Free Visitor Logbook Template (GDPR-Compliant, UK)

The traditional open visitor book, where every visitor can read the last visitor's details, is one of the most common small-business GDPR breaches. This template fixes that: a compliant register, the privacy notice to display at reception, and a contractor sign-in with induction confirmation.

⬇ Download PDF (print-ready)⬇ Download Excel (editable)

Free for use within your organisation. No sign-up required. If it saves you time, a link back to this page is always appreciated.

What's in the template

• Visitor register: name, company, host, times in/out, badge number
• Printed privacy notice: why you collect the data, 30-day retention, deletion rights
• Contractor sign-in: permit/RAMS reference and induction confirmation

How to use it

Display the privacy notice at the signing-in point, keep completed sheets for a fixed period (the template assumes 30 days) and destroy them on schedule. In an evacuation, the register is your roll call. Take it to the assembly point.

Who must keep this record

If you ask visitors to write down a name, an employer or a vehicle registration, you are processing personal data and you are the controller of it under the UK GDPR. That applies to a one-room office as much as a factory gatehouse. Two duties land on the same sheet: protecting the details you collect, and knowing who is in the building if you have to get everyone out.

• Reception and gatehouse staff running any sign-in point
• Sites signing in contractors against a permit or RAMS reference
• Anyone whose evacuation roll call depends on the register being accurate

How long to keep it

Set a fixed period, put it on the privacy notice and delete on schedule. The UK GDPR principle is storage limitation: personal data is kept no longer than you need it for the purpose you collected it for. Our template assumes 30 days, which suits most sites, but the number is yours to set and justify. If you hold sheets longer, for an open investigation say, write down why. What you should not do is stack completed books in a cupboard indefinitely.

What a completed entry looks like

A completed row, and the notice above it, should look like this.

• Visitor: J. Okafor, Northgate Surveying, visiting M. Price
• Times: in 09:12, out 11:40, signed out by the visitor rather than filled in later by reception
• Badge: V-27, handed back at sign-out (an unreturned badge is a loose end, chase it)
• Contractor line: permit or RAMS reference PTW-2026-118, induction confirmed before they go past reception
• Privacy notice: displayed at the signing-in point, stating what you collect, why, how long you keep it (30 days in the template) and how to ask for deletion

FAQs

Is an open visitor book really a data protection problem?

If every visitor can read the entries above theirs, you are showing one visitor's details to everyone who signs in after them, and none of those people have any reason to see them. That is the most common failure with a traditional book. Use a layout where a completed entry is not visible to the next person signing in.

Do we need a privacy notice at reception?

Yes. People should be told what you are collecting and why at the point they hand it over, not afterwards. The template includes a printable notice covering the purpose, the retention period and deletion rights. Display it at the signing-in point rather than filing it away.

Can a visitor ask us to delete their entry?

They can ask, so have a way of handling it rather than a shrug at the desk. Log the request, find the entry and respond. If you are holding the record for a defined reason, an incident under investigation for example, say so rather than deleting quietly.

What do we do with the register in an evacuation?

Take it to the assembly point and use it as the roll call for everyone who is not staff. That is why the sign-out column matters as much as sign-in: a visitor who left at 11:40 and is not at the muster point should not send anyone back into the building.

Sources

ico.org.ukICO: UK GDPR guidancegov.ukWorkplace fire safety: your responsibilities