Visitor management policy template for India: clauses, RACI and retention schedule

What Indian law expects a visitor policy to cover

No Indian law we checked requires a visitor policy by name, but these duties need a written policy that assigns them to named people.

Most duties under the Rules apply from 13 May 2027 (Rule 1(4)); some firms, including Cyril Amarchand Mangaldas, give 14 May 2027. A proposal to shorten that timeline was floated in January 2026; as of 12 October 2026 no change had been notified (S.S. Rana & Co.). Penalties run up to the Schedule maximums, such as ₹250 crore for failing to take security safeguards, sized by the Board under section 33(2). See our guides to the DPDP Act and ISO 27001 physical entry.

For evacuation, cite your state fire rules and fire NOC: NBC 2016 was withdrawn on 30 April 2026, and its replacement, the National Building Construction Standards 2026, calls itself “voluntary in nature and is non-binding” (our evacuation guide).

Visitor management policy template: clause by clause

Copy the clauses as they stand; each names an owner. Values in [square brackets] are placeholders or our suggestions, not legal requirements.

1. Purpose. This policy sets how [Company name] admits, records, supervises and signs out visitors, protects their personal data, and keeps visitors, staff and property safe.

2. Scope. It applies at [sites and entry points] to everyone entering who does not hold a valid staff credential. Contract workers on a contractor’s rolls follow the [Contractor management procedure].

3. Definitions. Visitor: anyone admitted for a visit. Host: the employee responsible for a visitor. Regular entrant: a vendor admitted often under a standing approval. Restricted area: [server rooms, labs, plant floors, records rooms]. Child: a person under 18 (DPDP Act s.2(f)).

4. Roles. As in the RACI (Annex A). The [Head of Administration] owns this policy; the [Head of Security] runs it daily; the [DPO or grievance officer] owns its privacy clauses.

5. Visitor types and fields. Every visitor is registered as one type in Annex B and gives only the fields listed for it. No field is added without the DPO’s approval. Reception never collects home addresses, dates of birth, signatures or copies of identity documents.

6. Notice and consent. Before any detail is collected, the visitor sees a notice listing each item, why it is collected and for how long, and how to withdraw consent, exercise rights and complain to the Data Protection Board. It is offered in English, Hindi and [city’s main language], and any other Eighth Schedule language on request. Consent is item by item, nothing pre-ticked, and the notice version is recorded with the visit.

7. ID verification. Where Annex B requires it, the guard or the approved visitor management system verifies a government-issued photo ID and records the result and who verified it. No ID number is written in a register, and staff never copy or photograph an ID.

8. Approval. Hosts pre-register expected visitors. Every visit is approved by the host; if the host does not respond within [5] minutes, a named backup is asked, then the reception supervisor. No one is admitted on their own word.

9. Passes and escorts. Each visitor gets a pass showing name, host, areas and validity, which expires at the end of the visit or day and may not be lent. Lost passes are reported at once. Visitors are escorted at all times in restricted areas, which also need the area owner’s approval.

10. Conduct, photography and material. Visitors follow staff instructions, safety signs and the photography rules in Annex D. Laptops, tools and samples are declared at entry and checked at exit; material leaving needs a gate pass signed by [role]. Hosts answer for their visitors’ conduct.

11. Contractors and candidates. Contractors complete the site induction and any NDA before work starts; candidates accept confidentiality terms before the interview.

12. Children. As in Annex C.

13. Foreign nationals. Foreign day visitors are registered like anyone else. Where [Company name] keeps accommodation for guests (a guest house or hostel), runs a hospital or nursing home with indoor patients, or admits foreign students, the [Admin lead] reports them to the Registration Officer on the FRRO portal under sections 8 to 10 of the Immigration and Foreigners Act 2025: Form-III within 24 hours of arrival for guests and patients, and the prescribed return for students.

14. Deliveries. Couriers hand over at reception unless the host collects in person; they do not go up to floors.

15. Refusal and deny list. Security may refuse or remove anyone without approval, who will not follow this policy, or who is on the internal deny list, and logs the reason. Only the [Head of Security], with [HR or Legal], adds deny-list entries, with a recorded reason, reviewed every [12] months. Entries rest on conduct, never on religion, caste, gender or similar attributes.

16. Harassment. Sexual harassment of or by a visitor is reported to the Internal Committee under the [POSH policy] or, where [Company name] has fewer than ten workers, to the district’s Local Committee. Reception knows how to reach the Committee.

17. Emergencies. The live visitor list goes to the assembly point in every evacuation and drill, and hosts account for their visitors. Missing persons are reported to the fire service at once. After a real alarm, no one re-enters until the fire officer in charge allows it.

18. Retention. Records are kept and erased as in Annex E, and each erasure is recorded. Records tied to an open incident or claim are held until it closes, with the reason logged.

19. Access and security. Only the roles in Annex A view visitor records, and every view is logged. Guards see only the current day’s visitors. Visitor data never goes to personal phones, messaging groups or personal accounts. Requests from the police or other authorities go to [Legal], are answered on a written request, and each disclosure is logged.

20. Processors. The security agency holds a licence under the Private Security Agencies (Regulation) Act 2005. The agency and any software vendor handle visitor data only under a written contract requiring security safeguards, erasure on schedule and breach reports to [Company name] within [6] hours of noticing.

21. Rights, grievances and breaches. Visitors may withdraw consent, ask for correction or erasure, or raise a grievance with [contact published on the website]; answers go out within [30] days and never later than 90. Suspected personal data breaches go to the [DPO] at once. The DPO informs affected visitors and the Data Protection Board without delay, sends the Board a full report within 72 hours (Rule 7(2)(b)), and reports to CERT-In within six hours where its 2022 Directions apply.

22. Exceptions and enforcement. Exceptions, such as a VIP visit, need the [Head of Security]’s written approval and are logged. Employees who breach this policy face the [disciplinary policy]; visitors may be removed and refused future entry.

23. Training and review. Reception and guards are trained on induction and every [six] months. The owner reviews this policy yearly and after any serious incident, audit finding or change in law. Version [1.0], approved by [name, role] on [date].

Data fields by visitor type (Annex B)

Every type also records visitor type, approver, time in, time out, pass number and notice version. Add a mobile number only where the pass or updates go to the visitor’s phone.

RACI for visitor management (Annex A)

R does, A answers, C is consulted, I is informed.

Visitor data retention schedule (Annex E)

Rule 8(3) asks for personal data, associated traffic data and processing logs to be kept for at least one year “for the purposes as specified in the Seventh Schedule”. Cyril Amarchand Mangaldas and Lakshmikumaran & Sridharan read it as binding every data fiduciary; section 8(7) gives way to retention another law requires.

Escalation matrix: who acts, and how fast

Minors and children on site (Annex C)

The DPDP Act treats anyone under 18 as a child (s.2(f)). Processing a child’s personal data needs the verifiable consent of a parent or lawful guardian (s.9(1)), Rule 10 asks you to check that the person consenting is an identifiable adult, and tracking or behavioural monitoring of children is barred (s.9(3)). The Schedule maximum for breaching these duties is ₹200 crore.

1. Children visit only with a parent or lawful guardian who is the registered visitor and stays with them.
2. Record the adult and “accompanied by [number] children”. Record a child’s name only with the parent’s or guardian’s consent.
3. No ID and no photo from children.
4. Children never enter restricted areas, plant floors or labs.
5. Family days follow an event plan approved by the [Head of Security] and the DPO.
6. Interns or students under 18 come only under a written arrangement approved by [HR] and the DPO, with a parent’s or lawful guardian’s verifiable consent.
7. Schools and campuses apply their own child-safety rules, which this annex does not replace.

Photography and recording rules (Annex D)

For visitors:

1. No photos, video or audio in restricted areas, on plant floors, or of screens and whiteboards, without the host’s written approval.
2. Phones and cameras are deposited before [named secure zones].
3. Anyone breaking this rule is asked to delete the material in front of security and may be removed if they refuse. Security never takes or searches a visitor’s phone.

For staff and guards:

1. Visitor photos are taken only at check-in, only for types in Annex B that need one, and only on the approved system.
2. No one photographs a visitor, an ID or a register page on a personal phone, or shares visitor details in a messaging group.
3. CCTV signs are displayed at entrances; footage is kept for [the period in the CCTV policy].
4. Event photos of visitors need a notice and consent, and never include children without a parent’s or guardian’s consent.

Harassment and misconduct: the POSH Act at your front desk

The POSH Act protects “a woman, of any age whether employed or not” (s.2(a)), so a woman visiting your office is covered. The employer must provide a safe workplace, including “safety from the persons coming into contact at the workplace” (s.19(a)), display the penal consequences of sexual harassment and the order constituting the Internal Committee (s.19(b)), and help the woman start criminal proceedings if she wishes, even when the harasser is not an employee (s.19(h)). Not constituting the Committee can attract a fine of up to ₹50,000 (s.26(1)).

In Dr. Sohail Malik v. Union of India (2025 INSC 1415, decided 10 December 2025), the Supreme Court held that the Internal Committee at the aggrieved woman’s workplace can inquire into a complaint against a respondent employed elsewhere, in that case another government department, and that the respondent’s employer acts on its findings. Ask counsel how this applies when the respondent is a visitor from a private company.

Visitor policy roll-out checklist

1. Fill every placeholder; have counsel and the DPO review the text.
2. Fix the Annex B fields and delete any you cannot justify.
3. Publish the grievance contact on your website and in the notice.
4. Add data clauses to the security agency contract and confirm its PSARA licence.
5. Brief hosts on approvals and escorts; train every guard and receptionist, night shift included.
6. Post the escalation matrix, with numbers, at reception and the guard post.
7. Run a drill that includes visitors and check the headcount.
8. Test one erasure end to end, keep the record, and diarise the annual review.

Where Orb fits

Orb, our visitor management system, makes these clauses the default way the lobby works.

Questions buyers ask