Which outsiders get in, where they may go, who is with them and when they leave: visitor access control is a process first (host, sign-in, visitor pass, escort, sign-out), and a matter of card readers or turnstiles only where a zone justifies it. Here is how to keep it proportionate and easy to demonstrate, and where a register like IRIGuest, which opens no doors, fits in.
In short
Visitor access control is the set of decisions and checks by which a company establishes who comes in from outside, who authorised them and answers for them, where and when they may go, and that they have left. It is a process before a technology: doors and turnstiles are one possible tool, not the definition.
For most SMEs, five things are enough: a named host, a sign-in record with entry and exit times, a visible numbered visitor pass, an escort beyond public areas and clearly marked zones. Hardware comes in only where a zone justifies it. A register such as IRIGuest covers the “who, for whom, when, still on site?” part. It opens no doors and drives no turnstiles.
Most companies discover a visitor access problem through a small incident: a door held open for someone carrying boxes, a supplier waved through because “he knows the way”, a visitor found alone in the warehouse. Or through an auditor, a customer or a NIS2 questionnaire asking: “How do you control visitors?”
In the UK and Irish security trade, “access control” on its own means hardware (fobs, card readers, maglocks, turnstiles), mostly for employees. This guide is about people without a credential: visitors, suppliers, couriers, drivers, candidates and auditors. It uses the term in the wider sense of visitor access management: decisions first, devices only where needed.
We follow the chain from invitation to exit, then show how to control visitor access through zones, identification, passes and emergency planning, how much control each organisation needs, and what GDPR, NIS2, ISO/IEC 27001 and safety law actually require across the EU, Ireland included, and in the UK. Legal position checked as at October 2026.
Visitor access control answers four questions. Who is this person? Who authorised the visit and answers for them? Where may they go, and until when? And, most often forgotten: are they still on site? Answer all four for every visitor and you have visitor access control, whatever equipment you own.
Two tools often get confused. Visitor management (sign-in record, host, pass, escort, rules) knows who came, for whom, why, what they were told and when they left. A physical access control system (credential, reader, electronic lock) knows that a card opened a door at a given time, not who holds a borrowed card or whether they left by a fire door. A sign-in record physically stops nobody.
| Aspect | Visitor management | Access control system |
|---|---|---|
| Tells you | Who, for whom, why, until when; who is still on site | Which credential opened which door, and when |
| Mainly concerns | Visitors, suppliers, couriers, drivers, auditors | Employees and other long-term credential holders |
| Typical tools | Register, host, visitor pass, escort, site rules | Cards or fobs, readers, electronic locks, turnstiles |
| What it doesn’t do | Open, lock or block any door | Know the purpose, the host, or who left without badging out |
In practice, access control for visitors means they are always signed in, and get a door credential only if they must pass controlled doors on their own. Employees are handled with other tools, as our guide to the visitor log versus employee attendance explains.
To control visitor access in practice, split the visit into checkpoints. Each is a decision with an owner, and each fails in a predictable way.
The host announces the visit on an expected-visitors list or calendar that reception can see. Walk-ins wait in reception while the host is called. Typical failure: an unannounced visitor treated as expected, with reception improvising.
No host, no entry beyond reception. A named employee (the host, or “sponsor” in UK guidance) confirms the visit and answers for the visitor until they leave, with a named deputy for absences. Typical failure: “He knows the way, just send him up.”
Name and company are checked against the expected list. ID is asked for only where the risk justifies it (restricted zones, out-of-hours entry), then looked at, not copied. Typical failure: a confident manner and a familiar company name taken as proof of identity.
Name, company, host, time in: the same few fields for everyone in a category, with the privacy notice at the entrance and earlier entries out of sight. Typical failure: a twelve-field form filled with nonsense, or a visitor book left open on the desk.
A visible, numbered, dated pass marked VISITOR, with its number in the sign-in record, so colleagues spot a guest at a glance. Typical failure: a box of identical, unnumbered passes, so nobody knows how many are out or who has one.
Exits, assembly point, what the alarm sounds like, no-go areas, the photo and phone rule and any PPE: shown before the visitor goes further, and acknowledged. Typical failure: four pages of small print in one language, with no record that anything was shown.
The zone map says where a visitor may go alone and where only with an escort, and the escort also covers toilets, canteen and the way out. Typical failure: the visitor who goes looking for the toilets and turns up in the warehouse.
The host walks the visitor out, the visit is signed out and the pass goes back by number. Open visits are checked at closing time. Typical failure: no exit times, so the on-site list is wrong just when it matters.
Checkpoints only work if they are written down and known to everyone who covers reception. Turning them into a short document with roles and exceptions is the subject of our guide to writing a visitor management policy.
A zone exists only if it has a visible boundary (door, gate, floor marking, sign), a rule (alone or escorted) and something that enforces it: a lock, a reader, a colleague who asks. Draw the zones on one A4 site plan, with matching colours on the visitor passes.
OutsideCar park, yard, gate, lorry park
One signposted visitor entrance; other doors closed from outside, always openable from inside. Drivers follow a marked route.
ReceptionEntrance, lobby, waiting area
Sign-in, host called, pass issued. Visitors may wait here alone, so no documents or unlocked screens in view.
Offices, meeting roomsDesks, corridors, canteen
Pass worn visibly, escorted to and from; meeting rooms near the entrance, clear desks, screens locked.
Production, warehouseShop floor, stores, dispatch, loading dock
Briefing and PPE first, always escorted, drivers kept to the dock, photo rule enforced, area visited recorded.
Restricted areasServer room, R&D lab, archive, cash office
Always locked, named staff only. Visitors only with the area owner’s approval, escorted, entry traced.
Each visitor category needs its own path: write a category-by-zone matrix and make the pass reflect it. Two principles keep it honest: familiarity is not authorisation (the weekly supplier still signs in), and emergency services are never delayed (reception records them afterwards). Inspectors with legal powers of entry are escorted, never obstructed: check their official ID and alert the designated manager at once; for them, “by approval” simply means the area owner goes along.
| Visitor | Reception | Offices | Production and warehouse | Restricted areas |
|---|---|---|---|---|
| Guest or customer | Free | Escorted | Escorted | By approval |
| Supplier or sales rep | Free | Escorted | Escorted | No |
| Courier | Free | No | No | No |
| Lorry driver | Free | No | Escorted | No |
| Job candidate | Free | Escorted | No | No |
| Auditor or inspector | Escorted | Escorted | Escorted | By approval |
For lorry drivers, “escorted” in the production column means the dock and drivers’ area only, under the eye of warehouse staff; couriers hand over goods at reception or at the edge of the dock, never inside the warehouse. Contractors work rather than visit, often for days in zones 4 and 5, with safety coordination agreed in advance (see our guide to contractor and supplier site access). In shared buildings, each tenant keeps its own sign-in record and hosts, even if the landlord runs the turnstiles.
For most visits, visitor identification needs only four things: name, company, host and purpose, plus a vehicle registration only if you manage the yard. ID is justified only where the risk is real (restricted zones, out-of-hours entry, high-value sites), and even then you look at the document and note “ID checked”, without copying or photographing it.
The GDPR, and in the UK the UK GDPR with the Data Protection Act 2018, let you collect only what the purpose needs. A drawer of passport copies is a liability with no security benefit: nobody checks them against anything. The real weak point is the unannounced technician: call their company on a number from your own records, never the one on their paperwork.
Lists of unwelcome people (“watchlists”) need a clear legal basis, accurate entries and short retention and, if they include criminal offence data, must also meet art. 10 GDPR. IRIGuest has no such feature. And a business card proves nothing about identity: anyone can print one.
Tell visitors at the entrance what you collect and why: a short notice at sign-in, the full text at reception. The usual legal basis is legitimate interests, not consent, which is not freely given when signing in is a condition of entry. Fields, notice and lawful basis are covered in our guide to the GDPR visitor log.
A visitor pass makes the visitor recognisable at a glance; it controls something only if somebody looks at it or a reader checks it.
| Credential | Strengths | Limits | When to use it |
|---|---|---|---|
| Sticker or paper day pass | Cheap, nothing to return, dated | Easy to copy or reuse if nobody checks the date; peels off workwear | Low-risk offices, events, many short visits |
| Numbered pass on a lanyard | Visible, cheap, easy to count back; a colour can show zones | Anonymous unless the number is recorded with the visit | The default for most SMEs |
| Pass with a QR code | Carries the pass number in scannable form; no personal data in the code | Means nothing unless a reader or a person checks it | Sites that already scan codes |
| Temporary proximity card | Opens only its own doors, within a time window; logged | Needs an access control system; unreturned, it stays a live key | Visitors who must pass controlled doors |
| QR code or pass on the phone | Nothing to hand out; quick arrival | Invisible in a corridor; depends on the battery | Arrival only, plus a visible pass on site |
| No pass, escort only | No administration | Looks like staff; fails when the host is called away | Micro offices, one short visit at a time |
Count passes back daily: through its number, a missing pass leads back to the visit it was issued for. Void the number of any pass reported lost. Formats and printing are in our visitor badge guide, and numbered QR passes come from our free badge generator. With the Cloud version of IRIGuest, the tablet reads the pass QR code at check-in and check-out.
Test every measure: what does it stop, who checks it, and what happens when it fails? Controls nobody checks, such as passes nobody looks at, are security theatre. These six risks cover most real incidents.
Usually courtesy: a door held for someone carrying boxes. Countermeasures: one visitor entrance, working door closers, side doors never used by visitors, and permission to say “sorry, everyone swipes in here” at any door that needs a credential.
A hi-vis vest and a clipboard open a surprising number of doors. Countermeasures: a named host confirms every visit, unannounced technicians are verified by calling their company on a number from your own records, and couriers stop at reception or the dock.
The host is called away and the visitor wanders off. Countermeasures: the host collects the visitor and walks them out, and a challenge culture where asking “Can I help you find someone?” is normal and never blamed.
Set a photo rule per zone, cover prototypes before a tour and reserve NDAs for sensitive visits. Under the EU Trade Secrets Directive (2016/943, art. 2(1)(c)), information is protected only if reasonable steps were taken to keep it secret.
A live network port in a meeting room is a way into your network. Lock screens automatically, offer guest Wi-Fi, disable network ports in public areas (as France’s ANSSI advises, measure 26) and keep visitors’ USB sticks out of company PCs.
With the number in the sign-in record and an end-of-day count, a missing pass leads back to its visit. Void a lost visual pass; a door card must be deactivated in the access control system itself, which a register like IRIGuest cannot do.
Found someone without a pass where they shouldn’t be? Approach politely, ask whom they are visiting and walk them to reception to check the sign-in record. If they are evasive, don’t confront them: alert whoever is in charge, then find out how they got in. At entrances that are not always staffed, a self-service reception records who signs in, but someone must still know they have arrived.
Visitors are not on any staff list and don’t know the exits, yet in an evacuation the fire and rescue service needs to know whether anyone is missing. The visits still open (signed in, not yet signed out) give you that list: with the free version of IRIGuest it is on the tablet; with the Cloud version it can also be opened from another device.
The list is only as good as sign-out discipline: sign-out where the pass is returned, hosts who walk visitors to the exit, a closing-time review of open visits (call the host before closing any by hand) and one register for all entrances. Name who takes the list out, plus a deputy, as reception may be evacuating too. With the free version, taking the list out means carrying the tablet itself, kept charged. Keep any “need help to evacuate?” question optional, with no health details. If the tablet or the network fails, use individual paper slips in a locked box, never a shared sheet.
The law asks for the outcome, not the tool. Directive 89/391/EEC (art. 8(1)) requires evacuation arrangements that take account of other people present. In Great Britain, the Health and Safety at Work Act 1974 (s. 3) covers non-employees, as section 12 of the Safety, Health and Welfare at Work Act 2005 does in Ireland. In England and Wales, the Fire Safety Order 2005 protects everyone lawfully on the premises and requires emergency procedures (art. 15), and Home Office guidance recommends a roll call at the assembly point.
With drivers at the dock, maintenance crews and several gates, keeping one reliable list is harder: see our guide to factory visitor management.
Begin with what could actually go wrong, not with the technology on sale. UK counter-terrorism policing guidance says measures should be justified, necessary and proportionate to the threat.
| Type of organisation | Main risk | What is enough | When to add technology |
|---|---|---|---|
| Office or practice, one entrance | Confidential files and conversations | Door kept locked, with a bell or intercom, sign-in record, escort always, clear desk | Rarely; at most a lock on the archive |
| SME plant or warehouse, one gate | Shop-floor safety, evacuation headcount, theft, know-how | Lorry route, briefing at sign-in, numbered passes, escorts, drivers kept to the dock | An electronic lock on the server room or R&D area, before any turnstile |
| Several sites or entrances | Different habits at each site; no single view of who is in | One procedure and set of fields, one central register, host notification | Temporary cards where door access control already exists |
| Sensitive areas, ISO 27001 or NIS2 | Unauthorised access to systems and information | Formal zones, ID checked for restricted areas, owner approval, escort always | Where the risk assessment calls for it: electronic access control and logging on restricted zones (neither prescribes it) |
| School or public body | Safeguarding; public counter versus back office | Every visiting adult signed in, wearing a pass, escorted near pupils | Rarely: locks on offices and plant rooms |
A turnstile project means hardware, installation, software, cards, maintenance and a fire safety review of every exit it touches. A good process costs mostly time. A realistic first 30 days: zone map, categories, host rule, numbered passes, end-of-day review of open visits, a drill test. For the register side, see how much visitor management software costs.
Visitor records fall under the GDPR in the EU and the UK GDPR in the UK. The usual basis is legitimate interests (art. 6(1)(f)), backed by a documented legitimate interests assessment. Public authorities rely on their public task instead (art. 6(1)(e)). Collect only what you need (art. 5(1)(c)), inform people at sign-in (art. 13) and set retention per purpose (art. 5(1)(e)). The register also belongs in your record of processing (art. 30), since the under-250 exemption does not cover regular processing. Only named roles should see history and exports, including the free version’s CSV files.
CCTV at the entrance is a separate processing operation, with its own notice and retention, and cannot show who is still inside. Signs go before the monitored area (EDPB Guidelines 3/2019). The EDPB expects footage to be erased within a few days, with over 72 hours needing justification. Ireland’s Data Protection Commission finds over a month hard to justify, and the ICO sets no fixed period. Never film the sign-in tablet. If staff are filmed too, tell them and, as good practice, consult them; employee representatives may also have legal rights here, depending on the country.
Fingerprint and facial data used to identify people are special category data (art. 9 GDPR), prohibited unless an exception applies, and the EDPB expects a non-biometric alternative anyway: you would run two systems to do what a pass and an escort already do. Regulators push back even for staff: in 2024 the ICO ordered Serco Leisure to stop using facial recognition and fingerprints for attendance. The on-screen signature in IRIGuest is stored as an image, an acknowledgement, not a biometric signature.
Retention periods, and making sure records really are deleted, are covered in our guide on how long to keep visitor logs. With the Cloud version of IRIGuest, visitor records are deleted automatically once the retention period you set runs out.
EU law is technology-neutral: it asks for appropriate, proportionate, demonstrable measures, never a specific turnstile or app, and imposes no general duty to keep a visitor register. Physical access controls are spelt out only in narrower regimes, such as Implementing Regulation 2024/2690 for certain digital providers and the CER Directive for designated critical entities.
| Rule | What it asks about physical access | Who it applies to |
|---|---|---|
| GDPR / UK GDPR | No tool; visitor data minimised, explained, time-limited and secured | Every organisation that records visitors |
| NIS2, art. 21 | Proportionate measures, all-hazards approach covering the physical environment of IT systems, access control policies | Mainly medium and large entities in Annex I and II sectors (EU) |
| Reg. (EU) 2024/2690 | Points 11.2.2(d) and 13.3: perimeters, entry controls, monitoring, testing; visitor access limited in scope and time | Only DNS, TLD, cloud, data-centre, CDN and managed (security) service providers, marketplaces, search engines, social networks, trust services |
| ISO/IEC 27001:2022 | Annex A 7.1–7.4: perimeters, physical entry (7.2), secure offices, monitoring; chosen via risk treatment and the Statement of Applicability, no technology prescribed | Organisations certified or seeking certification |
| UK NIS Regulations 2018 | Reg. 10: proportionate measures; the Cyber Security and Resilience Bill would extend the regime | Designated operators of essential services |
| Health and safety and fire law | Evacuation arrangements that take account of everyone present (Directive 89/391/EEC, art. 8(1); in England and Wales, Fire Safety Order 2005, art. 15) and a general duty to non-employees (HSWA 1974, s. 3; in Ireland, SHWW Act 2005, s. 12); no register prescribed | Every employer (under the Fire Safety Order, the responsible person for the premises) |
Situation as at October 2026. NIS2 covers medium-sized and large entities in Annex I and II sectors, including makers of computers and electronics, electrical equipment, machinery and vehicles (NACE C26–C30), medical devices, chemicals and food. Micro and small firms are generally out. Germany and Italy, among others, have transposed it. Ireland has not, and was referred to the Court of Justice on 8 July 2026 with Spain, France and the Netherlands. NIS2 does not apply in the UK, where the Cyber Security and Resilience Bill is still a Bill. NIS2 names no turnstile and no visitor register.
A register helps document your process and supports the evidence an auditor asks for, but it does not make a company “compliant”, and this page is not legal advice. Whether a visitor log is required by law is covered in a separate guide.
In the first 30 days, aim for these ten points. None needs new hardware, and all can be shown to an auditor.
Want to see sign-in and sign-out from the visitor’s side first? Try the sign-in online, with nothing to install.
IRIGuest covers the register side on an iPad or Android tablet: check-in and check-out, five languages chosen by the visitor, an on-screen signature, and customisable consents and questions (pass number, area visited, site rules, a no-photo acknowledgement). Open visits are your list of visitors still on site. The free version works offline only, with no time limit: each tablet is an independent register, exportable to CSV. The Cloud version works online only and replaces per-tablet CSV files with one central history and reports across tablets, entrances and sites. It adds host notification at check-in, QR-code pre-registration, the on-site list from another device, and business-card capture with AI that reads the card, not the visitor’s face or ID.
IRIGuest Cloud links every tablet and entrance to one history, reads the pass QR code at check-in and check-out, and shows which visitors are still on site from another device. From €50/month + VAT, or €540/year + VAT with the annual plan.
What it does not do: on its own, IRIGuest does not open or operate doors, turnstiles, barriers or gates (on a project basis, the Cloud version can be integrated via API with an existing access control system). Nor does it verify ID, photograph visitors, use biometrics or print passes from the tablet (passes come from the free badge generator). It works alongside your door system, not instead of it, and helps document who came, for whom and when they left, without making anyone “compliant”. For day-to-day use at the front desk, see our reception check-in app.
Official texts and guidance behind this page. Legal position checked as at October 2026; transposition and national rules can change. For information only, not legal advice.
It is the set of decisions and checks that establish who comes in from outside, who authorised them and answers for them, where and when they may go, and whether they have left. It is mainly a process (host, sign-in, visitor pass, escort, sign-out), with or without card readers or turnstiles.
Visitor management records who came, for whom, why, what they were told and when they left. An access control system decides which credentials open which doors. Most SMEs need the first at every entrance, on paper or with visitor management software, and the second on a few doors at most.
Usually not. The GDPR and the UK GDPR allow only the data the purpose needs, and a copy adds risk without adding security. Where an ID check is justified, look at the document, compare it with the person and note that the check was done. Keep a copy only if a law requires one.
Not everywhere. Visitors can usually wait alone in reception and, if your zone map allows it, use a meeting room by the entrance. Offices, production and the warehouse call for an escort; restricted areas such as server rooms also need the area owner’s approval. Write the rule down for each zone.
Rarely. For an SME with one entrance, a named host, a sign-in record with entry and exit times, numbered passes, an escort rule and locked restricted rooms give real, demonstrable control. Electronic access control suits rooms holding sensitive systems, unwatched entrances or out-of-hours work: start with one lock on the room that matters.
Not in so many words. For entities in scope, NIS2 asks for proportionate measures that also protect the physical environment of their IT systems, so physical access to those systems belongs in their risk analysis, but it names no turnstile or visitor register. Smaller firms are reached indirectly, through customers’ supply-chain requirements. NIS2 does not apply in the UK; Ireland had not transposed it as at October 2026.
It is almost never proportionate. Biometric data used to identify people is special category data (art. 9 GDPR), prohibited unless an exception applies, and the EDPB expects a non-biometric alternative anyway. For occasional visitors, a pass, a host and an escort do the job. IRIGuest uses no biometrics: its on-screen signature is stored as an image.
Yes, where necessary and proportionate: a sign before the monitored area, the full notice at reception, no camera pointed at the sign-in tablet and a short retention period. The EDPB suggests a few days, with reasons needed beyond 72 hours; Ireland’s Data Protection Commission finds more than a month hard to justify; the ICO sets no fixed UK period. CCTV complements the register; it cannot say who is still inside.
The number in the sign-in record shows which visit it belonged to, so the host can follow it up. Once the host confirms the visitor has left, close the visit, note the missing pass and void its number; a door card must be deactivated in the access control system at once. If passes often go missing, move the return point to the exit.
The host, never reception alone. Reception asks for the visitor’s name, company and the person they want to see, then calls that person. If they are unavailable, a named deputy decides or the visitor waits. For an unannounced technician, call their company on a number from your own records. Emergency services are never kept waiting.
Try a sign-in online in two minutes, or ask for a demo to see how the register and the on-site list fit your entrances.
