Is your visitor book allowed under UK GDPR?

Does UK GDPR apply to a visitor book?

Whether you call it a visitor book or a signing-in book, what it holds is personal data. A visitor’s name, their employer and the time they were in your building are information about an identifiable person. You are responsible for what you do with it, and the rules are about the data, not the medium. The safe approach is to treat a paper book the way you would treat a screen.

We looked for ICO guidance written for visitor books and did not find any on 13 October 2026. What follows applies the ICO’s general guidance, which covers every kind of personal data, to a front desk.

What are the risks of a paper visitor book?

Most of them come straight from the ICO’s principles:

• It shows other people’s details. An open book lets the next visitor read earlier names, employers and sometimes car registrations. The security principle asks for appropriate measures against unauthorised access to personal data, and a page anyone can read is hard to square with it.
• It keeps data too long. Books fill up and move to a drawer, and nobody deletes them. UK GDPR sets no fixed period, so you choose and justify your own.
• It collects more than it needs. Columns tend to multiply: reason for visit, vehicle, phone number. Data minimisation asks you to hold only what you need for the purpose.
• It tells the visitor nothing. People are owed privacy information at the point you collect their details.
• It is hard to search and delete. If someone asks for their entry to be erased, you have to find it across every book and redact it by hand.
• It can be left behind. A book kept at reception is not in your hands at the assembly point.

What lawful basis can you use for a visitor record?

The ICO says you must decide your lawful basis before you start using the information, and document it. A visitor record is usually justified as a legitimate interest: knowing who is on site, for safety and security. That basis asks you to show a purpose, that recording names is necessary for it, and that it does not override the visitor’s rights. Which basis applies is your decision, and you need to write down why.

What should a visitor privacy notice say?

The ICO’s right to be informed asks you to tell people what you collect and why, how long you keep it and who it is shared with. You give it when you collect the details, in concise, plain language. At a front desk, that is a short notice on the sign-in screen or beside the book, with a fuller version one step away.

How much should a visitor book ask for?

Data minimisation means the details are adequate, relevant and limited to what is necessary for your purpose. For most front desks that is a name, a company, a host and the times in and out. Add something else, such as a vehicle registration for a car park or a photo for a badge, only when you can say what it is for. A photo should be optional, and a visitor should be able to skip it.

How long should you keep visitor records?

For as long as the purpose needs, and no longer. The ICO’s advice is to set a retention schedule for each kind of data, justify it and review it. Offline storage is not the same as deletion, and deletion from live systems should reach backups. Write the period down, and delete on a schedule rather than when someone remembers.

What happens when someone asks you to delete their entry?

The ICO’s guidance says the right to erasure is not absolute and applies only in certain circumstances, such as when the details are no longer needed for the reason you collected them. You must reply without undue delay and within one month. With a paper book you find the entry and redact it. With a system you should be able to find a person’s records by name and remove them together.

How do you keep a visitor record secure?

The security principle asks for measures that are appropriate to the risk. The ICO’s guidance on physical security includes supervising visitors and disposing of paper securely. For a paper book that means keeping it out of sight, locking used books away and shredding them when the retention period ends. For a system it means limiting who can see records, encrypting them and keeping a log of changes.

What changes when you move to a digital visitor system?

Some risks go and others arrive. Each visitor sees only their own screen, a privacy notice can sit on that screen, and a retention period can run on its own. But a supplier now holds your visitors’ details for you, so ask where the records are stored and who the supplier’s sub-processors are, and say so in your own privacy information.

ReceptionOS runs on Cloudflare, and your records are stored in Western Europe. We do not offer a UK-only or EU-only residency guarantee. Our security page lists our sub-processors.