---
title: "Visitor management & GDPR"
url: https://doorjames.com/guides/visitor-management-gdpr/
language: en
updated: 2026-09-22
type: guide
section: resources
description: "Which visitor data is genuinely needed, how long it may be retained, what has to be shown at the kiosk and how to configure all of it."
translations: de=https://doorjames.com/de/leitfaeden/besuchermanagement-dsgvo/
formats: https://doorjames.com/guides/visitor-management-gdpr/index.md https://doorjames.com/guides/visitor-management-gdpr/index.json https://doorjames.com/guides/visitor-management-gdpr/index.jsonld
bookDemo: https://meet.doorjames.app/public-schedule/99469a6d66d20f7fdd5ee19182a8f8bd (30 min, Microsoft Teams)
---

# Processing visitor data in line with the GDPR

> Digital visitor management processes personal data of people with no contractual relationship to the organization. Four points matter: data minimization at capture, a visible location-specific privacy notice at check-in, a separate and short retention period for visitor data, and a clear role concept for access to visitor lists.

Visitor data belongs to people who have no contract with you. The processing should be regulated accordingly.

## Key facts

- **Typical data:** name, email, company, times
- **Notice:** location-specific at check-in
- **Retention:** configurable separately from booking data
- **Role:** CGI as processor

## The most common mistake: too many fields

Digital visitor solutions invite form creep – licence plates, ID numbers, health questions, photos. Every additional field increases both risk and justification effort. The sober question is: what do reception and security actually need to do their job?

## What digital does better than paper

From a data protection perspective the paper list at reception is rarely the better option: it lies open, every subsequent guest sees the previous ones, there is no retention period and no access restriction. A digital solution with a role concept, a configured period and logged access is – set up properly – the more privacy-friendly route.

## Note

This guide does not replace legal advice. It describes the technical options and the principles proven in practice; the data protection assessment for your organization sits with you.

## How it works

1. **Collect only what is needed** – For the core purpose, name, email address, company, appointment and check-in/check-out time are usually sufficient. Every additional field in the registration form needs a justification.
2. **Make the notice visible** – The privacy notice is shown and confirmed at check-in – location-specific, because local requirements can differ.
3. **Set a separate period** – Visitor data usually needs shorter retention than booking data. Door James allows separate anonymization and deletion periods per data type.
4. **Limit access** – Visitor lists should be visible only to reception, security and the responsible location roles – not to all administrators.
5. **Document the safety briefing** – Where a briefing is required, its confirmation is captured at check-in and can be exported – replacing loose paper records.
6. **Regulate emergency use** – Record that visitor data is used for the presence list in an emergency, and limit access to that purpose.

## Frequently asked questions

### May we scan or copy ID documents?

That goes far beyond the usual purpose and is legally delicate. Door James does not need it: identification works through the QR code and visit ID from the invitation.

### How long may visitor data be stored?

That depends on the purpose – reception handling, security, evidence obligations. Define a concrete period and configure it; the technical capability exists.

### Who is responsible for visitor data?

Usually your organization as controller. CGI processes as processor under the data processing agreement.

### What applies to ad-hoc visitors?

The same principles: minimal collection, visible notice, defined period. In addition, it should be regulated who confirms the registration.

## Related pages

- [Visitor management](https://doorjames.com/features/visitor-management/)
- [Security & hosting](https://doorjames.com/security/)
- [Banking & insurance](https://doorjames.com/industries/banking-and-insurance/)

---
Door James by CGI · https://doorjames.com · doorjames.support@cgi.com