School visitor management in India: gate passes, parent pick-up and college campuses

Schools and colleges at a glance

What the rules say about the school gate

We found no national law that prescribes a school visitor register format. The duty comes from documents that set the outcome and leave the method to you.

The 2021 guidelines are advisory, but on 24 September 2024, in Bachpan Bachao Andolan v. Union of India, the Supreme Court said states and UTs “are expected to adopt the guidelines”, with suitable modifications, and asked NCPCR to monitor implementation with them. Enforcement is real: on 30 December 2025 CBSE withdrew a Jaipur school’s affiliation after a nine-year-old’s fatal fall, finding child protection committees that existed only in name and CCTV upgrades still “in progress” (SCC Online).

Reporting is personal. On 9 July 2026, in AAA v. Linda Sema, the Supreme Court sent a headmistress to trial under POCSO for making her own enquiries instead of reporting a child’s complaint, holding that information received directly from the victim is credible knowledge under section 19(1) and that no internal verification should come first (LiveLaw). Anyone at the school who learns of possible abuse reports it to the Special Juvenile Police Unit or local police at once and tells the head; the school preserves the gate records and CCTV.

A day at a school gate: three scenarios

7:25 am, drop-off at a day school in Pune

Santosh Kale, guard supervisor at a large CBSE day school, locks the main gate at 7:50 once students and staff are in; after that, adults use the wicket door. A mother pre-registered for a 9 am meeting checks in and waits in the visitors’ room. A father who wants to “just see the principal” waits while the front office asks. No visitor car enters.

11:40 am, an uncle comes for a child with fever

The nurse calls Farah Shaikh about her daughter in Class 2. Farah says her brother-in-law, Imran, will come; he is not on the pick-up list. When he arrives, the front office checks the restrictions on file, calls Farah back on the number on file, not one Imran offers, and records her one-time authorisation naming him, with time and staff name. Imran’s identity is verified against that name, the class teacher signs an early-leave pass, and the guard checks pass, child and adult together. Had Farah been unreachable, the child would have stayed in the sick room.

1:30 pm, AC technicians in the primary block

Rajesh Nair, the estate manager, pre-registered two AMC technicians; each accepted the contractor code of conduct before arriving (no photographs, never alone with a child, staff washroom only). They work during assembly, when the Class 1 rooms are empty, with a support staff escort.

Parent pick-up authorisation and early-leave gate pass: templates

Collect the pick-up authorisation at admission and each academic year. For register columns see our visitor register format guide, and for visitor, material and vehicle passes see our gate pass templates.

Template 1: Parent pick-up authorisation form

Template 2: Student early-leave gate pass

Template 3: Visitor types and gate rules

Children’s data at the gate: what the DPDP Act asks

Once a gate register is digital, or a logbook is typed up or photographed, the DPDP Act applies (section 3). Notice (Rule 3), children’s consent (Rule 10) and most other duties apply from 13 May 2027 (Rule 1(4), eighteen months after publication); some firms, including Cyril Amarchand Mangaldas, give 14 May 2027. A January 2026 proposal to shorten the timeline (Business Standard) had not been notified as of 12 October 2026; the Removal of Difficulties Order of 5 October 2026 made two word-level corrections, one in section 9(1), and moved no dates (S.S. Rana & Co.).

• Who is a child. Anyone who has not completed eighteen years (section 2(f)). Processing a child’s data needs verifiable consent of the parent or lawful guardian (section 9(1)), after checking that the person giving it is an identifiable adult (Rule 10), never a driver or a nanny.
• The education exemption is narrow. Section 9(3) bars tracking and behavioural monitoring of children. Rule 12 and Part A of the Fourth Schedule lift sections 9(1) and 9(3) for an educational institution only for tracking and monitoring “for the educational activities of such institution” or “in the interests of safety of children enrolled with such institution”. Notice, security and retention duties still apply.
• Enrolled students and visiting children differ. Early-leave records of your own students can fall within that exemption; confirm the reading with counsel. A visiting sibling at annual day does not. Record the adult and how many children are with them, a child’s name only with a parent’s or guardian’s consent, and never ask a child for ID.
• Parents and authorised adults get a notice: standalone, in clear and plain language, with “an itemised description” of the data and purpose (Rule 3), in English or any of the 22 Eighth Schedule languages if they choose (section 5(3)). We advise English, Hindi and the city’s main language, others on request.
• Retention. Keep the visit record and its logs for one year: Rule 8(3) sets that minimum “for the purposes as specified in the Seventh Schedule”, and Cyril Amarchand Mangaldas and Lakshmikumaran & Sridharan read it as binding every data fiduciary. Keep visitors’ photos and mobile numbers for days, as a written decision your DPO and counsel sign off. Section 8(7) gives way where another law requires longer. CCTV is personal data too: one fixed period, a named list of who may view it, and a log of each export.
• Penalties. The Schedule’s maximum for breaching the section 9 children’s duties is ₹200 crore; the Data Protection Board sizes each penalty under section 33(2).

More in our guide to the DPDP Act and your visitor register.

College and university campuses: what changes

Most college students are adults, so the gate protects residents and a workplace rather than children in custody.

• The UGC sets the baseline. Its 2015 Guidelines on Safety of Students On and Off Campuses ask for no more than three entry points to student housing, each “manned by at least three security guards”, a woman security officer among the staff there, CCTV, identity verification and a “register of unknown entrants/visitors with their identity proofs and contact details”. Bags may be examined and ID cards worn on campus.
• Harassment by outsiders is the institution’s concern. The UGC’s 2015 sexual harassment regulations for higher education (notified 2 May 2016) cover “third party harassment” by an outsider (regulation 2(m)) and call for trained security with a good balance of women staff (regulation 3.2(10)).
• Some students are children. First-year students may be under 18. POCSO, including the section 19 reporting duty, protects them as it does schoolchildren, and processing their data, hostel entry logs included, needs a parent’s or guardian’s consent unless the educational institution exemption applies. Flag under-18 residents for the warden.

Hostel guests are invited by a named resident for set hours, with the warden approving overnight stays; food deliveries stop at a drop point; departments pre-register recruiters. On fest day, participants register through their own colleges, walk-ins use a separate gate, hostels close to visitors, and at close the team reconciles who checked in and has not checked out.

Recommended set-up for a school or campus

1. Name the owner. The principal or registrar is accountable, the administrator runs the gate, and the School Safety Committee reviews gate records quarterly.
2. Use one visitor gate in teaching hours. Lock the main gate once students and staff are in; visitors use the wicket door; deliveries stop at the gate.
3. Define visitor types as in Template 3; colleges add hostel guest, event visitor and recruiter.
4. Set approvals with backups: host teacher, section head, front office. No approval, no entry. Children leave only with a listed adult or one named in a recorded one-time authorisation.
5. Use ID verification where policy calls for it: contractors, unlisted pick-up adults, unknown entrants at colleges. Record who verified, not the number. Never ask children.
6. Issue passes that expire: a same-day visitor pass unlike staff and student IDs, and a separate early-leave pass.
7. Induct and escort contractors: code of conduct before arrival, escort in student areas, work outside class hours where possible. Daily agency staff come from authorised agencies and are police verified.
8. Count visitors in every drill. In a real alarm, report anyone unaccounted for to the fire service at once; sweep only if safe; only the fire officer in charge clears re-entry. See our guide to evacuation roll call and fire drills.
9. Write retention down: visit records and logs one year; visitor photos and mobile numbers days; CCTV at least 15 days for CBSE schools and one month in Maharashtra; pick-up authorisations erased when replaced; each erasure recorded.
10. Connect what you have: the staff list so teachers can host, one pick-up list the front office can reach, existing boom barriers and hostel card readers.

Common mistakes at school and college gates

• An open register at the gate, where every visitor reads parents’ names, numbers and which child left with whom.
• Guards photographing IDs on personal phones, or WhatsApp groups holding children’s photos you cannot erase.
• A pick-up list never updated after admission, and custody orders that never reach the gate (see our guide to visitor watchlists).
• Calling back on the number the adult gives instead of the one on file.
• Contractors unescorted in class hours because “they come every month”.
• CCTV with no fixed period: gone before 15 days, or kept for years with nobody deciding who may see it.

Where Orb fits

Orb, our visitor management system, is built for the DPDP Act and for gates that see parents, contractors and guests every day.

Questions buyers ask