Lift Access Control in India (2026): Restricting Floors Safely

Most access control stops people at a door. Lift access control does something a plain door cannot: it decides which floors a person is allowed to reach, and quietly refuses the rest. Tap your card in the car and only your own floor plus the common areas light up. A hotel guest's key-card reaches the lobby, the amenity floors and the one floor their room is on, and nothing else. An office card reaches the team's floor and the cafeteria, but not finance or the server floor. It is one of the most useful controls in a tall building, and also one of the most dangerous to get wrong, because a lift is a life-safety machine and no access rule may ever trap a person in a fire.

This guide is part of Studio Matrx's access control library. It explains how floor-level control actually works, how it plugs into the building access system, the three settings that use it most, and the single rule that overrides everything: fire wins.

Scope & safety. This guide is for planning, specifying and coordinating a lift access-control project, not for wiring one. The interface into a lift is a licensed lift-OEM plus integrator plus fire-safety job, never a DIY connection into the shaft or control panel. Every controlled point on an escape route must fail-safe: on power loss and on a fire-alarm signal it must release, the stairs must stay free, and a manual release must always work. A lift must obey fire recall — return to a safe floor and open its doors — and access restrictions must never prevent evacuation. This is educational guidance, not legal advice.

What lift access control actually does

A normal lift will take anyone to any floor. Lift access control adds a credential check between the person and the floor buttons: a reader in the car (or at the landing) identifies the person, the access system checks what they are allowed, and only the permitted floor calls are honoured. Everything else stays dark or is simply ignored.

There are two broad ways to do it, and the choice shapes cost, wiring and how the building feels to use.

Car-call control (the common retrofit)

A reader sits inside the car next to the button panel. You tap, and for a few seconds the buttons for your authorised floors become live; you press the one you want. Under the hood, the access controller tells the lift OEM's controller which floor calls to enable. This is the model most Indian apartment towers and mid-size offices use, because it can be retrofitted to an existing lift through the OEM's interface without redesigning the whole lift.

Destination control (bigger buildings)

In larger towers you badge at a destination control system kiosk in the lobby, key in (or the system already knows) your floor, and it assigns you a specific car. There are often no floor buttons inside the car at all. Because the system knows every passenger's destination before the doors open, it groups people going to the same floors, which cuts waiting and crowding. It also makes access control cleaner: the floor decision happens once, at the kiosk, before anyone steps in.

Whichever model, the credential itself is the same family you would use on any door: a card, a mobile credential on a phone, a biometric, or a combination for higher-security floors via multi-factor. The floor rights are just another permission attached to that credential in the access system.

The three settings that use it most

The same technology looks quite different depending on who is riding.

Apartment towers

In a residential tower, floor control means a resident reaches only their own floor plus the common floors — lobby, clubhouse, gym, terrace, parking. A visitor gets a temporary right to the host's floor, issued by the guard or the resident through the app, tied to the visitor flow you would run through visitor access management and often triggered from the video door phone at the gate. This stops the common failing of open lifts in societies: anyone reaching any floor. It pairs naturally with the door-level controls in the apartment access control guide, and sits inside the wider picture in the security guide for apartments and gated communities.

Offices

Here the same mechanism becomes floor and department control. A card reaches the floors a role is entitled to and no others, which is exactly the role-based access control model applied to vertical movement: finance staff reach finance, engineering reaches its floors, everyone reaches reception and the cafeteria. It is also how a multi-tenant building keeps one company's staff out of another's floor while sharing a lift core. Pair it with the door-level plan in office access control, and read the wider commercial-building security guide.

Hotels and serviced buildings

A hotel is the purest case. The guest key-card reaches only the booked floor plus the lobby and amenity floors — restaurant, pool, spa, business centre — and expires at checkout. This is the same key that opens the room, so hotel lift control and room-lock control are usually one system; see hotel-style digital locks for the room side and the security guide for hotels and resorts for the whole picture. It reassures guests that a stranger cannot ride to their room floor at will, while keeping amenities open to everyone who is allowed.

How it integrates with the building system

Lift access control is not a standalone box. It is a permission living inside your main access-control platform, expressed to the lift through a defined interface.

• The credential and rights sit in the access system. The same card or app that opens the main door carries the floor rights. You manage them in one place — issue, change, revoke — rather than programming the lift separately. A cloud access-control platform lets a facility manager change a person's floor rights remotely; an offline or hybrid setup keeps the lift usable in a network outage by caching rights locally.
• The access controller talks to the lift OEM controller, not the lift itself. This is the load-bearing point. The access system presents a simple allow or deny to the lift OEM's own controller through the OEM's published interface. Nobody wires a third-party board into the traction, doors or safety circuits. The OEM controller keeps sole charge of moving the car safely.
• It shares the same logs and audit trail. Every floor call by credential is a record. Handled through your access-control audit trails, it answers who went to which floor and when — useful for investigations and, in offices, often linked to time and attendance. That log is also personal data, which we come to below.

For a building being designed from scratch, the lift interface should be on the drawing from day one alongside the door controllers, the ANPR at the gate and the overall plan in the building security systems guide. Retrofits are common too, but they hinge entirely on whether the installed lift OEM offers an access interface — which is the first question to ask, not the last.

Fire, egress and the rule that overrides everything

This is the section that must never be skipped. A lift is a life-safety machine, and floor restrictions can, if done carelessly, make an emergency worse. The controls below are mandatory, governed by the National Building Code and fire regulations, and are a coordinated licensed job between the lift OEM, a fire-safety consultant, the integrator and the electrical contractor.

• Fire alarm must trigger fire recall. On a fire signal, the lift OEM controller takes over completely: it returns the car to a designated recall level (usually the ground or a fire-service floor), opens the doors and stops responding to normal calls. Access-control floor restrictions are overridden the moment recall begins. The access system does not fight the recall; it steps aside.
• Access rules must never block escape by the stairs. Restricting lift floors is fine because there is always another way down. Every stairwell and escape route must stay usable on foot. If any door on that route is access-controlled, it must fail-safe — release on power loss and on the fire signal — and carry a manual release, exactly as set out in the emergency door release guide. You control who takes the lift to a floor; you never control who can walk out of the building.
• Responders get a manual override. Firefighters must be able to seize the lift with a key-switch and drive it manually to reach a fire floor, regardless of any access setting. This is designed in by the lift OEM.
• Power cuts must not strand anyone. In India this is routine. The lift's own emergency and standby arrangements, plus a UPS on the access side, must be planned so a mains cut never leaves the access layer holding a car or a door in a way that traps a person. The default on any egress path is: release and free.

None of this is optional, and none of it is something an access-control installer improvises on site. The one device nobody is ever taught or allowed to defeat is the emergency release and the fire recall. If a proposal for lift access control does not put fire recall and stair egress first, it is the wrong proposal.

Privacy: the floor-access log is sensitive data

Every time a credential calls a floor, it can be logged — a precise record of who went where and when inside the building. Under the Digital Personal Data Protection Act, 2023, that log is personal data and must be handled accordingly.

• Lawful basis and notice. Residents, employees and guests should be told, in plain language, that floor access is logged, why, and for how long. For staff this usually rests on employment and building-security grounds; for guests, on the hotel's terms.
• Minimise and retain sensibly. Keep only what security genuinely needs, and set a retention period rather than storing floor logs forever. Define who — the facility manager, the RWA committee, the hotel security lead — can view them, and record when they do.
• Guard the credentials and the data. The access platform holding floor rights and logs is a security asset in its own right; protect it with strong administration, limited admin accounts and the same care described across the access-control audit trails guide. In a society, the RWA is effectively a data fiduciary for this information and should treat it that way.

Costs and what to plan for in India

Prices vary widely with the number of lifts, floors, the credential type and whether it is a retrofit or a new install, so treat these as planning bands, not quotes. Get the lift OEM's interface quote early, because it often dominates the cost.

To sketch a system and its budget before you brief a vendor, the Studio Matrx access-control system designer and access-control cost estimator let you model the doors and lifts together, and the smart-lock selector helps on the door side. For the mains and cabling context, see the electrical guides.

When to bring in a professional — always, for the lift interface. Specifying floor rights and choosing credentials is planning you can lead. But the actual connection into the lift, the fire-recall interlock and the egress fail-safe are a coordinated licensed job for the lift OEM, a fire-safety consultant, a licensed electrician and the access integrator, signed off to the fire code. Do not let a general access-control installer wire into a lift, and never accept a design that puts a floor restriction ahead of fire recall or free stair egress.

Key takeaways

• Lift access control restricts which floors a credential can reach — resident to their own floor plus common areas, staff to their department, guest to their booked floor plus amenities — using the same cards, phones or biometrics as your doors.
• Two models: car-call readers inside the car (common retrofit) and destination control at a lobby kiosk (larger new buildings); both express floor rights held in the main access system.
• The access controller only presents an allow or deny to the lift OEM's controller through the OEM interface — it never wires into the shaft, traction, doors or safety circuits.
• Fire always wins: a fire alarm triggers fire recall, access restrictions are overridden, the stairs stay free, doors on escape routes fail-safe, and firefighters get a manual override. This is a licensed, coordinated job.
• The floor-access log is sensitive personal data under the DPDP Act, 2023 — give notice, minimise, set retention, and control who can view it.

References

• Digital Personal Data Protection Act, 2023 (India) — lawful basis, notice, minimisation and retention for access and floor-access logs. Ministry of Electronics and Information Technology.
• National Building Code of India and fire-safety provisions for lifts and means of escape — fire recall, firefighter lift override, and egress, verifiable via the Bureau of Indian Standards at https://www.services.bis.gov.in/.
• Lift OEM technical documentation and access-interface datasheets (e.g. major elevator manufacturers) — the published interface through which an access system may present floor permissions.
• Access-control platform and reader manufacturer datasheets — floor-control modules, credential types and audit-log features.

This guide is educational and does not constitute legal, fire-safety or engineering advice; lift, fire-recall and egress work must be designed and certified by licensed professionals for your specific building.