Moving off a paper book is the easy decision. The harder one is where the visitor data should live afterwards. Most visitor management systems are cloud platforms: every name, phone number and photograph is stored on the vendor's servers. That's convenient, but it isn't the only option, and it isn't free of consequences.
What "cloud" means for your visitor data
- A third party holds it. The vendor becomes your data processor, so you need a data processing agreement with them, and they may use sub-processors of their own.
- It may leave the UK. Many platforms host abroad. International transfers need safeguards, and they need to be in your records and your DPIA.
- It sits in a shared target. One multi-tenant database holding many organisations' visitor photos is more attractive to an attacker than one folder on one reception PC.
- Retention is often theirs, not yours. Check whether you can actually set how long photos and records are kept.
- The cost recurs. Cloud visitor platforms commonly charge per site per month, often with extra charges for photos, branding or volume.
What "local" means
A local visitor log writes each visitor's details to files on a device you control. With Visitor Book's Local tier, that's a dated CSV file and a photos folder in a folder you choose, on a Windows or Mac computer running Chrome or Edge.
- No processor for visitor data. We never see, store or process it, so there's no visitor-data processing agreement to put in place with us.
- Open files. It's a plain CSV you can open in Excel. No export request, no lock-in.
- No dependence on us. Sign-ins are written straight to your own folder, not to our servers.
- Retention you set. Choose how many days to keep photos and logs, separately, and older files are cleared automatically.
The trade-offs are real, and you should weigh them. The device's security is your responsibility. Choose an organisational, access-controlled folder, not someone's personal Dropbox or OneDrive. Backup is up to you; our optional SharePoint add-on backs up completed days to your own Microsoft 365. And because of how browsers work, Local doesn't run on iPads, Android tablets or Safari.
Questions to ask any visitor management vendor
- Where exactly is visitor data stored, and in which country?
- Is it in a database, and who at your company can access it?
- Can we set retention ourselves, separately for photos and records?
- Which sub-processors do you use?
- What happens to our data if we leave?
- Does the sign-in screen ask visitors to "consent"? (It shouldn't. See which lawful basis a visitor log should use.)
When cloud is the right answer
If you need tablets at reception, several entrances, or you don't have a suitable Windows or Mac device, a hosted system makes sense. Visitor Book's Cloud tier is hosted in the UK, stores visitor data as files rather than in a database, emails each day's log to you with photos removed, and deletes data on the retention schedule you choose. Compare the tiers side by side.
This article is general information, not legal advice. Your own DPO or adviser should confirm which setup suits your organisation.