Visitor management systems – frequently asked questions (FAQ) 2025

A visitor management system is a digital solution for receiving, registering and managing visitors – everything from pre-registration and QR check-in to printing visitor badges, notifying the host and keeping a traceable visitor log. The aim is faster check-in, higher security and better compliance than manual paper lists.

Three common reasons: 1) Security (knowing who is on the premises at any given time), 2) Efficiency (shorter queues and fewer administrative steps), 3) Compliance (GDPR-compliant handling of personal data, the duty to inform and data retention).

The host can pre-register the visitor, who receives an email with a QR code. On arrival, the visitor scans the code at a self-service kiosk (tablet or touch screen) or at reception. The system notifies the host immediately and can print a badge. Visitors can also register on the spot without pre-registration.

Usually a touch-screen computer, possibly with a stand, a label printer and a QR reader is enough. Several devices can be connected to the same account if you have more than one entrance.

Yes – provided you meet the requirements of the GDPR: a legal basis (often legitimate interest or contract), the duty to inform, data minimisation, the rights of access, rectification and erasure, and a retention policy. In Sweden, the supplementary rules in the Data Protection Act (2018:218) and the guidance of the Swedish Authority for Privacy Protection (IMY) also apply.

Typically name, contact details, host or department, purpose and time of the visit. Keep only what is needed, and for as short a time as possible in line with your documented retention policy. Inform the visitor and respect their rights, including the right of access, rectification, restriction and erasure.

It is possible, but camera surveillance is a particular intrusion into privacy and requires strong grounds as well as a documented balancing of interests in line with IMY’s guidance. Monitoring employees is subject to especially high requirements.

Yes, but the assessment matters: data processors must meet the GDPR and the relevant Swedish requirements, and sensitive data (such as health data) is subject to specific confidentiality requirements and transfer assessments. We can help you carry out a DPIA and put appropriate safeguards in place.

Not necessarily. The system usually complements reception by automating repetitive steps (pre-registration, printing, notifications), while staff focus on service and security.

The price depends on the number of check-in points, users, modules (such as NDA signing, visitor badges and integrations) and the level of support. Some suppliers offer service agreements that include updates. Request a quote after a needs analysis.

Common integrations include Active Directory/Entra ID, access control systems, meeting booking, identity platforms, HR systems and security lists. For evacuations, the system can produce real-time lists of everyone who is checked in.

You get an up-to-date list of everyone who is checked in and out, for a quick roll call. There may also be SMS and email broadcasts and a muster-point function. (General industry support – combine it with your own crisis plan.)

Yes, digital signing and policy acknowledgement are common features. Link them to pre-registration for a smoother flow and better compliance.

Yes, modern systems offer multilingual interfaces and accessibility features (clear contrast, keyboard navigation and more). Also make sure there are easy-to-read alternatives and assistance available at reception.

Follow Swedish practice for cookies (ePrivacy and the GDPR): inform visitors, obtain consent where required and respect their choices.

They are risky, and in some cases a genuine security risk: harder to minimise, delete and control access to. A correctly configured digital system makes the duty to inform, handling of rights, logging and deletion easier in line with the GDPR and IMY’s guidance.

Typically: create an account, adapt the flow and set up a visitor kiosk. A basic installation is often quick; advanced integrations and policy work take longer.

• Carry out a lawfulness and balancing-of-interests assessment, plus a DPIA if needed.

• Sign data processing agreements and check sub-processors and transfers.

• Publish a clear privacy notice at check-in (duty to inform).

• Define a retention policy (time-based deletion).

• Test evacuation routines and train staff.
  The core requirements are set out in the GDPR/EU and IMY’s guidelines.