Skip to content

Guide

Visitor log and GDPR: obligations, retention period, template

SmartCraft Building

In short. The GDPR does not require you to keep a visitor log, but it governs the one you do keep, even on paper. Limit the data to what is necessary (identity, company, person visited, times). Inform visitors when the data is collected, enter the processing in your Article 30 record of processing activities and set a retention period. In its example, the CNIL uses three months.

This guide goes through the texts and the CNIL’s recommendations point by point. The CNIL is the French data protection authority: what follows is its reading of the GDPR, with French sources. The GDPR itself applies across the EU, so the guide is useful to any EU site, but the CNIL’s recommendations should not be read as EU-wide rules. This guide does not replace the advice of your data protection officer (DPO) or of a legal adviser, particularly if your business is subject to sector-specific regulation.

Is a visitor log mandatory?

The GDPR creates no general obligation to keep a visitor log. It sets the rules to follow once such a log exists.

The CNIL nevertheless lists this kind of tracking among its recommended security measures. Its guidance sheet “Protecting premises” (in French) advises organisations to “establish rules and means of controlling visitor access” and to have visitors accompanied outside the areas open to the public. For rooms or offices likely to hold sensitive personal data, it also recommends recording the date and time of visitors’ arrival and departure. For many businesses, then, the log follows from their obligation to secure the data they hold, not from a text that would require it as such.

Some regulated sectors may have their own access control requirements. This guide does not list them: check the texts that apply to your business.

Another obligation, however, is general: the record of processing activities under Article 30 of the GDPR (in French). It should not be confused with the visitor log: it is the document in which an organisation describes its data processing, including visitor management. Article 30(5) exempts organisations with fewer than 250 employees, unless the processing “is not occasional”, poses a risk or involves sensitive data. According to the CNIL (in French), this exemption is “in practice” limited to very specific cases, and when in doubt the processing should be recorded. A front desk that registers visitors every day is anything but occasional. The CNIL guidance sheet on access to premises (in French) also states that access control systems must appear in this record.

In its example of a privacy notice for badge access to premises (in French), the CNIL relies on the organisation’s legitimate interest (Article 6(1)(f) of the GDPR (in French)), namely the security of the premises. Its guidance sheet on access to premises (in French) also mentions legal obligation, where a text requires the system.

This legal basis sets a limit. Data collected for security cannot be used for anything else, such as marketing to visitors; otherwise it amounts to “diversion of purpose” (Article 5(1)(b) of the GDPR, as the same guidance sheet points out).

What data can you collect?

The data minimisation principle (Article 5(1)(c) (in French)) requires data to be “adequate, relevant and limited to what is necessary” in relation to the purpose.

In its example (in French), the CNIL keeps four items of data for visitors:

  • surname and first name;
  • company;
  • name of the employee or staff member visited;
  • dates and times of entry and exit.

This is a good starting point. Any additional data (phone number, number plate, photo, detailed reason for the visit) must be justified by a specific, documented need.

ID documents. None of the CNIL guidance consulted for this guide provides for photocopying visitors’ ID documents. In a related case, the CNIL answers that a hotelier cannot make a copy of their guests’ ID document (in French), even though they may ask to see it. To be on the safe side, when you need to check someone’s identity, ask to see the document without copying it, unless a text requires more of you.

How long should the data be kept?

Article 5(1)(e) of the GDPR (in French) requires data to be kept in a form that identifies people “for no longer than is necessary” for the purpose. The text gives no figure: it is up to the controller to set the period and to be able to justify it.

The CNIL does, however, give some benchmarks:

  • Access logs: its guidance sheet on access to premises (in French) states that they must be deleted “3 months after they are recorded”. Identification data, on the other hand, may stay in the active database for “the duration of the data subject’s authorisation”. For a one-off visitor, we infer that the authorisation does not extend beyond the visit, but the guidance sheet does not say so explicitly.
  • Visitor example: in its example of a privacy notice (in French), the CNIL sets the retention period for visitor data at three months from the day of the visit. This is an illustration to adapt, not a regulatory ceiling.
  • Video: if the front desk is filmed, the CNIL states that the retention period for footage “in principle […] does not exceed one month” (in French) and that a few days are generally enough.

For other data (contact details, number plate, etc.), we have not found a CNIL-recommended retention period specific to visitors. Set it in light of the purpose, and record it with its justification in your record of processing activities (Article 30(1)(f) (in French)).

How should visitors be informed?

Article 13 of the GDPR (in French) requires the person to be informed at the time the data is obtained from them. The CNIL asks for information that is “concise, transparent, intelligible and easily accessible” (in French), which the person does not have to go looking for.

The CNIL recommends two layers of information, which it illustrates in its example for badge access (in French):

  1. First layer: a sign displayed near the access control system or at the front desk, with the essentials (identification at the front desk, retention period, recipients, DPO contact) and a pointer to a full notice.
  2. Second layer: a full notice handed over with the badge. The CNIL specifies that it can also be sent by email in advance, when instructions are sent to the visitor before they arrive.

The invitation sent before an appointment is therefore a good moment to inform visitors.

What should the privacy notice contain?

Based on Article 13 and the CNIL guidance sheet on informing individuals (in French), the full notice states:

  • the identity and contact details of the controller (your company, or the building manager if it runs the front desk);
  • the contact details of the DPO, or failing that of a point of contact;
  • the purpose (security of premises and people) and the legal basis;
  • the legitimate interest pursued, where that is the basis relied on;
  • whether each item of data is mandatory or optional, and the consequences of refusing (for example, no badge);
  • the recipients: authorised security staff, any service providers;
  • the retention period, or the criteria used to determine it;
  • individuals’ rights: access, rectification, erasure, restriction, objection;
  • the right to lodge a complaint with the CNIL;
  • where applicable, transfers outside the European Union and their safeguards.

Is a paper visitor book compliant?

Paper is not exempt from the GDPR. Article 2(1) (in French) covers the non-automated processing of data “which form part of a filing system or are intended to form part of a filing system”. Article 4 defines a filing system as “any structured set of personal data which are accessible according to specific criteria”. A book organised by date falls within this definition.

Paper can therefore be compliant, but it raises two practical difficulties.

  • Confidentiality. A book left open on the counter shows every visitor the names, companies and times of previous visitors. This runs counter to Article 5(1)(f) (in French), which calls for “appropriate security”, and to the CNIL’s recommendation not to leave data that should remain confidential visible (in French) in reception areas. A few solutions: have the receptionist fill in the log, use individual slips, or cover the lines already filled in.
  • Purging. Deleting entries older than three months from a bound book means cutting out or destroying pages on a schedule kept by hand. In practice, books are often kept well beyond the stated period.

Visitor log template

In this table, “necessary” means data essential to the security purpose, in the sense of the mandatory nature of data under Article 13. Periods are given only where a CNIL source mentions them. Otherwise, they remain “to be defined” by the controller.

Data Mandatory / optional Justification Indicative period
Surname, first name Necessary Know who is on the premises (CNIL example) 3 months from the visit (CNIL example (in French))
Company Necessary Identify where the visit comes from (CNIL example) 3 months from the visit (CNIL example)
Person visited Necessary Know who receives and accompanies the visitor (CNIL example) 3 months from the visit (CNIL example)
Date, time of arrival and departure Necessary Traceability of access (CNIL, protecting premises (in French)) 3 months after recording (CNIL guidance on access to premises (in French))
Badge number issued Necessary if a badge is issued Link a badge to its holder, get the badge back 3 months for access logs (CNIL guidance)
Email or phone number Optional Send the invitation and the notice, give notice of a delay To be defined
Number plate Optional Car park access, if needed To be defined
Reason for the visit Optional Useful only if a reason determines access to an area To be defined
Photo Optional, must be justified Rarely necessary for a one-off visit To be defined
Copy of ID document Avoid Seeing the document without copying it is preferable (see above) Do not keep, unless a text requires it

Compliance checklist

  • The purpose of the log is written down (security of the premises) and it is not used for anything else.
  • The data collected is limited to the items in the table deemed necessary.
  • A retention period is set, justified and actually applied.
  • A first-layer sign is displayed at the front desk, and a full notice is available or sent with the invitation.
  • Previous entries are not visible to other visitors.
  • Access to the log is restricted to authorised people.
  • The “visitor management” processing appears in the record of processing activities.
  • A procedure is in place to respond to access or erasure requests.

What front desk software can automate

Front desk software does not make processing compliant on its own: the purpose, the retention period and the information given remain the controller’s choices. What it can do is apply those choices without relying on anyone’s memory:

  • Automatic purge: visitor records are deleted or anonymised when the set period expires, with no schedule kept by hand.
  • Pseudonymisation: for footfall statistics, the visitor’s name is replaced with an identifier. On the front desk screen, previous entries are not displayed, and the history can only be viewed by authorised people.
  • Audit trail: every view, change or export of the log is recorded. This helps demonstrate compliance, as required by Article 5(2) (in French).
  • Information with the invitation: the full notice is attached to the email sent before the visit, as the CNIL’s example allows.

This is the approach taken for the visitor module of SmartCraft Building, currently in development.

Sources

Pages consulted on 2026-10-23. Quotations from French sources are our translation.

See SmartCraft Building at your front desk