Security guard SOP for visitor entry: a printable gate and reception procedure for 2026

SOP template: document control and scope

Print this block at the top of the SOP.

What the law lets a security guard do at the gate

• Who can be a guard. Under the Private Security Agencies (Regulation) Act, 2005 (PSARA), a guard is 18 to 65 (section 10(1)(b)), the agency checks their character and antecedents (section 10(1)(c)) and trains them (section 9(2)), and each guard carries an agency photo identity card (section 17).
• How much training. Rule 8(1) of the Private Security Agencies Central Model Rules, 2020 (G.S.R. 776(E), 15 December 2020) sets at least 100 classroom hours and 60 field hours over at least 20 working days for entry-level guards, with a shorter course for ex-servicemen and former police. States frame their own rules. The rule 8(2) subjects include physical security, fire fighting, crowd control, examining identity documents and first aid, but not receiving visitors or keeping entry records.
• Confidentiality. Under section 18(1), a guard “shall not divulge to anyone other than the employer” what they learn on duty, except as the employer directs, for police inquiries or under legal process. Visitors’ names, numbers and hosts fall inside that.
• Searching people. We found no power in PSARA for a guard to search anyone. In our reading, a bag check at a private gate rests on the visitor agreeing to it as a condition of entry; confirm this with counsel.
• Holding someone. Section 40(1) of the Bharatiya Nagarik Suraksha Sanhita, 2023 lets any private person arrest someone who, in their presence, commits a non-bailable and cognizable offence, and requires them to hand the person to the police “without unnecessary delay, but within six hours”. Even then, section 49(1) gives the search to the police officer.
• A 2026 change. The Jan Vishwas (Amendment of Provisions) Act, 2026 amended PSARA from 15 May 2026 (notification S.O. 2180(E), 30 April 2026). The government’s explainer and SCC Online describe one change: the duty to display the agency’s licence at its premises, and its fine, are gone. We found no change to the duties above; online copies of the Act predate the amendment, so ask counsel for the current text.

Roles at the gate and reception

Step 1: Shift handover at the gate

A guard who does not know who is inside cannot run an evacuation. Both guards sign this at every shift change; the supervisor countersigns.

1. Who is inside now: count of visitors, contractors and drivers on site, and any passes past their valid-until time.
2. Expected today: pre-approved visitors, VIPs, contractor gangs, interview batches and deliveries due this shift.
3. Open items: material out on returnable passes, laptops declared at entry and not yet checked out, vehicles inside.
4. Alerts: watchlist changes, police or management instructions, areas closed for work.
5. Incidents: anything from the last shift still open.
6. Kit: metal detector, radio, charged duty phone, keys, torch, first-aid kit, call sheet.
7. Post check: emergency exits and fire lanes clear, CCTV monitor and gate barrier working.
8. Sign-off: names, time, and any item the incoming guard did not accept.

Step 2: Visitor arrival and approval

The core rule: no approval, no entry. A visitor’s word that “Mr Rao is expecting me” is not an approval.

1. Greet and ask. “Good morning. Whom are you visiting, and from which company?”
2. Check pre-registration. If the visitor is expected and approved, go to step 5.
3. Walk-in. Send the visitor to check in (self check-in or reception). The host approves; if the host does not answer within [5] minutes, ask the host’s backup, then reception. Never call a host’s number given by the visitor.
4. ID verification where policy needs it. For the visitor types your policy names (such as contractors or anyone entering a restricted area), confirm ID verification is complete. If the visitor declines, politely refuse entry; the host may meet them in the lobby.
5. Match the person to the pass. Compare the face to the photo on the pass and check the host, area and valid-until time.
6. Brief and hand over. Tell the visitor the site rules (photography, escort areas, assembly point); the host or an escort collects them from the lobby.

Couriers stop at a drop counter unless policy says otherwise. Contractors finish induction and any NDA before arrival (see our factories guide). Children come with a parent or lawful guardian, who alone gives any consent for their data.

Step 3: Belongings, laptops, material and vehicles

1. Bags. Ask, do not demand: “May I check your bag, please? It is the entry rule for everyone.” A visitor who refuses may leave the bag at the counter against a token, or not enter.
2. Frisking. Only where your policy requires it, by a guard of the same gender, in a screened spot. Section 49(2) of the Bharatiya Nagarik Suraksha Sanhita requires a female to be searched “by another female with strict regard to decency”; adopt that rule, roster a female guard on every shift that frisks, and honour a visitor’s request for a guard of a particular gender.
3. Laptops and cameras. Where policy requires, record make and serial at entry and check the same item out; in restricted areas, ask visitors to deposit cameras or cover phone cameras.
4. Material. Anything leaving that did not come in leaves only on a signed material gate pass, returnable or non-returnable; see our gate pass formats.
5. Prohibited items. Weapons, alcohol, inflammables: refuse entry with the item and call the supervisor. Never take custody of a weapon.
6. Vehicles. Record the vehicle number, driver and the visit or delivery it belongs to, check the boot only with the driver’s agreement, and keep drivers in their waiting area unless they hold a pass.

Step 4: Passes, escorts and restricted areas

• Every visitor carries a pass naming the host, area and valid-until time, which looks different from staff identification. PCI DSS v4.0.1 requirement 9.3.2 expects visitors to the cardholder data environment to be authorised before entry, escorted at all times, and given a badge that expires and visibly sets them apart from staff.
• Escort means escort. In restricted areas (server rooms, labs, cash rooms, production floors) the host or a guard stays with the visitor.
• Tailgating. One person per pass at turnstiles and doors. Two guards approach a tailgater and walk them back to reception.
• Pass misuse. A pass shown by someone other than the person in its photo is refused and reported. A screenshot of a pass is not a pass.

ISO/IEC 27001:2022 control 7.2, “Physical entry”, asks for entry controls on secure areas (see our ISO 27001 guide).

Step 5: Exit and end of day

1. Close the visit at exit: record the exit time, recover or deactivate the pass, and check out declared laptops and material. PCI DSS 9.3.3 expects visitor badges surrendered or deactivated before visitors leave or at expiry.
2. Overstays: at the valid-until time, call the host; if the host cannot account for the visitor, the supervisor finds them.
3. End-of-day reconciliation: before the night shift, the supervisor checks every visit is closed; anyone still showing inside is found or recorded as an exception.
4. Records: keep the visit record and logs for one year. DPDP Rule 8(3) sets a one-year minimum for personal data, associated traffic data and processing logs “for the purposes as specified in the Seventh Schedule”; Cyril Amarchand Mangaldas and Lakshmikumaran & Sridharan read it as binding every data fiduciary. Keep photos and mobile numbers for days, as a written decision your DPO and counsel sign off. PCI DSS 9.3.4 asks for three months. See our DPDP guide.

Incidents at the gate: what the guard does and whom to call

Incident report fields: date and time; post; guard’s name; people involved; what happened, in the guard’s words; action taken; who was told and when; police or ambulance reference; supervisor’s signature. Write it the same shift. Our lobby emergency playbook covers bomb threats and lockdowns.

Emergencies: the guard’s job in a fire or evacuation

1. On the alarm: stop all entry, confirm the fire service has been called (101 or 112), open vehicle gates for fire tenders and keep the fire lane clear. Nobody uses the lifts.
2. Take the list: carry the live list of visitors, contractors and drivers inside to the assembly point.
3. Count: hosts confirm their visitors; security confirms contractors and drivers.
4. Report at once: give the incident controller and the fire service the names and last known floor of anyone unaccounted for, and keep phoning them and their hosts in parallel. Never go back inside to search.
5. Help on the stairs: tell the fire officer where any visitor who could not use the stairs unaided is waiting.
6. No re-entry: after a real alarm, nobody goes back in until the fire officer in charge clears it.

NBC 2016 was withdrawn on 30 April 2026 when BIS established SP 7:2026, the National Building Construction Standards 2026; state fire rules and your fire NOC still set drill duties. See our evacuation roll call guide.

What security guards must never do with visitor data

Each of these common lobby habits can become a data breach.

• Photographing ID cards on a personal phone. The images sync to the cloud and leave with the guard.
• Sharing visitor photos in WhatsApp groups. Everyone in the group, former staff included, keeps a copy.
• An open logbook on the counter. Each visitor can read the names, numbers and hosts above their own.
• Keeping a visitor’s ID card as a deposit for the pass.
• Giving out visitor details to callers or other tenants. PSARA section 18 already forbids it.
• Spreadsheets on a shared desk computer with no password and no record of who opened them.

Under the DPDP Act, a personal data breach includes “accidental disclosure” of personal data (section 2(u)). Section 8(5) requires reasonable security safeguards, which Rule 6 spells out as access control, logs and monitoring. Rule 7 requires you to tell each affected person and the Board, with a detailed report to the Board within 72 hours. Penalties can reach ₹250 crore for failed safeguards and ₹200 crore for an unreported breach, sized by the Board under section 33(2). These duties apply from 13 May 2027 (Rule 1(4)).

Guard supervisor checklist for every shift

1. Handover signed by both guards, with the count of people inside and open items.
2. Emergency call sheet at the post: 112; [police station, number]; [fire station, number]; [nearest hospital with an emergency ward, number]; [security head, number]; [facility head, number].
3. Duty phone charged; no visitor data on personal phones.
4. Expected visitors, contractors, deliveries and watchlist changes briefed; guard knows the code word.
5. A female guard rostered where frisking is done.
6. Every visitor checked for approval and a valid pass before entry; escorts in place for restricted areas.
7. Material leaving only on a signed gate pass.
8. Overstays chased at the valid-until time.
9. End-of-day reconciliation: every visit closed or explained.
10. Incident reports written the same shift; fire lane and exits clear at each round.
11. Shift report signed and filed.

How to brief, test and audit the SOP

• Brief every shift: one step, one scenario, one question per guard.
• Train new guards on this SOP before their first solo shift, with a signed record.
• Spot checks: each month, send unannounced test “visitors”: one without approval, one with an expired pass, one who tailgates. Record the results.
• Contract terms: put this SOP, the confidentiality duty and the no-personal-phones rule in the agency contract, and ask for each guard’s training certificate and proof of the character and antecedent check.

Where Orb fits

Orb, our visitor management system, gives the guard a short, checkable job at each step.

Questions buyers ask