Resources
Processing visitor data in line with the GDPR
Visitor data belongs to people who have no contract with you. The processing should be regulated accordingly.
In short
Digital visitor management processes personal data of people with no contractual relationship to the organization. Four points matter: data minimization at capture, a visible location-specific privacy notice at check-in, a separate and short retention period for visitor data, and a clear role concept for access to visitor lists.
- Typical data
- name, email, company, times
- Notice
- location-specific at check-in
- Retention
- configurable separately from booking data
- Role
- CGI as processor
The most common mistake: too many fields
Digital visitor solutions invite form creep – licence plates, ID numbers, health questions, photos. Every additional field increases both risk and justification effort. The sober question is: what do reception and security actually need to do their job?
What digital does better than paper
From a data protection perspective the paper list at reception is rarely the better option: it lies open, every subsequent guest sees the previous ones, there is no retention period and no access restriction. A digital solution with a role concept, a configured period and logged access is – set up properly – the more privacy-friendly route.
Note
This guide does not replace legal advice. It describes the technical options and the principles proven in practice; the data protection assessment for your organization sits with you.
How it works
- 1
Collect only what is needed
For the core purpose, name, email address, company, appointment and check-in/check-out time are usually sufficient. Every additional field in the registration form needs a justification.
- 2
Make the notice visible
The privacy notice is shown and confirmed at check-in – location-specific, because local requirements can differ.
- 3
Set a separate period
Visitor data usually needs shorter retention than booking data. Door James allows separate anonymization and deletion periods per data type.
- 4
Limit access
Visitor lists should be visible only to reception, security and the responsible location roles – not to all administrators.
- 5
Document the safety briefing
Where a briefing is required, its confirmation is captured at check-in and can be exported – replacing loose paper records.
- 6
Regulate emergency use
Record that visitor data is used for the presence list in an emergency, and limit access to that purpose.
Frequently asked questions
May we scan or copy ID documents?
That goes far beyond the usual purpose and is legally delicate. Door James does not need it: identification works through the QR code and visit ID from the invitation.
How long may visitor data be stored?
That depends on the purpose – reception handling, security, evidence obligations. Define a concrete period and configure it; the technical capability exists.
Who is responsible for visitor data?
Usually your organization as controller. CGI processes as processor under the data processing agreement.
What applies to ad-hoc visitors?
The same principles: minimal collection, visible notice, defined period. In addition, it should be regulated who confirms the registration.
Talk it through with someone who has done it
Rollouts fail on the same handful of decisions. Thirty minutes on yours costs less than finding out in month three.