Good Distribution Practice, 3.2
GDP visitor control for wholesale dealers: “Visitors should be accompanied”
The GDP guidelines mention visitors once. Section 3.2 says unauthorised access should be prevented, usually with an alarm and access control, and that visitors should be accompanied. This page quotes it, shows why a UK licence holder follows it, and says what a sign in at reception records and what stays with your people.
Sign in on a demonstration kiosk, then open the fire roll call on your phone. Do not enter real details: everything typed is deleted within the hour.
From £599 setup and £150 a month plus VAT, iPad and stand included. We are not the MHRA or a consultancy.
In Ireland or elsewhere in the EU? The installed kiosk on this page is sold in the UK. For EU sites: the same software on an iPad you already own, with the record kept in the EU, from €179 a month.
What the guidelines say
The visitor sentence, the lines around it, and the UK link
Section 3.2 has no must and no shall: its requirements say should. The stronger words on this page are about people and the licence: a wholesaler must designate a responsible person, and the MHRA’s notes say the licence holder shall comply with the guidelines.
GDP guidelines, 3.2 Premises
Visitors should be accompanied
Unauthorised access to all areas of the authorised premises should be prevented. Prevention measures would usually include a monitored intruder alarm system and appropriate access control. Visitors should be accompanied.
Three sentences, and the only place the guidelines mention visitors. Two say should and one says would. They ask for unauthorised access to be prevented, name an alarm and access control as the usual means, and ask for visitors to be accompanied. They do not mention a visitor log.
GDP guidelines, 3.2 Premises
Storage areas restricted
Medicinal products should be stored in segregated areas which are clearly marked and have access restricted to authorised personnel.
The same section, earlier. Who counts as authorised is the wholesaler’s decision, written into its own procedures.
GDP guidelines, 4.2 General
Documents kept five years
Documents should be retained for the period stated in national legislation but at least five years. Personal data should be deleted or anonymised as soon as their storage is no longer than necessary for the purpose of distribution activities.
Whether a visitor record is a GDP document is a question for your quality system. If it is, five years is longer than the kiosk keeps anything, and the FAQ below says what to do.
MHRA Guidance Note 6, Appendix 2
The UK link
The Regulations require that the licence holder shall: comply with the guidelines on Good Distribution Practice
From the MHRA’s notes for holders of a Wholesale Dealer’s Licence, WDA(H). The footnote to that line names these guidelines, 2013/C 343/01. GOV.UK’s licence page says the same in plain words: to qualify for a wholesale distribution licence, “you must comply with good distribution practice (GDP)”.
MHRA Guidance Note 6, 9.1
The Responsible Person
Regulation 45 of the Human Medicines Regulations 2012, as amended, requires that all licensed wholesale dealers should have at their disposal at least one person available as the Responsible Person (RP).
The guidelines say the same in 2.2: “The wholesale distributor must designate a person as responsible person.” Guidance Note 6 lists knowledge of the guidelines on Good Distribution Practice among what the RP should have.
Quoted from the Guidelines of 5 November 2013 on Good Distribution Practice of medicinal products for human use (2013/C 343/01), Official Journal C 343 of 23 November 2013, and from MHRA Guidance Note 6, both read on 27 September 2026. The guidelines write “responsible person”; the MHRA writes “Responsible Person (RP)”. This page covers medicines for human use only.
At reception
What 3.2 says, what the record shows, what stays with you
| What 3.2 says | What the record shows | What stays with you |
|---|---|---|
| “Visitors should be accompanied.” | The host named on every visit. When the visitor signs in, your site’s Teams or Slack channel is told their name, company and who they are visiting. | The accompanying itself. The kiosk cannot see whether the host stayed with them. |
| “Unauthorised access to all areas of the authorised premises should be prevented.” | Who was let in at reception, when, and the declaration they accepted, with the exact wording kept. | Preventing access. The kiosk opens no doors and stops nobody walking past it. |
| “a monitored intruder alarm system and appropriate access control” | Nothing. The kiosk is neither. | Your alarm and your access control. |
| “access restricted to authorised personnel” | Nothing about which areas a visitor went into. | Deciding who is authorised, and keeping everyone else out of the storage areas. |
| Who was on the premises on a given day | Name, company, who they visited, time in and time out, filtered by date and exported. A visitor who forgets to sign out is signed out automatically at 23:59 UTC, so their record shows that time, not a real exit. | Whether that record is a GDP document, and how long you keep it. |
Drivers are the visitors a wholesaler sees most. A courier who only drops a parcel is logged as a delivery and is not signed in; a driver who goes further than goods in should sign in like any other visitor.
The delivery drop-off, step by stepVisitor and driver sign in for warehousesTAPA FSR, for a high value storeGMP, for the manufacturing sidePharmaceutical and life sciences sites
See it work
A sign in and a fire roll call, in 100 seconds
A visitor signs in on the iPad. The alarm goes. The marshal opens the live list on their phone at the muster point and reads off who is still on site.
The player loads from YouTube only when you press play. Nothing is sent to Google before that. What happens when you do.
Before you ask
The questions Responsible Persons ask
Does GDP require a visitor log?
The EU GDP guidelines do not mention one. Section 3.2 says unauthorised access to the premises should be prevented, that prevention would usually include a monitored intruder alarm and appropriate access control, and that visitors should be accompanied. A record of who came in, and who they were with, is one way to show the last sentence was followed.
Do the EU GDP guidelines apply to a UK wholesaler?
The MHRA’s Guidance Note 6, for holders of a Wholesale Dealer’s Licence, says the Regulations require the licence holder to comply with the guidelines on Good Distribution Practice, and its footnote names these guidelines, 2013/C 343/01. GOV.UK’s licence page says that to qualify for a wholesale distribution licence you must comply with good distribution practice. Check the current MHRA guidance for your own licence.
Who is responsible for visitor control under GDP?
The guidelines put the premises requirements on the wholesale distributor. The Responsible Person named on the licence should know the guidelines, according to Guidance Note 6. Who owns the visitor procedure in your business is your decision.
How long should visitor records be kept?
The guidelines say documents should be retained for the period in national legislation but at least five years, and that personal data should be deleted or anonymised once it is no longer necessary for distribution activities. Whether your visitor record is one of those documents is for your quality system to decide. The kiosk keeps records for the period you set, up to two years; if you need longer, export the record and keep it in your document system.
Does the kiosk stop unauthorised people getting in?
No. It records who signed in at reception, who they came to see, when, and the declaration they accepted. Preventing access is your alarm, your access control and your people, as 3.2 says.
Being straight with you
What this does not do
- We are not the MHRA, an inspector or a GDP consultancy, and this is general information about published guidelines, not regulatory advice.
- The kiosk does not make a wholesaler meet GDP. It keeps a record of who came in, who they were with and what they accepted, and the inspector decides what that record is worth.
- It is not an intruder alarm or an access control system, and it opens no doors.
- It keeps records for up to two years. If your quality system treats the visitor record as a GDP document, export it and keep it in your document system for as long as that asks.
- A courier who only uses the delivery drop-off is logged as a delivery, not signed in, and is not on the visitor record or the roll call.
Sources
Check any of this yourself
- Guidelines of 5 November 2013 on Good Distribution Practice of medicinal products for human use (2013/C 343/01)Official Journal C 343, 23 November 2013. Sections 2.2, 3.2 and 4.2 are quoted from the EUR-Lex text, read 27 September 2026.
- MHRA Guidance Note 6, notes for holders of a Wholesale Dealer’s Licence (WDA(H))Fifth edition 2022, section 9 amended 2023. Section 9.1 (page 10) and Appendix 2 (page 23) are quoted. Read 27 September 2026.
- GOV.UK, Apply for manufacturer or wholesaler of medicines licencesThe MHRA’s licence page, updated 12 September 2025, which links Guidance Note 6. Read 27 September 2026.
General information about published guidelines, not regulatory advice. The MHRA has no connection with Noon Elite.
Also asked of sites like yours
The other things somebody may ask you to evidence
Each of these is a page about one standard, one duty or one visitor, written the same way as this one: what it actually asks for, what an iPad at reception records towards it, and where it does not help.
Every standard on one page: the clause numbers, the version and the date each was read, on one printable table.
- GDPR and the visitor book
- CMMC physical security
- List X visitor control
- ITAR visitor log
- Def Stan 05-138 visitor access
- ISO 27001 visitor access
- PCI DSS visitor log
- AEO visitor access control
- CTPAT visitor log
- TISAX visitor management
- TAPA FSR visitor log
- BRCGS visitor control
- BRCGS packaging visitor control
- BRCGS storage and distribution visitors
- BRCGS unannounced audit
- Visitor control non-conformity
- SALSA visitor control
- IFS Food visitor hygiene
- UFAS feed mill visitor control
- GMP visitors in production areas
- Fire roll call
- Contractor management
- Construction work in occupied premises
- HSE inspection records
- ISO 45001 contractor control
- Visitor NDA sign in
- Visitor record retention
- What a visitor log must contain
- Standards calendar
- Sign in sheet template
- Visitor health questionnaire template
- Contractor induction template
- Permit to work template
- Hot work permit template
- Fire drill record template
Advise sites on this standard? Referral terms are on one page.
Next step
Tell us how visitors get into your warehouse today
Fifteen minutes on the phone. Who comes through the door, who goes with them, and what your last GDP inspection said about it. We will tell you straight whether a kiosk helps.
Book a 15 minute callNo site visit needed and nothing to install. If it is not a fit we will say so on the call.
Would rather email? [email protected]
Not the person who signs it off? Send them the one page business case