How long can you keep visitor sign-in records under UK GDPR?

Quick answer. There is no fixed retention period for visitor records in UK GDPR. Article 5(1)(e) requires personal data to be kept "for no longer than is necessary" for its purpose, and Article 5(2) makes you responsible for showing that. The ICO confirms the law "does not set specific time limits". Choose a period tied to why you keep the log (security, evacuation, incident investigation, any sector rule that applies), record it in a retention schedule, and delete records automatically when it ends.

Reviewed 2026-10-21. Not legal advice. Several ICO guidance pages are under review following the Data (Use and Access) Act 2025, so check the current versions.

What the law says

The rule is the storage limitation principle in Article 5(1)(e) of the UK GDPR. Personal data must be "kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed." Longer storage is allowed only for archiving in the public interest, research or statistics, with safeguards. A reception log does not fall into any of those.

Article 5(2) adds the accountability principle: the controller must "be able to demonstrate compliance". In practice that means a written reason for the period you chose and evidence that deletion happens.

The ICO's guidance on storage limitation fills in the detail:

• The UK GDPR "does not set specific time limits for different types of data." You set the period and justify it.
• You should have a retention policy with standard periods "wherever possible". Small organizations with occasional, low-risk processing may not need one written down, but must still review and delete.
• Taking records offline is not deletion. The aim, in the ICO's words, is to "put the data beyond use."

The lawful basis for a visitor log

Retention follows purpose. Most organizations keep a visitor log under legitimate interests (Article 6(1)(f)): knowing who is in the building for security, being able to account for people if the building is evacuated, and being able to investigate an incident afterwards.

The ICO describes legitimate interests as a three-part test: a legitimate purpose, processing that is necessary for it, and a balance against the visitor's interests. Write that assessment down. It is also where the retention period gets its reasoning: if the purpose is looking into incidents, keep the record as long as incidents usually take to surface, and no longer.

Consent is rarely the right basis when signing in is a condition of entry, because the visitor has no real choice. If your sign-in asks health questions (symptoms, for example), those answers are special category data under Article 9 and need a separate condition.

Visitors must be told how long you keep their data, or the criteria you use to decide (Article 13(2)(a)). A short notice on the sign-in screen, linking to your full privacy notice, covers it.

Setting and documenting a retention period

1. List what you hold and where it lives.
2. Name the purpose of each item. A signed NDA has a different purpose from a fire roll call.
3. Pick a period and write down why. Typical reasons: how long incidents take to be reported, a sector rule, or a possible claim. In England and Wales the limitation period for personal injury claims is generally three years from the injury or from the date of knowledge (Limitation Act 1980, section 11).
4. Put it in your retention schedule, and in your record of processing activities if you keep one under Article 30.
5. Apply it automatically. Deletion that depends on someone remembering gets missed.
6. Keep a route for exceptions. If a specific incident is under investigation, hold those records until it closes and note why.
7. Review it once a year, and when your purpose changes.

It is not only the sign-in log

Personal data from a visit ends up in other places too, and each needs a period:

• Signatures. A signature on a visitor agreement or NDA is personal data. If the NDA has a term that runs past your log period, keep the signed copy for that term and say so in the schedule.
• Email addresses and phone numbers collected for pre-registration and invitations.
• Host notification emails sitting in staff mailboxes. Your visitor system cannot delete those; your email retention policy has to.
• Exports and printouts. A CSV downloaded for an audit and left on a laptop is outside any automatic purge.
• Audit logs of who changed what. Decide their period separately.
• CCTV at reception is a separate system with its own retention period. The ICO's video surveillance guidance says that period should not be set by how much the recorder can store.

Subject access and erasure requests

Access (Article 15). A visitor can ask for a copy of what you hold about them. The ICO says you must respond without undue delay and within one month, extendable by two further months if the request is complex or one of several from the same person (tell them within the first month). The clock starts once you have any proof of identity you needed, and pauses if you ask for clarification of what they want. You are expected to make a reasonable and proportionate search, and in most cases you cannot charge a fee.

Erasure (Article 17). The right is not absolute. It applies, among other cases, when the data is no longer needed for its purpose, or when the visitor objects to processing based on legitimate interests and you have no overriding grounds. You can refuse where you need the data for legal claims, for example a record tied to a reported accident. You must answer within one month either way, with reasons if you refuse.

A short, enforced retention period makes both requests smaller.

A worked example policy

Example only. This is an illustration for a single office with a staffed reception. Your purposes, sector rules and risks may need different periods. It is not legal advice.

Add an owner, a review date and the lawful basis for each line.

How BeckonDesk handles this

Each BeckonDesk workspace has its own retention setting under Settings → Data retention: 30 or 90 days, 6 months, 1 or 2 years, a custom number of days, or keep forever (0 days, which turns automatic deletion off). The default is 365 days. Records past the window are deleted by a background job. That covers visit records, staff attendance, visitor profiles and signatures no longer linked to a visit, past pre-registrations, delivery records, notification logs, access events, roll-call marks, closed approvals and contractor visit records. Audit logs are not purged.

The kiosk shows your own privacy notice with a checkbox the visitor ticks before their details are stored. If you rely on legitimate interests, word that notice as information about what happens, not as a request for consent.

On the Privacy page, admins log access and erasure requests. An access request produces a JSON export of the visitor's data; an erasure redacts the visitor. Erasure does not yet reach every place a person can appear (pre-registrations and answers to custom fields, for example), so include those in your procedure. The visitor log, audit trail and a 30-day evidence pack export as CSV.

BeckonDesk is hosted on Microsoft Azure in the United States, so a UK organization using it transfers personal data outside the UK. Our Data Processing Agreement sets out how that transfer is covered. These settings help you apply a policy; they do not choose the policy for you or make you compliant.

Frequently asked

Is there a maximum period for keeping visitor logs in the UK?

No fixed one. UK GDPR Article 5(1)(e) says personal data must be kept no longer than necessary for its purpose, and the ICO confirms the law does not set time limits for particular types of data. You choose the period, write down why, and delete when it ends.

Do visitors have to consent to signing in?

Usually consent is not the right basis, because signing in is a condition of entry. Most organizations rely on legitimate interests for security and safety, record a legitimate interests assessment, and tell visitors at sign-in how their data is used and how long it is kept.

Can a visitor ask you to delete their sign-in record?

Yes, under Article 17, but the right is not absolute. You must erase it if you no longer need it or if they object and you have no overriding grounds. You can refuse where you need the record for legal claims. Either way you must reply within one month.

Related reading

• How long do you have to keep visitor logs? (US regimes)
• The paper sign-in sheet is a privacy problem
• Visitor sign-in kiosk
• Visitor pre-registration
• Security and data handling at BeckonDesk

Sources

• UK GDPR Article 5 (principles, including 5(1)(e) storage limitation and 5(2) accountability), legislation.gov.uk
• UK GDPR Article 6, Article 9, Article 13, Article 15, Article 17 and Article 30, legislation.gov.uk
• ICO: Principle (e): Storage limitation
• ICO: Legitimate interests
• ICO: Right of access, what should we consider when responding to a request?
• ICO: Right to erasure
• ICO: Video surveillance (including guidance for organisations using CCTV)
• Limitation Act 1980, section 11, legislation.gov.uk

Set a retention period once. Let it run.

BeckonDesk deletes visit records when your workspace's retention window ends. Included at $79 per location per month, with a 30-day free trial and no card.