QR code visitor management means giving a guest a single-use, time-limited QR code, before the visit or at reception, which they scan at the turnstile or door reader to get in. The code only works within a set time window and for specified zones, and expires when the visit ends. It replaces the paper logbook and unreturned visitor badges.
Why visitor access is still the weak link
Plenty of sites that moved staff onto card access control still handle visitors the old way: a logbook at the gatehouse, a box of cards marked "VISITOR" on the desk and someone to hand them out.
The problems are familiar:
- Nothing in the logbook is verified. Name, company and phone number are handwritten; who the visitor is there to see often goes unrecorded.
- Visitor cards open every door. Shared visitor cards are usually set up with broad permissions, so the same card gets into production, the warehouse or office floors.
- Cards do not come back. A card that is never returned stays active in the system.
- No exit record. In an evacuation, nobody knows which visitors are still inside.
- The logbook is a personal data archive. Page after page of names and phone numbers accumulates on a desk anyone can see.
Visitors may be suppliers, auditors, service engineers, job candidates or customers. What they have in common is that they do not know the site and they still need to be held to the same rules as staff. Patient companions in hospitals and parents at schools fall into this group too; see hospital access control and school access control.
In municipal service buildings, visitors can mean hundreds of citizens a day; we explain how to run that flow without adding paperwork in municipal building access control.
The cost of sticking with the paper logbook
A visitor book looks harmless, but it carries risk on two fronts: physical security and personal data protection.
On the data side, regulatory pressure in Türkiye is rising. Türkiye's data protection law, KVKK (Law No. 6698, broadly comparable to the GDPR), is enforced by the Personal Data Protection Authority, which received 12,512 complaints and reports in 2025 (KVKK Annual Report 2025). The same report states that the Authority's Board imposed administrative fines on 876 data controllers in 2025 (KVKK Annual Report 2025). A logbook left open on a desk, with no defined retention period, can quickly raise questions about transparency obligations and data security.
On the physical side, the industry is moving away from paper and plastic:
In HID Global's survey of more than 1,200 security professionals, 39% of organisations were actively using mobile identities. (HID Global, 2024 State of Physical Access Control)
HID's 2025 report adds that nearly two-thirds of respondents are either deploying or planning to deploy mobile solutions (HID Global, 2025 State of Security and Identity). A QR code is the most practical form of that shift on the visitor side: it can sit on a phone or on a printout, costs nothing to print and never needs collecting. We compare NFC, Bluetooth and QR options for phone-based entry in our mobile access control guide.
How to set up QR code visitor management in seven steps
- Define visitor types. Supplier, service engineer, auditor, job candidate, meeting guest. Contractor crews working on site are handled separately, with their safety paperwork (contractor access and safety compliance). Each type has different zones it may visit and a different length of stay.
- Assign a host. Every visit should have a named member of staff responsible for it; the guest is let in on that person's behalf.
- Restrict the code. The QR code should be single-use, valid only within a set date and time window, and open only the zones needed. An expired code should work on no door at all.
- Run the code on the same system as staff rules. Separate software and separate door definitions for visitors mean two rule sets. Cards and QR codes should be read on the same reader and evaluated by the same rules engine.
- Record the exit too. Scanning the code again at the turnstile or exit reader keeps the "who is on site" list accurate.
- Put data protection in place. Show visitors a privacy notice, collect only what you need, set a retention period in line with your retention and disposal policy, and delete or anonymise records once it expires.
- Plan for emergencies. A head count at the assembly point must include the visitors who are inside (emergency muster report).
Logbook versus QR code
| Criterion | Logbook + shared visitor card | Time-limited QR code |
|---|---|---|
| Who arrived | Handwritten, unverified | Pre-registered, linked to a host |
| Scope of access | Often broad | Defined zones only |
| Duration | Until the card is returned | Set time window |
| Returns | Cards go missing and stay active | Code expires on its own |
| Exit record | Usually none | Created by the scan |
| Data protection | Open book, unclear retention | Defined retention and anonymisation |
The same principles apply beyond factories: in a multi-tenant office the code should open only the visited floor (office building access control), and at a gated residential complex guest codes and plate records need the same retention discipline (residential complex access control).
How Digital Bridge sets up visitor access
Visitor management cannot be designed apart from the physical layout of the site, so we start on the ground:
- Flow analysis. We map where visitors arrive, where they wait, which doors they pass through and where they leave. Gatehouse, reception, production and office areas are treated separately.
- Hardware layout. We install terminals that read both QR codes and cards alongside turnstiles, doors or barriers as part of our card access control service. For visitors arriving by car, barrier and parking systems and licence plate recognition can be added to the same flow.
- Reception and pre-registration. We provide kiosk terminals for self-service check-in and can build organisation-specific steps such as pre-registration or host notification as custom web software. We show how self-service visitor check-in works at reception in our self-service kiosk guide.
- Data protection compliance. Our data protection compliance service covers the visitor privacy notice, data inventory and retention and disposal policy.
For busy public-facing sites such as hospitals, see our healthcare and hospital solutions. We compare how visitors physically pass through the gate in our guide to types of turnstiles; every other guide on doors and cards is in our access control and attendance hub.
SmartPass: cards and QR on one terminal, under one set of rules
SmartPass, our own product, reads 13.56MHz RFID cards for staff and single-use, time-limited QR codes for visitors on the same terminal. Both follow the same permission rules, so you do not need a separate visitor system.
Take a supplier audit. The auditor receives a single-use QR code valid only on the day of the visit from 09:00 to 17:00, opening only the "Gatehouse", "Admin Building" and "Warehouse" zones. They scan it at the gatehouse and go in. At the production area door the same code is refused because the rule does not cover it. After 17:00 the code works nowhere.
Other SmartPass features that matter for visitors:
- Zone hierarchy. Zones such as gatehouse, production, warehouse and offices are defined in a hierarchy, and a visitor's scope is set against those zones.
- Plain-language rules and a simulator. Rules are written as readable sentences; if two rules conflict, the system states clearly which one applies. You can test a new rule in the simulator before it goes live.
- Live monitoring and emergencies. Who is on site right now is listed zone by zone, and in an emergency every door can be locked with a single action.
- Privacy by design. Card numbers are not stored in plain text, records past their retention period are anonymised, every change is logged with old and new values, and the auditor role is read-only.
In multi-site groups each site runs on its own subdomain and database; sites cannot see each other's records, while head office receives consolidated reports.
Next step
Open the last month of your visitor logbook and try to answer three questions: How many visitors have an exit time recorded? How many visitor cards came back? How many years has this book been kept? If the answers are uncomfortable, it is time to move to QR code visitor access. To map your site's visitor flow together and see SmartPass in action, get in touch.
For the staff side of the decision, see 125kHz vs 13.56MHz access cards.