Multi-location visitor management: branches, clinics, warehouses and regional offices

Why small sites are the weak link

A branch in Nashik or a clinic in Siliguri has a logbook on a table and a guard on a long shift. In our experience the same gaps appear at almost every small site.

• Logbooks nobody reviews. The missing host column surfaces only when something goes wrong.
• No exit times. “Time out” is the column most often blank, so nobody can trace a visit end to end.
• No notice. A register becomes digital personal data once it is typed into a spreadsheet or a page is photographed (DPDP Act, section 3). Where consent is the basis, as we advise, a notice must come first (section 5(1)), with an itemised description of the data (Rule 3). Small sites rarely show one.
• Retention that differs by site. One branch keeps registers for years in a cupboard; another sends WhatsApp photos to a regional manager nightly. Rule 8(3) sets a one-year minimum for personal data and processing logs “for the purposes as specified in the Seventh Schedule”, which Cyril Amarchand Mangaldas and Lakshmikumaran & Sridharan read as binding every data fiduciary; section 8(7) asks for erasure once the purpose is served.
• No headcount. Without exit times there is no list for the fire warden, at the sites with the fewest trained wardens.

The company, not the branch, is the data fiduciary for these registers, unless a franchisee runs the site. A breach at one site goes to each affected visitor and to the Data Protection Board “without delay”, with a detailed report to the Board within 72 hours (Rule 7). Most DPDP duties apply from 13 May 2027 (Rule 1(4), eighteen months after publication); some firms, including Cyril Amarchand Mangaldas, count from the next day and give 14 May 2027. A January 2026 proposal to shorten the timeline for some provisions had not been notified as of 12 October 2026 (Business Standard; S.S. Rana & Co.).

What head office answers for in an audit

Four kinds of review reach the small sites.

• ISO 27001 multi-site certification. Certification bodies sample sites, and usually choose them (DQS). The general rule, IAF MD 1, was reissued unchanged in substance as Global ACI-TECH-3-001 from 28 August 2026, after the IAF handed its work to the Global Accreditation Cooperation Incorporated (Global ACI) on 1 January 2026. It samples the square root of the number of sites, rounded up, at an initial audit (seven of 40) and 0.6 times that root at surveillance (four), at least 25% at random, with every site in your internal audit programme. For ISO 27001 it gives precedence to the ISMS rules in ISO/IEC 27006, now ISO/IEC 27006-1:2024, so ask your certification body how it sizes your sample. Where Annex A 7.2, “Physical entry”, is in your Statement of Applicability, it can be tested at any sampled branch. See our ISO 27001 visitor management guide.
• PCI DSS. Where a site handles card data, requirement 9.3.4 of v4.0.1 asks for visitor logs with the visitor’s name and organisation, the date and time, and who authorised access, kept for at least three months. See our PCI DSS visitor log guide.
• DPDP. Rule 6(1) asks for access control over computer resources, logs of who accessed personal data, and those logs kept for a year. See our DPDP guide.
• Client questionnaires. Physical and Environmental Security is one of the 21 risk domains in the SIG questionnaire (Mitratech). “All sites” in your answer includes the smallest.

A note for banks and NBFCs. RBI’s Commercial Banks (Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026, dated 31 July 2026, cover commercial banks except small finance, payments and local area banks. They ask for physical and environmental controls where critical assets sit, naming data centre and disaster recovery sites (paragraphs 60 to 63), and for checks on vendor and third-party personnel who access critical assets (paragraph 135). RBI’s 2023 IT governance directions set the same data centre and disaster recovery controls for NBFCs in the Top, Upper and Middle Layers (paragraph 18). In our reading, neither sets a format for a branch visitor register; confirm the version in force with your compliance team.

What breaks at small sites, and what a central set-up gives you

What central teams need from a multi-site visitor management system

1. One policy. Visitor types, escort rules, ID verification where policy calls for it, and what no site may collect. Sites should not quietly add columns.
2. One notice in local languages. Section 5(3) lets the visitor choose English or any of the 22 Eighth Schedule languages. We advise English, Hindi and the city’s main language at the door, others on request, all from one versioned master notice.
3. One retention schedule. Keep the visit record and its logs for one year, the Rule 8(3) minimum for its Seventh Schedule purposes; because the rule speaks of personal data generally, keep photos and mobile numbers for days only as a written decision your DPO and counsel sign off. The same clock at every site, with a record of each erasure.
4. One access log. Every look at a visitor record, at any site, logged and kept for a year (Rule 6(1)(c) and (e)).
5. Records you can pull for an audit. Host, approver and times for the sampled dates at the sampled sites, exported once, with no whole registers emailed around.
6. Local approvals. The host at the site approves, with a named backup. Head office sets the rule; the branch runs the visit.

Three snapshots from small sites

These are illustrative situations, not customers.

11:20 am, a branch with one guard and three visitors. Santosh Pawar guards an NBFC branch in Nashik: today an AC technician, a courier and a regional auditor. The technician scans the QR poster, reads the notice and checks in on his phone; the branch manager, Kavita Deshmukh, approves from her desk. Santosh scans the pass and matches the face to the photo. Customers at the counter are not in the visitor log; the technician, who goes behind it, is.

Monday 10 am, an audit request covering 40 sites. Arvind Menon, compliance manager at a diagnostics chain in Mumbai, must show the internal audit covered all 40 centres before the certification audit samples some of them. With logbooks, that means 40 couriers and missing pages. With one log, he exports the sampled dates and shows host, approver and times for each visit.

6:30 am, a warehouse with trucks but few visitors. At a Bhiwandi warehouse, drivers who stay in the yard go in the gate’s vehicle records; anyone entering the office or floor, including a driver walking to the dock office, is a visitor. The truck gate and office door are two entry points, each with a poster. For gate passes, see our guide to visitor management for factories.

How to roll out visitor management across many sites

1. Start with a pilot region. Pick five to ten sites covering each site type: a busy branch, a quiet one, a site with no guard, a warehouse. Run it beside the logbook for a month.
2. Make the six choices once, centrally: site, staff list, visitor types, notice, retention and approvals. Each site adds its entry points.
3. Print a QR poster per entry point. Visitors check in on their own phone in the browser, with nothing to download. A visitor without a smartphone is checked in by the guard, who reads the notice aloud.
4. Load staff lists, or sync the directory. Branch staff transfer often; directory sync (Okta, Microsoft Entra ID) keeps joiners and leavers current.
5. Train the guard in ten minutes. Scan the pass, match the face to the photo, check host and validity, and call the named backup if anything is wrong. Where there is no guard, a named colleague handles anything unusual.
6. Put the rules in every agency contract. The security agency is usually your data processor, engaged only under a valid contract (section 8(2)) with security safeguards (Rule 6(1)(f)). Agencies differ by region; the clause should not.
7. Roll out in waves, a region at a time; lock each retired logbook away and destroy it securely a year after its last entry.
8. Track monthly: visits with an exit time, visits approved by a named host, and sites still sending logbook photos.

For the minimum process at a site with no reception, see our small offices guide; for the columns, see our visitor register format guide.

What multi-site visitor management should cost

For a branch network, the pricing basis matters more than the headline price. Ask every vendor to price your real portfolio: entry points, monthly visits per site in the busiest month, messaging, any devices each site needs and yearly increases, then compare the three-year cost.

Orb, our visitor management system, is priced per entry point a month, by monthly visits, never per host or floor, from ₹1,499 per entry point a month (live Pricing page). An entry point is one reception or gate that keeps its own register. For portfolio companies with many locations and little traffic at each, a curated Orb plan manages all the sites together. A site needs nothing new to start: a QR poster and a phone the guard already has.

Common mistakes in multi-site rollouts

• Copying the head office lobby to a two-person branch. Three visitors a day need a poster and a guard’s phone; keep kiosks and turnstile work for sites whose traffic calls for them.
• Letting each region pick its own tool. Three systems mean three access logs and three answers for the auditor.
• Logging customers or patients as visitors. It collects data nobody needs and, at a clinic, adds health context.
• Forgetting the logbooks in cupboards. Once photographed or scanned they are digital personal data and need a destruction date.

Where Orb fits

Orb is built for companies that run many small sites from one head office.

Questions buyers ask