Visitor management is one of the last analogue processes in German companies and at the same time one of the most frequently overlooked data protection risks. Paper visitor books, handwritten entries and manual coordination at reception violate the GDPR in many cases. This article shows what companies specifically need to consider.
Why visitor management is a GDPR issue
As soon as a visitor enters their name, company and time of visit in a list, personal data is processed. This triggers GDPR obligations, regardless of whether the list is on paper or digital.
The most common violations in practice:
- Visitor lists are left out in the open and can be seen by subsequent visitors
- Data is not deleted on time
- There is no data processing agreement with the software provider
- Visitors are not informed about the data processing
The four GDPR obligations at a glance
Data processing agreement (DPA): If an external service provider is used to register visitors, a DPA under Art. 28 GDPR is mandatory.
Data minimisation: Only the data necessary for the purpose of the visit may be collected: name, company, time, host.
Transparency: Visitors must be actively informed about the data processing at check-in.
Data deletion: Visit data must be deleted after a defined period. Automatic deletion periods are the only practical way.
What this means for choosing software
GDPR compliant visitor management software must meet the following requirements:
- Data stored exclusively in Germany or the EU, no US cloud provider
- Standard data processing agreement under Art. 28 GDPR
- Automatic data deletion after a configurable period
- Transparent information for visitors at check-in
- Restrictable level of analysis for works agreements
Visitor management and the works council
In companies with a works council, the introduction of visitor management software is subject to co-determination under Section 87(1) No. 6 of the German Works Constitution Act (BetrVG). The process needs to be structured. Works councils typically require that visit data is not analysed individually at employee level and that access rights are clearly defined.
Conclusion
GDPR compliant visitor management is not a complex project. It is a question of the right software and the right process. What matters: data storage in the EU, automatic deletion periods, a standard DPA and a setup the works council can agree to.
Further reading
Frequently asked questions
In most cases, no. In practice, paper visitor books hardly meet the requirements for data minimisation, data deletion and transparency reliably. Personal data is left open to view and is rarely deleted on time. Both violate the GDPR.
Yes. As soon as an external service provider processes personal data, a DPA under Art. 28 GDPR is mandatory. This also applies to software as a service solutions. Seatti provides one as standard, without renegotiation.
There is no statutory period. The retention period must be appropriate to the purpose. In practice, 30 to 90 days after the visit is common. Seatti enables configurable deletion periods with automatic execution.
Yes, if the system can potentially record the behaviour or performance of employees, Section 87(1) No. 6 BetrVG applies. Seatti can be configured so that no individual analysis takes place at employee level. This makes it straightforward to conclude a works agreement.
Following the principle of data minimisation, only the data necessary for the purpose of the visit: name, company, time and host. No further information. Seatti collects only these mandatory fields.
Yes. The GDPR requires active information at check-in: who processes the data, for what purpose and how long it is stored. Seatti provides this transparency information as standard in the digital check-in process.
