QR Code Visitor Management: How to Replace the Logbook with Controlled, Privacy-Compliant Guest Access

QR code visitor management means giving a guest a single-use, time-limited QR code, before the visit or at reception, which they scan at the turnstile or door reader to get in. The code works only in a set time window and zones, expiring when the visit ends. It replaces the logbook, lost badges and guesswork about who is inside.

Key takeaways

• A time-limited QR code works only within a set date, time window and zones, and expires on its own when the visit ends.
• A paper logbook and shared visitor card mean unverified records, broad permissions, unreturned cards and missing exit records.
• The data protection risk is real: Türkiye's KVKK Board fined 876 data controllers in 2025; an open visitor logbook is a personal data archive.
• Setup takes seven steps: visitor types, a host, code limits, one rules engine, exit records, data protection and emergency planning.
• SmartPass from Digital Bridge does not use QR codes; it admits visitors with a time-limited temporary card governed by the same rules as staff cards.

Why visitor access is still the weak link

Plenty of sites that moved staff onto card access control still handle visitors the old way: a logbook at the gatehouse, a box of cards marked "VISITOR" on the desk and someone to hand them out.

The problems with logbook-and-shared-card visitor access are familiar:

• Nothing in the logbook is verified. Name, company and phone number are handwritten; who the visitor is there to see often goes unrecorded.
• Visitor cards open every door. Shared visitor cards are usually set up with broad permissions, so the same card gets into production, the warehouse or office floors.
• Cards do not come back. A card that is never returned stays active in the system.
• No exit record. In an evacuation, nobody knows which visitors are still inside.
• The logbook is a personal data archive. Page after page of names and phone numbers accumulates on a desk anyone can see.

Visitors may be suppliers, auditors, service engineers, job candidates or customers. What they have in common is that they do not know the site and they still need to be held to the same rules as staff. Patient companions in hospitals and parents at schools fall into this group too; see hospital access control and school access control.

Visitor traffic is also irregular: a supplier arriving at the same time as the morning shift change creates both a queue and a gap in control at the gatehouse. To clear the crowd, the guard eases off the checks, and that is usually exactly when the security gap opens.

In municipal service buildings, visitors can mean hundreds of citizens a day; we explain how to run that flow without adding paperwork in municipal building access control.

What are the risks of a paper visitor logbook?

A paper visitor logbook looks harmless, but it carries risk on two fronts: physical security and personal data protection. We cover the data protection side in more detail in paper visitor logs and KVKK.

On the data side, regulatory pressure in Türkiye is rising. Türkiye's data protection law, KVKK (Law No. 6698 on the Protection of Personal Data), broadly comparable to the GDPR, is enforced by the Personal Data Protection Authority, which received 12,512 complaints and reports in 2025 (KVKK Annual Report 2025).

The same report states that the Authority's Board imposed administrative fines on 876 data controllers in 2025 (KVKK Annual Report 2025). A logbook left open on a desk, with no defined retention period, can quickly raise questions about transparency obligations and data security.

On the physical side, the industry is moving away from paper and plastic:

In HID Global's 2024 survey of more than 1,200 security professionals, 39% of respondents were actively using mobile identities. (HID Global, 2024 State of Physical Access Control)

HID's 2025 report, based on 1,800 respondents, adds that nearly two-thirds of respondents are either deploying or planning to deploy mobile solutions (HID Global, 2025 State of Security and Identity). A QR code is the most practical form of that shift on the visitor side: it can sit on a phone or on a printout, costs nothing to print and never needs collecting. We compare NFC, Bluetooth and QR options for phone-based entry in our mobile access control guide.

How to set up QR code visitor management in seven steps

1. Define visitor types. Supplier, service engineer, auditor, job candidate, meeting guest. Contractor crews working on site are handled separately, with their safety paperwork (contractor access and safety compliance). Each type has different zones it may visit and a different length of stay.
2. Assign a host. Every visit should have a named member of staff responsible for it; the guest is let in on that person's behalf.
3. Restrict the code. The QR code should be single-use, valid only within a set date and time window, and open only the zones needed. An expired code should work on no door at all.
4. Run the code on the same system as staff rules. Separate software and separate door definitions for visitors mean two rule sets. Cards and QR codes should be read on the same reader and evaluated by the same rules engine.
5. Record the exit too. Scanning the code again at the turnstile or exit reader keeps the "who is on site" list accurate.
6. Put data protection in place. Show visitors a privacy notice, collect only what you need, set a retention period in line with your retention and disposal policy, and delete or anonymise records once it expires.
7. Plan for emergencies. A head count at the assembly point must include the visitors who are inside (emergency muster report).

Visitor logbook or time-limited QR code?

Three common mistakes in QR code visitor access

Defining the code too broadly. Issuing a visitor code for "the whole building, all day" is just a digital copy of the shared visitor card. The code's scope should match the purpose of the visit: a meeting guest has no need to open the warehouse door.

Skipping the exit. Where codes are scanned only on entry, the system ends the day showing dozens of "ghost" visitors still inside. At doors without an exit turnstile or exit reader, at least get an exit confirmation at reception.

Keeping visitor data forever. Going digital is not permission to keep data indefinitely. Set a written retention period for visitor records and have the system enforce it automatically; otherwise the risk of the paper logbook has simply moved to another medium.

The principles of QR code visitor access apply beyond factories too: in a multi-tenant office the code should open only the visited floor (office building access control), and at a gated residential complex guest codes and plate records need the same retention discipline (residential complex access control).

How Digital Bridge sets up visitor access

Visitor management cannot be designed apart from the physical layout of the site, so we start on the ground:

1. Flow analysis. We map where visitors arrive, where they wait, which doors they pass through and where they leave. Gatehouse, reception, production and office areas are treated separately.
2. Hardware layout. We install terminals that read both QR codes and cards alongside turnstiles, doors or barriers as part of our card access control service. For visitors arriving by car, barrier and parking systems and licence plate recognition can be added to the same flow.
3. Reception and pre-registration. We provide kiosk terminals for self-service check-in and can build organisation-specific steps such as pre-registration or host notification as custom web software. We show how self-service visitor check-in works at reception in our self-service kiosk guide.
4. Data protection compliance. Our data protection compliance service covers the visitor privacy notice, data inventory and retention and disposal policy.

For busy public-facing sites such as hospitals, see our healthcare and hospital solutions. We compare how visitors physically pass through the gate in our guide to types of turnstiles; every other guide on doors and cards is in our access control and attendance hub.

Visitor access in SmartPass: a temporary card instead of QR

The core principles of visitor access (pre-registration, a responsible host, limits on time and zones, an exit record) work with QR codes and with cards alike. SmartPass, our own product, applies them with cards: SmartPass has no QR-based entry, and visitors receive a temporary card at entry. SmartPass works with 13.56MHz MIFARE and NFC-readable cards; it reads only the card's ID number (UID) and writes nothing to the card. Because the visitor card is read by the same readers and judged by the same rules as staff cards, you do not need a separate visitor system.

The SmartPass visitor flow has four steps:

1. Pre-registration. Reception records the visitor's first name, surname, company, host, end time and purpose of visit. No national ID number is collected from visitors.
2. A temporary card at entry. The card's rights are limited to the visit's access group and duration; once the visit ends the card works at no point and the panel shows a warning.
3. Email to the host. The host is notified by email when the visitor arrives; this notification can be switched off in the organisation settings.
4. Card returned on exit. The card is collected on the way out, and an unreturned card is useless anyway once the visit has expired.

Take a supplier audit. The auditor is pre-registered the day before and collects a temporary card at the gatehouse on the day of the visit. The card's access group covers only the gatehouse, admin building and warehouse zones, so the auditor is refused at the production door and the refusal reason is logged. After the visit's end time the card works nowhere, and the auditor hands it back at the gatehouse on the way out.

Other SmartPass features that matter for visitors:

• One decision engine. When a visitor card is presented, the server decides; a rule changed in the panel applies at every door at once. If the connection drops, doors keep deciding by the same rules from a signed permission list.
• Inside now. The dashboard's "inside now" view shows staff, contractors and visitors separately; daily visitor numbers are tracked and the visitor report exports to Excel, PDF and CSV.
• Points without a fixed door. An NFC-enabled Android phone can act as a mobile terminal, reading the same cards and deciding with the same engine as fixed doors.
• Canteen. A visitor's meal is charged to the host's department.
• Privacy by design. Card numbers are not stored in plain text but as a one-way hash; once the retention period ends, the visitor's name and purpose of visit are deleted automatically; every change is kept in the audit log with its previous and new values.

In multi-site groups each site can be opened as a separate SmartPass organisation with its own database, and authorised users switch between sites from the "Kurumlarım" (My organisations) list without entering a password again. If your visitor flow requires QR codes, we discuss that separately within the project scope; SmartPass's own visitor management runs on temporary cards.

Next step for reviewing your visitor access

Open the last month of your visitor logbook and try to answer three questions: how many visitors have an exit time recorded, how many visitor cards came back and how many years has this book been kept? If the answers are uncomfortable, it is time to move to registered, time-limited visitor access.

To map your site's visitor flow together and see SmartPass's temporary-card visitor management in action, get in touch. To buy SmartPass, request a quote via Smart360; pricing depends on the number of access points, the number of people and hardware requirements.

For the staff side of the decision, see 125kHz vs 13.56MHz access cards.