Visitor register format: what to record, and what to leave out

Visitor register format: the columns we recommend

Many downloadable formats ask for full address, ID proof number, a signature and even body temperature. We recommend three groups of columns instead.

Copy this header row into row 1 of a register or spreadsheet; the second row is an example to delete.

Essential columns

Only if your policy needs it

Do not collect

What security and audits actually need from a visitor log

A visitor log answers five questions: who came, when they came and left, whom they visited, who approved it, and why. Security standards and their auditors ask for much the same.

• PCI DSS v4.0.1, requirement 9.3.4, reads: “Visitor logs are used to maintain a physical record of visitor activity both within the facility and within sensitive areas, including:” the visitor’s name and organisation, the date and time of the visit, and the person who authorised access. Logs are kept at least three months unless law restricts it. Version 4.0.1 changed “a visitor log” to “visitor logs” (PCI SSC Summary of Changes).
• ISO/IEC 27001:2022, Annex A 7.2 (“Physical entry”), expects entry controls for secure areas. Auditors typically look for sign-in and sign-out records with name, host, purpose and times.

Neither asks for an ID number, an address or a signature. The column most often blank in registers we review is time out, and without it a fire warden has no headcount.

Why fewer columns is safer under the DPDP Act

The DPDP Act 2023 covers personal data collected digitally, or digitised later (section 3), so a spreadsheet is in scope, and so is a logbook once someone photographs a page. For the full picture, see our guide to the DPDP Act and your visitor register. Four duties shape the format.

• Purpose. Consent must be “limited to such personal data as is necessary” for the specified purpose (section 6(1)). An address or an ID number is rarely necessary to let someone in.
• Notice. Before collecting, tell the visitor what you collect and why (section 5(1)), with “an itemised description” of the data (Rule 3), so every column becomes a line in that notice. The visitor may choose English or any of the 22 Eighth Schedule languages (section 5(3)); we advise English, Hindi and the city’s main language at the door, and any other on request.
• Retention. Erase data once the purpose is served (section 8(7)), subject to the one-year minimum in Rule 8(3) explained below.
• Security. Take reasonable security safeguards (section 8(5)), including access control and access logs (Rule 6(1)). Failing this duty carries a maximum penalty of ₹250 crore (Schedule to the Act).

Most duties under the Rules apply from 13 May 2027, eighteen months after publication (Rule 1(4)); some firms, including Cyril Amarchand Mangaldas, count from the next day and give 14 May 2027. A proposal to shorten that timeline was floated in January 2026; as of 12 October 2026 no change had been notified (S.S. Rana & Co.). A security agency supplying your guards is usually your data processor, so you need a valid contract with it (section 8(2)) and remain responsible for what it does (section 8(1)).

Common mistakes in Indian visitor registers

• Collecting ID numbers or photocopying ID cards by default. A drawer of ID copies is a fraudster’s best find at your gate. Verify by sight where policy requires it and record “verified, by whom”.
• Open registers. A register book on the desk lets every visitor read the names, companies and mobile numbers of everyone above them. If you keep a book, have the guard write each entry and keep mobile numbers where only the desk can see them.
• Signatures as “consent”. Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action (section 6(1)) after a notice (section 5(1)). A signature does not show what the person was told or what they agreed to.
• Guards photographing pages on WhatsApp. A shift-end photo puts the register on a personal phone, in a chat you cannot audit or erase, and a lost phone can become a reportable breach.

Visitor register formats for offices, factory gates, schools and societies

Start from the essential columns and add only what the site needs.

Office reception visitor register

Essential columns plus pass number, and a photo only for areas that need it. In a multi-tenant building the host column names the tenant and floor. Record interview candidates as “candidate” and keep CV details out.

Factory gate entry register format

Keep people, vehicles and material separate.

• People: essential columns, plus contractor company, induction done, and ID verified where policy calls for it.
• Vehicles: vehicle number, transporter, driver’s name, times in and out.
• Material: in or out, returnable or not, and the gate pass or challan number, with goods described on the gate pass.

Daily contract workers are not visitors; manage them through contractor and labour records.

School and campus visitor register

Match pick-up adults against the authorised list. Where state or board safety directions require visitors to show ID, record “ID verified, by whom” and leave the number out. Do not ask visiting children for ID. A child is anyone under 18 (section 2(f)), and a child’s data needs verifiable consent of the parent or lawful guardian (section 9(1)). Record the accompanying adult and how many children are with them, and a child’s name only with that consent. The exemption in Rule 12 and Part A of the Fourth Schedule covers only an institution’s tracking and behavioural monitoring for its educational activities or the safety of its enrolled children, so it does not reach visiting children.

Residential society visitor register

Flat number as host, visitor name, visitor type (guest, delivery, service), approved by (the resident), time in and out, and vehicle number only if the visitor parks inside. Delivery riders need company, flat and time, and no mobile number. Domestic staff and drivers belong on a regular-entrant list. The society decides how this data is used, so it is the data fiduciary.

Visitor register format in Excel or Google Sheets

A spreadsheet beats an open register book if set up properly. Paste the header row from the top of this guide into row 1. Keep mobile numbers, if needed, in a separate file only the desk supervisor can open, linked by entry number and erased sooner.

• Use drop-downs (data validation) for visitor type, purpose and host.
• Protect the sheet, but do not rely on it. Microsoft says worksheet protection “isn’t intended as a security feature”; Google says sheet protection “shouldn’t be used as a security measure”.
• Restrict sharing to named accounts, never “anyone with the link”, and turn off download, print and copy for viewers.
• Log access, and check how long the log lasts. Microsoft 365 logs opens of SharePoint and OneDrive files as “FileAccessed” (a repeat open by the same user within five minutes is not logged again). Audit (Standard) keeps records for 180 days; Audit (Premium), a separate licence, keeps them for a year. Google Workspace’s Admin console Drive log records views, though most events are logged only for files owned by users on supported editions, and keeps them for six months. A file’s Activity dashboard is not an access log, because users can hide their views. Rule 6(1)(e) asks for a year of logs, so export shorter logs monthly. A guard’s personal account gives you none of this, and Rule 6(1)(c) expects access logs.
• Delete on schedule. Start a new file each month. When every entry is past its erase-by date, delete the file, empty the trash or recycle bin (in SharePoint, the second-stage bin too), and check no backup or retention policy keeps a copy. Deleting rows in a long-running sheet leaves them in version history.
• Keep an erasure log: which file, when, by whom, with no visitor details in it.

How long to keep visitor register entries

• Erase when the purpose is served or consent is withdrawn, whichever is earlier (section 8(7)). Section 8(7) gives way to retention another law requires, so Rule 8(3) governs the first year.
• Keep personal data, associated traffic data and processing logs for at least one year from processing, “for the purposes as specified in the Seventh Schedule”, then erase them unless another law requires longer (Rule 8(3), from 13 May 2027). Cyril Amarchand Mangaldas and Lakshmikumaran & Sridharan read this as applying to every data fiduciary.
• PCI DSS 9.3.4 sets a three-month floor; Rule 8(3) is the longer one in India.

How the one-year minimum sits with an erasure request, or with a short-lived purpose such as a photo used only at the gate, has not been tested before the Data Protection Board.

When a manual register stops being enough

A logbook or spreadsheet suits a small site with one entrance. It stops being enough when:

• you cannot say who is inside during an evacuation;
• several entrances or tenants share a lobby;
• an auditor asks who looked at visitor records;
• contractors must finish an induction or NDA before arriving;
• visitors wait while a guard phones around for a host;
• pages are photographed or typed up anyway, so you carry digital duties without digital controls.

Visitor register checklist

1. Remove the “do not collect” columns, and record “ID verified, by whom” instead of ID numbers.
2. Stop visitors reading earlier entries or mobile numbers.
3. Show an itemised notice first, in English, Hindi and your city’s main language, others on request.
4. Stop WhatsApp photos of pages and visitor lists.
5. Fill “time out” for every visit and test it in your next drill.
6. Keep the visit record and logs for one year, photos and mobile numbers for days, signed off by your DPO and counsel.
7. Restrict and log spreadsheet access, keep an erasure log, and put register rules in your security agency’s contract.

Where Orb fits

Orb, our visitor management system, is built around the format in this guide.

Questions buyers ask