Key points
- Use a non-sensitive internal reference to identify each key.
- Assign every issue to an authorised person and an expected return.
- Route an unconfirmed return through the agreed exception process.
Define who may issue and receive a key
Management designates the key-store owner, people authorised to issue keys and roles eligible to receive them for their duties. This authorisation list is separate from the daily register: the register records a handover but does not itself create permission.
The EDPB recommends protecting keys and controlling access to sensitive areas. In this proposed hotel workflow, detailed key mappings remain in the property’s approved secure environment. The shift register shows an internal reference and holder, without alarm codes or programming information.
Record the information needed each day
| Field | Illustrative example | Check |
|---|---|---|
| Access-device reference | SK-014 | Matching internal label |
| Holder | Authorised staff identifier | Permission verified |
| Issue | Time and issuing employee | Acceptance confirmed |
| Expected return | End of the relevant shift | Known deadline |
| Actual return | Time and receiving employee | Physical presence checked |
| Exception | Return unconfirmed, case E-09 | Owner and next action assigned |
Match the acceptance evidence to the chosen record system. Do not describe a confirmation as an electronic signature if the system does not provide one. A recorded acknowledgement may meet the internal operational need, but the hotel should define its intended meaning and the process for making corrections.
Manage issue and changes of holder
- Verify the employee’s professional identity and authorisation for the assignment.
- Check the reference of the key actually being issued.
- Record the holder, time and expected return.
- Obtain acceptance before completing the handover.
- Prevent informal transfers: a change of holder follows the approved process and updates the register.
When relief staff arrive, check their authorisation before issue. Familiarity with the property or a colleague’s verbal agreement does not replace that check. Contractor handovers follow the specific conditions established by the hotel, including whoever is responsible for confirming the end of the assignment.
Observe the return rather than inferring it
The key-store employee confirms physical return and the correct reference. They record the actual return time and place the device in its designated location. A holder finishing their shift does not prove that the key has come back.
At shift change, reconcile expected keys, keys present and assignments still active. Transfer exceptions to the incoming owner with the action under way. This fits within hotel operations coordination, while the detailed register remains restricted to authorised people. If a colleague says a key was handed directly to another employee, verify that handover through the approved process rather than guessing who now holds it.
Illustrative example: a key still assigned after shift change
SK-014 remains assigned to an employee whose shift has ended. The store owner finds that its return was never confirmed. They open E-09, review the recorded handovers and contact the holder using the agreed professional channel. They do not mark the key as present simply to balance the register.
If the situation is not promptly explained, they follow the missing-key procedure and inform the competent role. That role decides the protective measures in the relevant system. The register retains the reporting time, decision and final confirmation without recording technical security secrets or instructions for bypassing controls.
Close the exception and review permissions
An exception closes when the responsible person confirms the outcome: the device is recovered and verified, or the required protective action has been completed under procedure. A message saying “probably on a trolley” is not a resolution and should not remove the item from the next shift’s attention.
When an employee changes role or leaves, reconcile open assignments and have the relevant owners review permissions. Retain register data under a justified policy with restricted access. Its purpose is accountable custody, not unnecessary circulation of staff movements. Keeping that purpose clear also helps decide which details belong in a general handover and which should stay in the secure record.
Frequently asked questions
Can the hotel use a paper register?
Yes, if access, legibility, timely updates and physical reconciliation are controlled. Prevent ambiguous corrections and define how useful history is retained. A digital system likewise does not remove the need to verify actual return.
Should the register list every door each key opens?
Not in the general shift view. Use an internal reference sufficient to identify the access device. Sensitive mappings and settings should remain available only to roles that need them for their work.