Visitor book

What are visitor books?

Visitor books, visitor lists or visitor logs are generally used at company receptions to keep track of visitors. The following are usually recorded

• Name of the visitor
• Company of the visitor
• Visitor's address
• Person visiting the company or reason for visit
• Time of arrival
• Time of departure from the company

In some cases, further information is also collected, such as specific contact details.

Why are visitor lists kept?

Companies should ask themselves this question - if there is no good reason for the administrative effort, you can do without visitor books.

In many cases, however, there are good reasons for visitor documentation:

• If security breaches are detected, the number of suspects can be narrowed down retrospectively.
• In the event of an emergency - such as a fire - visitor lists can help to create a complete evacuation list.

When handling sensitive data - e.g. in commissioned data processing - companies are sometimes even legally or contractually obliged to keep a visitor log.

Visitor books and data protection/DSGVO

Visitor logs are relevant to data protection for two main reasons: On the one hand, visitor books and visitor lists are part of a company's access controls. They therefore serve to protect the (personal) data available in the company and make it easier to investigate data protection violations afterwards. For example, many contracts for order data management stipulate the keeping of visitor logs as a security measure. Ultimately, visitor logs are also a prerequisite for access controls.

On the other hand, visitor lists, visitor books and visitor forms themselves record personal data that must be protected. This means in particular:

• Companies should not keep visitor lists or visitor books openly displayed at reception, as this would allow new visitors to view the personal data of previous visitors.
• Publicly accessible solutions should also not be used for internal purposes, such as announcing visitors in advance. For example, an Excel list stored openly on an internal server would allow all employees to view the visitors of other employees.
• The personal data collected in a visitor book may only be stored for as long as is necessary for its purpose. The permissible storage period depends on the situation, with many options ranging from deletion on the same evening to storage for 6 months.

The data collected must also be deleted in compliance with the GDPR:
Paper visitor lists and visitor books must be made unrecognisable in the document shredder. In the case of electronic data, it is not enough to delete it; it must also be overwritten so that it cannot be restored.