How little you need to collect
Visitor books ask for a lot and almost none of it is used for anything, which is a reasonable definition of data you should not be collecting.
Key takeaways
- Name, host, arrival time. Everything else needs a stated reason.
- The paper book’s worst feature is showing everybody the previous entries.
- A photograph of every visitor is a biometric dataset with no purpose attached.
- Thirty days is a generous retention period for a roll call record.
- Ask for a mobile number only if you will use it, and say what for.
Field by field
| Field | Used for what? | Verdict |
|---|---|---|
| Name | The roll call | Necessary |
| Host | The roll call, and letting them know | Necessary |
| Arrival time | Confidence in the roll call | Necessary |
| Company | Nothing, usually | Only if you have a reason |
| Car registration | Parking, if you manage it | Only where parking is managed |
| Purpose of visit | Nothing | Drop it |
| Signature | A ritual | Drop it |
| Photograph | Identifying a visitor to staff | Rarely justified; see below |
The middle rows are the interesting ones because they are collected almost universally and used almost never. Purpose of visit in particular is a field that people fill in with a single word and which nobody has ever read.
The test for any field is straightforward: name the situation in which somebody looks at it. If the answer takes more than a moment to construct, the field should not exist.
What the paper book discloses
- Compute
- Management
- Analytics
- Front-end & mobile
- People
This is worth being explicit about because it is often the first genuine benefit of replacing the book, ahead of anything to do with the roll call. Who is meeting whom is frequently commercially sensitive and a shared page publishes it to everybody who walks in.
Photographs
- App integration
- Machine learning
- Security & identity
- Management
- Front-end & mobile
The distinction that matters
A photograph printed on a temporary badge and deleted when the visitor leaves has a clear purpose and a short life. A stored photograph of every visitor, retained and searchable, is a different thing with different obligations, and facial matching is different again and involves special category data in most regimes.
Most buildings that ask for visitor photographs want the first one and end up building the second by default, because deletion is the step that gets left out.
Retention
The roll call needs today. An incident investigation might need last week. Almost nothing needs last year, and a visitor log going back several years is a list of who met whom that somebody will eventually ask about.
Thirty days is generous and defensible for most buildings, with automatic deletion rather than a policy somebody is supposed to enact. Where a longer period is genuinely required — some regulated environments — it should be a stated period with a stated reason, not an absence of deletion.
Mobile numbers
Useful if you are going to use them: an evacuation message, a check-out prompt, a notification that their host is on their way down. Not useful as a field that exists because the form template had one.
If it is collected, the screen should say what it is for in six words. That both justifies it and reminds whoever configured the system that it needs a justification.
Next: the part that does not work.
All posts