Three kinds of visitor

One-off visitor (client, candidate, engineer): comes once, to see one person.
Regular supplier (courier, cleaning, maintenance): comes often, at predictable times.
Contractor (another company's staff working on your premises): long-term access, usually tied to health and safety paperwork.

Each needs a different route. The most common mistake is handling them all with "the visitor card" that is never returned.

A workable process

Pre-registration. The host registers the visit with date and time. Reception knows who to expect.
Temporary credential. A QR code sent by email or a card handed over at reception, valid only that day and for the doors needed.
Arrival. Identity is checked, the host is notified and basic information is given (site rules, evacuation).
Stay. Escorted or unescorted depending on the area.
Departure. It is logged and the credential expires. If it is not logged, the system should flag it.

Suppliers and contractors

Named credentials, not generic ones: "cleaner 1" does not tell you who came in.
Permissions limited to their time slot and their areas.
Expiry tied to the end of the contract or of the required documents.
On industrial sites this is coordinated with contractor document control: see access control in industrial units.

What data you may collect

A visitor log is personal data processing under the GDPR. In practice:

Ask for the minimum: name, company, host and time. Avoid photocopying ID documents if checking them is enough.
Inform people at reception (sign or screen) who the controller is, what the data is for and how long it is kept.
Set a short retention period and delete on expiry.

More in data protection in access control.

Common mistakes

A paper visitor book in plain view: every visitor reads the details of those before them.
Generic visitor cards with access to the whole building.
Not knowing, in an evacuation, how many visitors are inside.

If your reception has speed gates or turnstiles, design the visitor process at the same time.

Frequently asked questions

Can we ask visitors for ID?

You can check identity where there is a security reason, but keeping a copy of the document is usually excessive. Apply data minimisation and check with your data protection adviser.

Is a QR code suitable for visitor access?

Yes, it is practical because it is sent before arrival and expires by itself. Since it can be forwarded, limit it to low-risk areas and check identity at reception.

This guide is for information only and is not a substitute for legal advice or for the technical design of each installation. Regulations change: always check the current text at the official source.

Visitor and contractor management in access control: how to organise it

Quick answer