How to choose a visitor management system in India: 2026 buyer's guide

What does a visitor management system do, and why does “VMS” confuse buyers in India?

A visitor management system records who enters, who they are meeting, who approved them, when they arrived and left, and who is inside right now. A good one also shows a notice about the visitor’s data, gives the guard something to check, and produces the records an auditor or fire officer asks for. It replaces the logbook at the desk, the guard’s call to a host’s extension, and the spreadsheet emailed to tenants every morning.

In India, “VMS” often means a video management system, the software that records CCTV footage (government tenders use it that way), so a tender for a “VMS” can bring you camera quotes. Write “visitor management system” in full.

Check-in on the visitor’s phone, a tablet or a register: which fits your entrance?

How should host approval, the gate pass and the guard workflow work?

In most Indian lobbies the slowest step is the guard calling an extension nobody answers.

• Host approval: hosts live in WhatsApp, or Microsoft Teams or Slack in larger companies. Approval should reach them there in one tap, then go to a backup, then the desk.
• WhatsApp charges: since 1 July 2025 Meta charges per template message, by category and country; utility templates are free only inside an open 24-hour customer service window (Meta). Ask whether charges are in the price, list Meta and any WhatsApp business solution provider as subprocessors, and decide what the approval message shows, because it lands on hosts’ own phones.
• The gate pass: a static QR code in an SMS can be forwarded or screenshotted. Ask whether the pass changes over time and expires with the visit.
• The guard view: photo, name, host and approval status. A guard does not need a visitor’s mobile number or ID details.
• Watchlists: these are personal data too, so decide who can add a name, on what grounds and for how long.

Contractors, candidates and deliveries: which visitor types do you need?

A client meeting, an interview, a lift repair and 25 contract workers on a 7am shift are different visits.

• Contractors: ID verification where your policy calls for it, a safety induction and NDA signed before arrival, a pass valid for the contract period and work areas, and a named sponsor.
• Candidates: a short flow, an NDA if needed, and their own retention setting.
• Deliveries: often a gate entry with no host approval.
• Under-18 visitors: route them to the desk, where a parent or lawful guardian with them can give consent. The DPDP Act needs verifiable parental consent for a child’s data (section 9(1)).

Who is inside right now? Live register and emergency roll call

During an evacuation, the fire warden needs everyone inside, by floor or zone, and a way to mark each person safe at the assembly point. A logbook on a desk you have just evacuated cannot do that.

In the demo, ask the vendor to start a roll call, mark people safe, message visitors not yet accounted for and produce the drill report for a fire officer, then repeat it with Wi-Fi off.

Multi-site, multi-tenant and integrations: will it fit your estate?

Multiple sites: one set of policies, notices and retention rules, with site admins who see only their own site.

Multi-tenant buildings and co-working spaces: each tenant sees only its own visitors, and building security sees everyone inside for evacuation. The DPDP Act does not mention landlords or tenants, so agree in writing who gives the notice, answers visitor requests and reports a breach. We cover that split in our guide to the DPDP Act and your visitor register.

Access control and turnstiles: ask how an approval reaches your readers, turnstiles or face recognition gates (a QR reader, an API into the access control software, or a credential sent to the controller). Older readers often use Wiegand. OSDP, the Security Industry Association’s protocol, supports encryption through its Secure Channel when it is switched on, and is published as IEC 60839-11-5. For face gates, ask when each visitor’s face template is deleted.

Staff directory: a stale host list lets last month’s leaver approve visitors. Upload a staff list for small sites; larger organisations should sync from Okta or Microsoft Entra ID, often through SCIM (IETF RFC 7644).

Which DPDP Act duties must a visitor management system support?

A visitor management system holds digital personal data, so the DPDP Act 2023 and Rules 2025 apply. Most duties apply from 13 May 2027 (Rule 1(4), eighteen months after publication); some firms, including Cyril Amarchand Mangaldas, count from the next day and give 14 May 2027. A proposal to shorten the timeline was floated in January 2026; as of 12 October 2026 no change had been notified. You stay responsible for what your vendor does (section 8(1)) and may use one only under a valid contract (section 8(2)). The system should let you:

1. Show a notice before the first question: standalone, plain language, itemised data and purposes, and links to withdraw consent, exercise rights and complain to the Data Protection Board (section 5, Rule 3).
2. Offer it in English or any of the 22 Eighth Schedule languages, as the visitor chooses (section 5(3)). In practice, show English, Hindi and your city’s main language at the door and offer any other on request.
3. Record consent with a clear affirmative action, nothing pre-ticked, limited to what each purpose needs, with withdrawal as easy as giving it (section 6). Item-by-item consent shows this most clearly.
4. Log every access to visitor records, alongside encryption, access control and backups (Rule 6).
5. Set retention per data item: section 8(7) says erase when the purpose is served, but gives way to retention another law requires. Rule 8(3) requires personal data, associated traffic data and processing logs to be kept for at least one year “for the purposes specified in the Seventh Schedule” (State purposes); Cyril Amarchand Mangaldas and Lakshmikumaran & Sridharan read it as applying to every data fiduciary, so it governs the first year, photos and mobile numbers included. Our advice: keep the visit record and its logs for one year, and photos and mobile numbers for days only as a written decision your DPO and counsel sign off.
6. Support breach reporting: tell affected visitors and the Board without delay, with a full report to the Board within 72 hours of becoming aware (Rule 7). CERT-In’s 2022 Directions separately require reporting listed incidents within 6 hours.

Data residency: the Act has no general rule that personal data must stay in India. Section 16 lets the government restrict transfers to notified countries, Rule 15 lets it set requirements for making personal data available to a foreign State, and Rule 13(4) can require significant data fiduciaries to keep specified data in India; laws with stricter transfer rules still apply. CERT-In’s 2022 Directions require service providers, intermediaries, data centres, body corporates and government organisations to keep ICT system logs for a rolling 180 days within Indian jurisdiction, though its FAQs (May 2022, Q35) allow storage outside India if the logs can be produced to CERT-In in reasonable time. Ask for the country, cloud region and every subprocessor.

Visitor management system pricing in India: models and total cost

Vendors price in five main ways.

The subscription is rarely the whole cost. Add:

• Devices and badges: tablets, kiosk stands, device management, replacements, labels and lanyards that never come back.
• Messaging: WhatsApp template charges and SMS. Commercial SMS needs registered headers and templates, and since 1 October 2024 SMS carrying URLs, APKs or OTT links the sender has not whitelisted are blocked (TRAI).
• ID verification: often charged per check.
• Integration and your own time: the integrator, the data processing agreement, vendor risk assessment and guard training.

Visitor management system RFP: 12 questions to ask, and red flags

Ask for live answers on your scenarios, then in writing.

1. Check in a visitor without a smartphone. What record is created?
2. Send an approval to a host who does not answer. When is a backup asked, then the desk?
3. What does the guard see on scan, and can a screenshot get someone in?
4. Show the notice. Which languages, and which version did each visitor see?
5. Can we set retention per data item, and what proof of erasure do we get?
6. Show the access log, including your support staff. Can we export it to our SIEM?
7. Which country and cloud region hold our data, and who are your subprocessors?
8. Will you sign a data processing agreement with Rule 6 security terms, erasure, breach notice in hours, subprocessor changes and audit rights?
9. Run a roll call now. How does it work if Wi-Fi is down?
10. How do you connect to our turnstiles, readers and directory, and who pays?
11. How fast does a leaver lose the ability to approve visitors, and do our admins sign in through our SSO with MFA and role-based access?
12. What is the three-year cost at our volume, what uptime and support response do you commit to, and how do we get our data out if we leave?

Red flags:

• ”By checking in you agree” or pre-ticked boxes in place of an itemised notice.
• Retention fixed by the vendor, or no proof of erasure.
• No access log, or one that leaves out vendor staff.
• A pass a screenshot can reuse: a static QR image with no photo check or expiry at the gate.
• ID collected from every visitor, whatever the visit type.
• No named cloud region, subprocessor list or pilot at your entrance.

How to run a four week visitor management pilot

Pilot at one entrance, ideally your busiest, and define success before you start.

1. Week 0, baseline: measure time from arrival to entry at the morning peak, host response time, and how many register entries lack an exit time or host.
2. Set measures and targets: check-in time at peak, visits approved before entry, complete records, visitors routed to the desk, and guard feedback.
3. Week 1, go live with a desk fallback: sign the data processing agreement and finish your vendor security review first, agree that pilot data is erased if you do not proceed, then put up the notice, train guards and reception, and brief hosts.
4. Weeks 2 and 3, test the edges: an unanswered host, a contractor without an induction, a visitor without a phone, a network drop, an evacuation drill.
5. Week 4, test the data: export the access log, run an erasure request end to end, check retention against your policy.
6. Decide: compare against the baseline, separate product failures from process failures, then roll out site by site.

Where Orb fits

Orb, our visitor management system, is built for Indian buildings and for the DPDP Act 2023 and Rules 2025.

Questions buyers ask