In this guide · 8 sections
- 01What a visitor log may collect under the PDPA
- 02Full NRIC vs partial NRIC for visitors
- 03Do not keep the visitor's IC at the counter
- 04Notice at reception and on the sign-in screen
- 05How long to keep visitor records
- 06Cloud visitor management systems: what to check with the vendor
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
For most offices, record name, contact number, company, host and time, plus at most a partial NRIC (last 3 digits and checksum letter). Full NRIC needs a legal or real high-security reason. Show a notice at reception, set a short retention period and never keep a visitor's IC.
What a visitor log may collect under the PDPA
Visitor details are personal data, so the usual PDPA obligations apply: tell people why you collect it, collect only what is reasonable for that purpose, protect it and do not keep it longer than needed. The extra rule is about NRIC numbers.
| Data field | Usually reasonable? | Notes |
|---|---|---|
| Name, company, host, time in and out | Yes | The core of any visitor log |
| Mobile number or email | Yes | Useful to contact visitors after an incident |
| Vehicle number | Yes, if you manage parking | PDPC's condo example includes it |
| Partial NRIC (e.g. 567A) | Only if you need an ID check | Not treated as collecting the full NRIC, but still personal data |
| Full NRIC number | Only if law requires it or a high-fidelity ID is justified | You must be able to explain why to the visitor and PDPC |
| Copy or photo of the NRIC card | Rarely | Same test as full NRIC; avoid by default |
| Visitor photo | Depends on purpose | Explain it in your notice and protect it |
Full NRIC vs partial NRIC for visitors
The PDPC's NRIC advisory guidelines say organisations are generally not allowed to collect, use or disclose NRIC numbers or copies. There are two exceptions: when a law requires it, or when it is necessary to accurately establish someone's identity to a high degree of fidelity.
The guidelines give visitor examples on both sides:
- Private condominium: the MCST could check a visitor's NRIC or other photo ID and record the visitor's full name, partial NRIC (last three digits and checksum letter), mobile number and vehicle number. PDPC suggests a password-protected electronic visitor management system instead of an open logbook.
- Secured data centre: where the building assesses that accurately identifying every visitor is necessary to protect critical infrastructure, full NRIC collection may be justified, but it must be able to explain why to visitors and the PDPC, and protect the numbers properly.
- Preschools: PDPC cites visitor entry to preschools as a case where identifying people wrongly may pose a significant safety or security risk.
A typical office, showroom or clinic front desk is much closer to the condo example than the data centre one. Our guide to NRIC collection rules covers the guidelines in more depth.
Do not keep the visitor's IC at the counter
Practical alternatives: issue numbered passes logged against the visitor's name and mobile number, have the host collect the pass, use self-expiring paper or QR passes, or ask for a different item such as a business card. If an ID check is genuinely needed, look at the card and record only the partial number.
Notice at reception and on the sign-in screen
The PDPA's notification obligation means visitors should know why you collect their details before they hand them over. A visitor management tablet makes this easy, because you can show the notice on the first screen.
State the purpose
For example: 'We record visitor details for building security and to contact you if there is an incident.'
List what you collect
Name, mobile number, company, host, time in and out, and photo if you take one.
Say how long you keep it
Give the retention period, such as 30 days, unless needed for an investigation.
Give a contact
Name your data protection officer or a contact email for questions and access requests.
Place it where people see it
On the tablet's first screen, and as a printed sign at the counter for paper logs.
If you also run CCTV at reception, mention it in the same notice. Our CCTV and PDPA guide explains signage for cameras.
How long to keep visitor records
The PDPA does not set a fixed period for visitor logs. PDPC's Retention Limitation Obligation requires you to stop retaining personal data, or dispose of it properly, once it is no longer needed for any business or legal purpose. The NRIC guidelines repeat this for NRIC numbers in the condo example.
Pick a period that matches the purpose. For general office security, a period measured in weeks is often enough, with a hold on specific records if an incident is being investigated. Write the period down, set the system to purge automatically, and shred old paper logbooks. Our data retention policy template helps you record it.
Cloud visitor management systems: what to check with the vendor
Most visitor apps store data in the vendor's cloud. Your organisation stays responsible for that data, and the vendor is your data intermediary.
Visitor system vendor checklist
PDPC's summary says personal data may be transferred overseas only under the prescribed requirements, so the protection is comparable to the PDPA. Ask the vendor where their servers are and what safeguards they have.
Do it yourself or get help?
Fixing a visitor log is mostly about removing fields, adding a notice and setting deletion. A small office can do that in an afternoon with the steps above.
If visitor data is one of several PDPA gaps, our PDPA Compliance Pack (S$690) covers notices, retention policy, data inventory and vendor checks across your forms, systems and front desk.
Frequently asked questions
Generally not the full number. PDPC's guidelines allow full NRIC collection only when a law requires it or when you need to identify someone to a high degree of fidelity, for example for significant security risks. For most offices, a name, mobile number and, if needed, a partial NRIC of the last three digits and checksum letter is enough.
Yes. PDPC's guidelines say collecting up to the last three digits and the checksum letter, such as 567A, is not treated as collecting the full NRIC number. It is still personal data, so protect it, include it in your notice and delete it with the rest of the record when you no longer need it.
Not unless a law requires it. PDPC's example of a secured data centre says the building should not retain visitors' physical NRICs as collateral for visitor badges, and suggests alternatives such as returning badges at a single exit point. Use numbered passes logged against the visitor's name instead.
The PDPA sets no fixed period. You must stop keeping the records once they no longer serve a business or legal purpose. Choose a period that matches your security needs, write it in your retention policy, tell visitors in your notice and set the system to delete automatically. Keep specific records longer only for an investigation.
Yes. The notification obligation applies however you collect the data. Put a short printed notice at the counter explaining the purpose, what you collect, how long you keep it and who to contact. Also avoid open logbooks where visitors can read earlier entries; PDPC suggests a password-protected electronic system instead.