Visitor record retention
How long to keep visitor records in the UK, by standard
For the quality, security or site manager with a cupboard of old visitor books, or a retention setting to choose. There is no single UK period. Each standard that touches reception says something different, and several say nothing. This page is one table: what each document says about how long, in its own words, with the clause number and the day it was read.
Sign in on a demonstration kiosk, then open the fire roll call on your phone. Do not enter real details: everything typed is deleted within the hour.
From £150 a month plus VAT, iPad and stand included. We are not auditors or data protection lawyers.
The schedule
What each document says about how long
Read at source on 26 September 2026. Where a document gives a period, the row quotes it. Where it gives none, the row says so, and where we could not read the document, the row says that instead of guessing. Each standard links to the page that quotes its visitor clauses in full.
| Standard | Clause | How long | What it says |
|---|---|---|---|
| PCI DSSv4.0.1, June 2024 | 9.3.4 | At least three months | “Retaining the log for at least three months, unless otherwise restricted by law.”Testing procedure 9.3.4.c has the assessor examine where the logs are stored to verify it. |
| TAPA FSRFSR 2026, effective 15 September 2026 | 4.1.5 (levels A, B and C) | At least 30 days | “All visitors to the office area registered and log maintained for minimum of 30 days.”The driver log in 4.3.1 has no period. Sites certified before 15 September 2026 know this as 7.3.5 of FSR 2023. |
| BRCGS Storage and DistributionIssue 4, SD401 self-assessment tool, version 4, 6 May 2021 | 3.1.3.1 | At least one year | “The record retention time period shall reflect product shelf life and any specific customer or legal requirements, but shall never be less than 1 year.”The rule for records in general. The visitor clause, 4.2.2, names no period of its own. |
| BRCGS Food SafetyIssue 9, F904a auditor checklist, version 1, 1 August 2022 | 3.3.2 | Shelf life plus 12 months, at least | “Records shall be retained for a defined period with consideration given to: any legal or customer requirements; the shelf life of the product. … At a minimum, records shall be retained for the shelf life of the product plus 12 months.”The rule for records in general. The visitor clause, 4.1.4, names no period of its own; whether your auditor holds the visitor record to 3.3.2 is theirs to say. |
| SALSAIssue 7, June 2026 | 3.5.2 | Shelf life plus one year, for records relating to the product | “All documents and completed records relating to the safety, legality and quality of products shall be genuine, legible, retained in good condition and stored securely for at least the shelf-life of the products plus one year.”No clause in Issue 7 gives a period for a visitor record by name. |
| BRCGS Packaging MaterialsIssue 7, P701a audit checklist, version 1, 28 October 2024 | 3.3.4 | No fixed period: the site documents its own | “The site shall document its period of retention for records which relate to the usable life of the product, the intended use, and respecting customer or legal requirements.”The visitor clause, 4.4.2, names no period of its own. |
| UK GDPRArticle 5, as in force on 26 September 2026 | 5(1)(e), storage limitation | No fixed period: no longer than necessary | Personal data shall be “kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed”.A ceiling, not a floor. You decide the period, write it down, and keep to it, on paper or on screen. |
| CTPATMinimum Security Criteria, Foreign Manufacturers, March 2020 | 10.2 | The criteria name no period | 10.2 requires the log and lists its fields; nothing in the document says how long it is kept. Set one in your own procedure and be ready to show it. |
| ITAR guidanceDDTC ITAR Compliance Program Guidelines | Element 3, section C | The guidelines name no period | They say a Technology Control Plan should address records of foreign-person visitors, and give no period for them. The five-year passage on page 25 lists licences, exemptions and exports, not visitor records. |
| List XSecurity Requirements for List X Contractors v10.0, April 2014; FSC Policy and Guidance v1.4, March 2024 | 46(h); 22 and 23 | Neither document names a period | 46(h) requires records of all foreign visitors, made available to Security Advisers on request. Your Security Adviser is the person to ask how long. |
| ISO/IEC 270022022 edition | 7.2, guidance to ISO/IEC 27001 Annex A 7.2 | Not read at source | ISO sells the document and we have not read it, so this row claims nothing about what it says. It is guidance to a control, not a 27001 requirement. Your own copy governs. |
| ISO 450012018 edition | None cited | Not read at source | ISO sells the standard and we have not read it, so this row claims nothing about what it says. Your own copy governs. |
A quotation is the document’s own words and keeps its spelling. The BRCGS wording is from BRCGS’s free audit checklists, which reproduce each requirement under its number; the Standards themselves are sold on the BRCGS Store. Clause numbers move between issues, so check the version against the one your auditor works from. This is general information, not legal or compliance advice.
On the kiosk
Retention is set once, and the deleting is done for you
You set one retention period for the company and every site in it, in whole days from one to 730, and a year applies if you leave it blank. Visits older than that are deleted automatically every night, permanently, and delivery drop-offs go on the same schedule. The privacy notice every visitor accepts on the kiosk states the number of days, so the period you choose is the period they are told.
The dashboard shows how far back your register goes, and asked for a week older than that it says the records are no longer held rather than showing an empty week. The longest the kiosk keeps a visit is two years. Where a rule above points further, a long-life product under BRCGS Food or SALSA for instance, export the register before the period ends and keep the file under your own schedule.
What stays with you
The decision, and the paper you already have
- Choosing the period is yours as controller. We process the records and delete them on the schedule you set.
- Writing the period into your retention policy, and giving the reason for it, is yours too.
- A paper book has no retention period of its own. It is kept until somebody throws it away.
The kiosk does not make a site compliant, certified or audit ready. It keeps a timestamped record for the period you set, and the auditor decides what that record is worth.
Before you ask
Four questions about keeping the record
How long should visitor records be kept in the UK?
There is no single UK period. UK GDPR Article 5(1)(e) says no longer than is necessary for the purpose, and sets no number. The minimums come from the standard you are held to: PCI DSS 9.3.4 at least three months, TAPA FSR 2026 4.1.5 at least 30 days, and BRCGS Storage and Distribution 3.1.3.1 never less than one year for records. BRCGS Food Safety 3.3.2 and SALSA 3.5.2 set shelf life plus a year for records. Read on 26 September 2026.
Is there a legal minimum for keeping a visitor book?
UK GDPR sets a principle that works as a maximum: no longer than necessary. The minimums in the table on this page come from standards a site chooses to be certified against or a customer asks it to meet, not from the law itself.
Can the kiosk keep visitor records for longer than two years?
No. The retention setting runs from one day to 730 days, a year if you leave it blank. If a rule you work to points past two years, for example shelf life plus a year on a long-life product, export the register before the period ends and keep the file under your own schedule.
What happens to a visit when the retention period ends?
It is deleted automatically overnight, permanently, along with delivery drop-offs past the same period. The stored copies of the wording visitors accepted are kept, because they hold no personal data. The dashboard then says that week is no longer held, rather than showing it as empty.
What the log must contain, by standardWhat changed in each standard, and whenPaper records in UK data breach reports: the ICO’s figures
Also asked of sites like yours
The other things somebody may ask you to evidence
Each of these is a page about one standard, one duty or one visitor, written the same way as this one: what it actually asks for, what an iPad at reception records towards it, and where it does not help.
Every standard on one page: the clause numbers, the version and the date each was read, on one printable table.
- GDPR and the visitor book
- CMMC physical security
- List X visitor control
- ITAR visitor log
- Def Stan 05-138 visitor access
- ISO 27001 visitor access
- PCI DSS visitor log
- AEO visitor access control
- CTPAT visitor log
- TISAX visitor management
- TAPA FSR visitor log
- BRCGS visitor control
- BRCGS packaging visitor control
- BRCGS storage and distribution visitors
- BRCGS unannounced audit
- Visitor control non-conformity
- SALSA visitor control
- IFS Food visitor hygiene
- UFAS feed mill visitor control
- GMP visitors in production areas
- GDP wholesale visitor control
- Fire roll call
- Contractor management
- Construction work in occupied premises
- HSE inspection records
- ISO 45001 contractor control
- Visitor NDA sign in
- What a visitor log must contain
- Standards calendar
- Sign in sheet template
- Visitor health questionnaire template
- Contractor induction template
- Permit to work template
- Hot work permit template
- Fire drill record template
Advise sites on this standard? Referral terms are on one page.
Next step
Bring your retention question to the call
Fifteen minutes on the phone. Tell us which standard or customer you answer to, and we will tell you straight how the retention setting fits it and where it does not.
Book a 15 minute callNo site visit needed and nothing to install. If it is not a fit we will say so on the call.
Would rather email? [email protected]
Not the person who signs it off? Send them the one page business case