishes, the official rules for safety signage, the use of the GHS in labelling and the preparation of the Safety Data Sheet.
Understand NR 25, the safety rules for handling, storing and disposing of industrial waste (solid, liquid and gaseous) and the occupational risk involved.
Understand NR 22, the rules for mining in Brazil, how the CIPAMIN works and the requirements of the sector's Risk Management Programme (PGR).
Simplify your Risk Management, reducing liabilities and ensuring safe, standardized, and auditable operations with fast implementation and advisory support.
