This paper presents a dynamic, privacy-preserving context-aware geofencing system designed to support indoor climate data access and control in IoT-enabled buildings. The approach addresses two interrelated challenges: safeguarding sensitive indoor climate data in compliance with the General Data Protection Regulation’s (GDPR) data minimization and purpose limitation requirements, and enabling responsive environmental control based on user presence without relying on continuous tracking. During installation, each IoT device is registered via a mobile application that automatically collects spatial metadata, including GPS coordinates, which are clustered and aggregated into convex hulls representing building footprints. These geofences govern both data access and control logic, with evaluations occurring locally on users’ mobile devices to preserve privacy. The system architecture integrates a Java-Spring-MongoDB backend with an Angular-based dashboard and supports real-time visualization using Leaflet, OpenStreetMap, and Three.js. Evaluations at two case study sites, a mid-sized Danish university building and a large Malaysian library, demonstrate accurate spatial modeling, responsive access control enforcement, and successful actuation of climate control systems based on geofence crossings. Results show that anticipatory thermal preconditioning and energy-saving setbacks can be triggered reliably by geofence events, confirming the viability of location-based automation as a privacy-aware control mechanism for smart buildings.