Visitor records are personal data. They hold names, times, sometimes a photo or an identity document, and a pattern of who came and went. That makes "how long do we keep them?" a real question, not an afterthought, because every record you hold is one you are responsible for.
Keep them only as long as you have a reason to
The guiding principle for any personal data is to keep it while you have a use for it, and not longer. For visitor records, the common reasons are a safety and evacuation history, an audit trail for incidents, and answering a later question about who was on site. Once a record is old enough that none of those apply, holding it stops being an asset and starts being a liability.
Set a retention period, and make it automatic
Pick a period that matches why you keep the records, write it down, and apply it to everyone. A fixed window, such as one or two years, is easy to explain and easy to enforce. The important part is that it happens on its own. A retention rule that depends on someone remembering to delete old data is a rule that quietly fails.
Store them so old data cannot be misused
Retention is only half the job. While you hold visitor records, store them so a copy cannot leak or be read by the wrong person:
- Limit who can read the history. Access to past visits should sit with administrators, not with everyone at the desk.
- Never store an identity number in the clear. A one-way hash lets you match a returning visitor without keeping the number itself, so even full database access cannot read it back.
- Keep the trail append-only. A history that can only be added to cannot be quietly edited to hide what happened.
A note on what this guide is not
This is general guidance, not legal advice. Data-protection law varies by country and by the kind of site you run, and a clinic, a school and a warehouse may each sit under different rules. Check the requirements that apply to you, and treat the points above as a floor rather than a ceiling.
How Entry Keep handles it
Entry Keep is built on the assumption that visitor records are sensitive. Identity-document numbers are stored only as a one-way hash, access to the history is scoped to administrators, and the audit trail is append-only. The Basic plan keeps records for two years; a dedicated deployment can set its own period. See how Entry Keep handles visitor data, or how it works for clinics and offices.