# Is a Paper Visitor Log Compliant with Data Protection Law? Risks, Record Rules and Digital Visitor Management

> A paper visitor book exposes past visitors, keeps data forever and skips the privacy notice. Learn what to record, for how long and how to protect it.

Source: https://digitalbridge.com.tr/en/blog/paper-visitor-log-kvkk.html
Publisher: Digital Bridge Teknoloji (https://digitalbridge.com.tr)
Topic: Access Control & Attendance
Published: 2026-10-23 · Updated: 2026-10-23

A paper visitor log is not unlawful in itself, but the way most organisations use one creates a data protection risk: open pages expose earlier visitors, too much data is collected, no privacy notice is given and old books are kept for years. Compliance means minimal data, a notice, restricted access and timely deletion.

## Key takeaways

- A visitor's name, company and the person they are visiting are personal data; the organisation keeping the log is the data controller.
- A paper log has three weak points: a page anyone can read, unnecessary data and an undefined retention period.
- Asking visitors for a national ID number is rarely proportionate at an office or factory entrance; define the purpose first.
- Tie the retention period to a written policy and delete or anonymise records once it expires.
- Digital visitor management automates these steps with pre-registration, time-limited temporary cards and automatic deletion.

## Why is a visitor log a data protection issue?

Türkiye's Personal Data Protection Law No. 6698 (KVKK) treats any information relating to an identified or identifiable person as personal data. The name, company, arrival and departure times and host recorded in a visitor book all fall within that definition, and the company keeping the record is the data controller under [KVKK](https://digitalbridge.com.tr/en/glossary.html#kvkk). The general principles in Article 4 (processing that is relevant, limited and proportionate, and kept only as long as necessary) apply even to a small book on the reception desk.

Article 10 of the Law sets out the duty to inform, and Article 12 requires technical and administrative measures to prevent unlawful access to the data ([Law No. 6698, mevzuat.gov.tr](https://www.mevzuat.gov.tr/mevzuatmetin/1.5.6698.pdf)). A log left open at reception conflicts most directly with these two articles. We explain the difference between a privacy notice and explicit consent in our guide to [KVKK explicit consent and privacy notices](https://digitalbridge.com.tr/en/blog/kvkk-explicit-consent-vs-privacy-notice.html).

## How much risk does a paper log create?

According to the Turkish Data Protection Authority's 2025 Annual Report, it received 12,512 complaints and notices in 2025, of which 6,506 concerned unlawful processing of personal data ([KVKK 2025 Annual Report](https://www.kvkk.gov.tr/SharedFolderServer/CMSFiles/MTY5ZjMxYTVlZGY0Y2Y.pdf)). The same report shows 328 data breach notifications that year. The report does not break complaints down by process, but "unlawful processing" also covers everyday failings such as excess data and indefinite retention in a visitor log.

The practical cost of a paper log shows up in three places. First, visibility: a competitor's sales representative can learn which suppliers you are meeting simply by glancing at the page. Second, permanence: full books are rarely thrown away, so a visitor from five years ago is still on file. Third, poor oversight: in an evacuation, "how many visitors are in the building right now?" cannot be answered quickly from a book.

## What should a visitor record contain, and what should it leave out?

Proportionality depends on the purpose of the record. If the purpose is "knowing who is on site and linking each visit to a member of staff", then name, company, host and arrival and departure times are enough for most organisations. A national ID number, date of birth or a copy of an identity document should only be considered where a separate legal requirement exists and is documented.

| Data item | For most offices and factories | Note |
|---|---|---|
| Full name | Needed | To identify the visitor |
| Company | Usually needed | Can be left optional |
| Host | Needed | Links responsibility to an employee |
| Arrival and departure time | Needed | For evacuation and security |
| Purpose of visit | Useful | Keep it short and general |
| National ID number | Usually unnecessary | Only with a written justification |
| Copy of ID document | Avoid | Excess data and retention risk |
| Phone number | Usually unnecessary | Contact goes through the host |

Sites with special security needs, such as data centres or pharmaceutical plants, may follow different rules. Record your decision under a "visitors" category in your [personal data inventory](https://digitalbridge.com.tr/en/blog/kvkk-personal-data-inventory.html). If you also run CCTV, footage has its own rules, covered in our guide to [CCTV recording and KVKK](https://digitalbridge.com.tr/en/blog/cctv-recording-kvkk.html).

## Seven steps to bring a paper log into line

If you cannot give up paper straight away, these steps reduce the risk:

1. **Write down the purpose.** State in one sentence why the record is kept (building security, evacuation, linking the visit to a host).
2. **Cut the columns.** Limit the book to the items marked as needed in the table and drop the ID number column.
3. **Give a privacy notice.** Display a short notice at reception or hand one to the visitor, covering purpose, legal basis, retention period and how to make a request.
4. **Hide earlier entries.** Use a single-line slip or separate card for the visitor, have staff transcribe it and keep previous rows out of sight.
5. **Restrict access.** Lock the book away outside working hours and document who may open it.
6. **Set a retention period.** Put it in your data retention and destruction policy and destroy expired pages with a written record.
7. **Be ready for requests.** If a visitor asks what you hold about them, you must be able to find it; see our guide to [handling KVKK data subject requests](https://digitalbridge.com.tr/en/blog/kvkk-data-subject-request-handling.html).

Steps 4 and 6 are usually the weakest links. On paper, hiding earlier rows and weeding out expired records are manual tasks, and at a busy reception that discipline tends to slip within weeks.

## Paper log or digital visitor management?

Digital visitor management keeps visit details in software and ties entry to the access control system. A visitor can then enter only the permitted areas, and only for the permitted time. Our guide to [card access control systems](https://digitalbridge.com.tr/en/blog/card-access-control-system-guide.html) explains the underlying logic.

| Criterion | Paper log | Digital visitor management |
|---|---|---|
| Earlier visitors visible | Yes, if the page is open | Only to authorised users |
| Retention period applied | Manual weeding | Automatic deletion on expiry |
| Visitors on site | Count the page | Live on the dashboard |
| When the visit ends | Not checked | Temporary card stops working |
| Host notified | By phone | Automatic email |
| Evidence for an audit | A page in a book | A reportable record |

Software does not deliver compliance on its own, but it removes the daily effort of applying a written rule by hand. If you are considering codes on a phone screen instead of cards, our guide to [QR code visitor access](https://digitalbridge.com.tr/en/blog/qr-code-visitor-access.html) covers a different approach.

## How does SmartPass make visitor registration easier?

[SmartPass](https://digitalbridge.com.tr/en/smartpass.html) is Digital Bridge's software from the Smart360 family that brings card access control, staff time and attendance, visitor management and canteen management together in one panel. A visitor's card passes through the same decision engine as staff cards.

Take a concrete scenario: a supplier's auditor is due at a manufacturing plant in the morning. The purchasing specialist pre-registers the visit with first name, surname, company, host, end time and purpose.

When the auditor arrives, reception issues a temporary card and the host receives an email. The card's rights are limited to the visit's permission group and duration; once that time is up, the card is refused at every point and a warning appears in the panel. The card is handed back on the way out.

The details that matter for data protection:

- **No ID number is taken.** SmartPass does not ask visitors for an identity number.
- **Retention is your choice.** The organisation sets how long access records are kept, between 30 days and the upper limit of its package; when the period ends, the visitor's name and purpose are deleted automatically, while counts and reports remain.
- **Access follows roles.** There are 43 separate panel permissions; a receptionist can be given visitor reception rights only, and the person list and audit log reports need separate permission.
- **Card numbers are not stored.** The card number is turned into a one-way hash on the device, and reports show only the last four digits.
- **Changes leave a trail.** Every change is kept in the audit log with its previous and new values.

The dashboard's "inside now" view shows staff, contractors and visitors separately, which is far quicker to read during an evacuation than a paper page. A visitor's meal is charged to the host's department, and the visitor report can be exported to Excel, PDF or CSV. Doors keep deciding from a signed permission list on the device even when the internet drops, as explained in our guide to [access control offline mode](https://digitalbridge.com.tr/en/blog/access-control-offline-mode.html). You can explore the visitor flow and other features on the [SmartPass product page](https://digitalbridge.com.tr/en/smartpass.html).

## How can Digital Bridge help?

Fixing visitor registration is both a legal and a technical job. Through our [data protection compliance consultancy](https://digitalbridge.com.tr/en/consultancy/data-protection-compliance.html), Digital Bridge helps define the purpose, privacy notice and retention period for visitor data. On the technical side, a SmartPass project starts with a site survey covering access points, existing turnstiles and readers, card types and the person list.

The SmartPass fixed terminal is brand-independent and works with OSDP readers and dry-contact relays, so turnstiles, doors and barriers with a relay input can usually be reused. We describe the hardware side on our [card access control](https://digitalbridge.com.tr/en/industrial-products/card-access-control.html) page. After go-live, the first month-end close is carried out together.

## Next step: where should you start?

Start by comparing your visitor book with the table above and removing unnecessary columns; it costs nothing. Then plan the move to digital visitor management around your visitor numbers, entry points and retention needs. For the wider picture, browse our articles on [access control and attendance](https://digitalbridge.com.tr/en/blog/topic/gecis-kontrol.html).

SmartPass is priced by quotation, based on the number of access points, the number of people and the hardware required. To buy, fill in the [SmartPass sales form](https://smart360.com.tr/teklif-iste?urun=smartpass); the quotation is sent on the same business day. If you would like to learn more first, visit the [SmartPass page](https://digitalbridge.com.tr/en/smartpass.html) or [contact us](https://digitalbridge.com.tr/en/contact.html) with your questions.

## Frequently Asked Questions

### Is it illegal to use a paper visitor book?

No, a paper book is not prohibited in itself. The problem is how it is used. Collecting more data than needed, letting every visitor read earlier names, giving no privacy notice and keeping books indefinitely can all conflict with the proportionality, transparency and security duties under data protection law. Once those points are fixed, a paper book can still be used.

### Can we ask visitors for their national ID number?

At most office and factory entrances, an ID number is not a proportionate item for building security; name, company and host are usually enough. If a specific regulation or special security requirement applies, the justification should be written down and mentioned in the privacy notice. If you are unsure, review the question with your legal adviser before collecting it.

### How long should visitor records be kept?

KVKK does not set a fixed number of days; personal data should be kept only as long as the purpose requires. The organisation should choose a reasonable period for visitor records and write it into its data retention and destruction policy. When the period ends, records should be deleted, destroyed or anonymised, and that action should be documented.

### How should we give visitors a privacy notice?

The simplest way is to display a short notice clearly at reception or to present it on paper or screen during registration. It should state who the data controller is, why the data is processed, the legal basis, who it may be shared with and the visitor's rights. Giving a privacy notice is not the same as obtaining explicit consent.

### How does SmartPass delete visitor data?

The organisation chooses how long access records are kept, between 30 days and the upper limit of its package. When that period ends, the visitor's name and purpose of visit are deleted automatically, while counts such as daily visitor numbers and reports are kept. The retention period written in your policy is therefore applied without anyone weeding records by hand.

### How do we buy SmartPass?

Because SmartPass is installed together with hardware, it is priced by quotation based on the number of access points, the number of people and the hardware needed. When you complete the sales form on the Smart360 website, the quotation is sent on the same business day. Installation begins with a site survey, which confirms whether your existing turnstiles, readers and cards can be reused.