Visitor Management Policy: What to Include for Singapore Sites

A visitor management policy is the written set of rules that decides who may enter your premises, how they are identified, where they may go, who accompanies them and what happens to the data you collect. In Singapore, a sound policy has to satisfy three things at once: the security expectations set by the police and the Ministry of Manpower, your duties under the Workplace Safety and Health Act, and the Personal Data Protection Act (PDPA). This guide sets out what to write, in what order, and how to keep it working.

TL;DR

• A good policy covers visitor categories, pre-registration, ID checks, badges, escorts, restricted zones, emergencies, data handling and a named owner for each rule.
• Under the PDPA, collect only what you need, notify visitors of the purpose, and avoid full NRIC numbers unless the law requires them or accurate identification demands them.
• The PDPA sets no fixed retention period for visitor records. Set your own, document the reasoning and dispose of data when the purpose ends.
• Test the policy with drills, review it on a schedule you decide, and update it when your site, tenants or threat picture change.
• Digital visitor management makes the policy enforceable at the gate rather than on paper.

Table of Contents

• What a visitor management policy actually is
• The sections your policy should contain
• Walking a visitor through the policy: four stages
• Keeping visitor data PDPA-compliant
• Security rules: zones, escorts and access levels
• Responsibilities: who enforces what
• Emergency procedures for visitors
• Putting the policy into practice and keeping it current
• Our perspective
• How BeyondSensor can help
• FAQ
• Sources

What a visitor management policy actually is

The policy describes the path of every non-employee from the moment a visit is requested to the moment the visitor signs out. It covers guests, interviewees, contractors, vendors, couriers and auditors. Anyone who is not on your payroll and is not a permanent tenant falls under it.

It is different from a visitor procedure. The policy states the rules and the reasons: who qualifies for access, what must be verified, what data is collected. The procedure is the step-by-step instruction a receptionist or security officer follows. Write the policy first, and keep it short enough that managers will read it. Put the detailed steps in an annex.

The policy also serves a legal purpose. As an occupier, you must keep the workplace and the routes in and out safe for every person within your premises, whether or not that person is your employee. The Act's section 12(2) adds that employers must take reasonably practicable measures for the safety and health of people other than employees who may be affected by their undertaking. Knowing who is on site, and where, is the starting point for meeting both duties.

The sections your policy should contain

A corporate visitor policy that works in practice usually has the following parts. Adapt the depth to your site: a multi-tenant office tower needs more than a single-occupier warehouse.

1. Purpose and scope. State what the policy protects (people, assets, information) and which premises, entrances and visitor types it covers.
2. Visitor categories. Define each group and its access level. A typical split is guest, interview candidate, short-term vendor, long-term contractor, delivery personnel and official visitor such as an inspector.
3. Pre-arrival approval. Specify who may invite visitors and what the host must submit in advance.
4. Identification and badging. Say what ID is checked, what is recorded and what the pass looks like.
5. Escort and zone rules. Say who must be accompanied, and which zones are open, controlled or restricted.
6. Contractor vetting. Cover safety briefings, permits and the extra checks for people who work on site for days or weeks.
7. Unannounced visitors. Say what the front desk does when someone arrives without an appointment.
8. Data protection. Set out what is collected, why, who can see it, how long it is kept and how it is destroyed.
9. Emergency procedures. Explain how visitors are accounted for during evacuation or lockdown.
10. Responsibilities and enforcement. Name the policy owner, the hosts, the front desk, security and facilities, and the consequence of breaches.
11. Review. State how often the policy is reviewed and by whom.

Walking a visitor through the policy: four stages

The clearest way to write the operational rules is to follow the visitor in order.

Stage 1: Pre-registration by the host

Require the host to register the visit before arrival: visitor name, company, date and time, destination and purpose. This shortens the queue at the gate and lets security check names against any watchlist before the person arrives. Our guide to visitor pre-registration for Singapore sites covers the workflow in detail, and visitor watchlist screening explains how to avoid decisions made under pressure at the desk.

Stage 2: Identity confirmation on arrival

The visitor confirms identity by a QR code from the invitation, a passcode, an ID check or a supervised verification at the desk. Your policy should state which method applies to which category. A returning contractor with a valid pass may use a QR code. A first-time visitor to a controlled zone may need a photo ID check by a security officer.

Stage 3: Controlled entry

Approval should translate into physical control. The Ministry of Manpower's SGSecure bulletin describes access control as resting on three elements: identification, authentication and authorisation. It lists swipe cards, PIN verification, biometric turnstiles and interlocking doors as measures, and says all visitors should register for a Visitor pass and be accompanied by staff at all times. Write the same logic into your policy: no pass, no entry; no escort, no access beyond the lobby.

Stage 4: Time-bound access and sign-out

Visitor passes should expire automatically at the end of the visit window. Sign-out closes the record and tells you who is still in the building if an incident occurs. A policy that covers entry but ignores exit leaves a gap exactly when you need the headcount.

Keeping visitor data PDPA-compliant

Searches for a PDPA visitor management approach usually come down to four questions: what may you collect, how do you tell visitors, how long do you keep it, and how do you protect it.

What to collect

Collect what the visit requires: typically name, company, host, purpose and arrival time. The PDPC's guidance on key concepts says organisations may collect NRIC numbers only where required by law or where necessary to identify a person to a high degree of accuracy. Under the PDPC's NRIC guidelines, organisations are generally not allowed to collect, use or disclose NRIC numbers or copies unless one of those conditions is met.

The PDPC has also said that for visitor management, organisations should consider alternatives such as organisation-generated IDs, tracking numbers or email addresses, and should avoid over-collecting other personal data as a substitute. The same release states that physical NRICs may be retained only if required by law, so your policy should forbid holding a visitor's card at the desk as security for a pass.

Security officers can still look at a photo ID. The government's reply to a parliamentary question confirms that officers may check a visitor's photo ID, such as an NRIC, during registration to verify identity, and may collect details such as name and contact number to reach the visitor when necessary. For a condominium, the PDPC's example approach is to check the NRIC or other photo ID and record the full name, only the last three digits and checksum of the NRIC, contact details and vehicle number. A sensible policy line is: check the ID, record a partial number only if you must, and do not copy the card.

How to notify visitors

The Notification Obligation requires you to tell individuals the purposes of collection, use or disclosure on or before collection. The PDPC does not prescribe a particular form for this, so a short notice on the pre-registration invitation, a sign at the kiosk or a line on the check-in screen can each work, depending on how the visitor arrives. Choose the channel that visitors will actually see, and state it in the policy.

Under section 15A, deemed consent by notification is available where the organisation has assessed that the collection is not likely to have an adverse effect on the individual and has taken reasonable steps to make the notification adequate. If you rely on that route, keep the assessment on file.

How long to keep records

The PDPA does not prescribe a retention period. Section 25 requires you to stop retaining the data, or remove the means of linking it to individuals, once it is reasonable to assume the purpose is no longer served and retention is no longer necessary for legal or business purposes. The PDPC expects organisations to prepare a retention policy setting out the approach and the rationale. Its guidelines on selected topics mention setting the retention period and considering ways to anonymise data.

In practice, write a fixed period into the policy, for example a short window for routine guest logs and a longer one for records tied to an incident or investigation. Record why you chose it. Automate deletion where your system allows it, so the rule does not depend on someone remembering.

How to protect it

Section 24 requires reasonable security arrangements against unauthorised access, collection, use, disclosure, copying, modification or disposal. The PDPC says arrangements should fit the nature of the data and the harm a breach could cause, with trained personnel responsible and a plan to respond promptly to breaches.

For visitor logs, the point is practical. An open logbook at the desk shows every previous visitor's name and number to the next person who signs in. The PDPC's NRIC guidance suggests a visitor management system that stores the information electronically and is password protected instead of an open log book. Its advisories on collecting visitor data also call for administrative controls such as preventing data exposure to other visitors and briefing the personnel who collect it.

If your system captures face images or other biometric data, the PDPC's guide on biometric data in security applications states that biometric templates are sensitive personal data and that individuals can request access to the samples captured. Cover this in the policy before you switch the feature on. If cameras at your entrances record visitors, privacy masking for CCTV is a related control worth reading.

Security rules: zones, escorts and access levels

The Singapore Police Force's guide for responsible persons applies security zoning: unrestricted zones such as lobbies and reception, controlled zones such as administrative offices, and restricted zones limited to designated staff, such as areas holding classified records, hazardous materials or cash. The same guide lists visitor management systems, self-registration kiosks and two-factor authentication among access control methods.

Map your own premises to those three zones and tie each visitor category to them. The SPF's workplace advisories also recommend security clearance policies that differentiate staff and visitors, with visitor escort and card access into protected areas.

Visitor category	Typical access	Escort	Pre-registration	Notes for the policy
Business guest	Lobby, meeting rooms	Yes, host or delegate	Yes	Pass expires at end of visit
Interview candidate	Reception, interview room	Yes	Yes, by HR	Limit data to what hiring needs
Courier or delivery	Lobby or loading bay	Not past the bay	Optional	Separate entry path where possible
Short-term vendor	Named work area	Yes	Yes	Safety briefing before entry
Long-term contractor	Named zones, set dates	Per zone	Yes, with vetting	Role-based access, see below
Official or inspector	As required by the visit	Per site rule	Where possible	Verify identity, log visit

For longer engagements, tie access to a role rather than a person. Our guide to role-based access control for Singapore security teams explains how. Where contractors perform hazardous work, a digital permit to work links the visitor record to the work authorisation.

Responsibilities: who enforces what

A policy without owners is a document, not a control. Include a short responsibility matrix:

• Policy owner (often the security director or head of facilities): maintains the policy, approves exceptions, runs the review.
• Hosts: pre-register visitors, meet them at reception, escort them and make sure they sign out.
• Front desk or security officers: verify identity, issue passes, refuse entry when rules are not met and escalate anomalies.
• IT or data protection officer: controls access to visitor data, enforces retention and deletion, handles access requests.
• Facilities management: maintains turnstiles, doors and signage, and keeps evacuation information current.

State what happens when a rule is broken, for example a host who lets a visitor go unescorted. Training is part of this. The SPF advises that staff be trained to identify threats and follow emergency procedures, and the PDPC expects personnel who collect visitor data to be briefed on proper collection.

Emergency procedures for visitors

Visitors do not know your exits, your assembly point or your lockdown signals. The policy should say how they are told: a briefing at check-in, a printed card with the pass, or a screen message. The Ministry of Manpower's SGSecure guide for workplaces says employers should brief employees on escape routes and places to hide, and obtain evacuation plans from building management if they are tenants.

Add these items to the policy:

1. The live visitor list is available to the person running the muster, on a device that works if the network does not.
2. Hosts are responsible for the visitors they invited until accounted for at the assembly point.
3. Visitors who have signed in but not out are treated as present.
4. Contractors working in restricted areas follow their site-specific emergency plan.

The SPF's building security guidelines say that emergency response plans, security manuals and standard operating procedures should be regularly reviewed, updated and communicated, with exercises to test them. Include visitors in the scenarios you rehearse.

Putting the policy into practice and keeping it current

Three steps make the difference between a policy that exists and one that is followed.

Communicate it to both audiences. Staff need to know their duties as hosts. Visitors need a short, readable summary in the invitation: bring photo ID, expect to be escorted, here is how your data is used. Keep the visitor version to a few lines.

Build it into the gate. Rules that depend on memory fail at busy times. Put pre-registration, pass expiry, zone limits and data retention into the system your front desk uses, so the default behavior is the compliant one. The physical security tools comparison helps you decide which tool types fit your site.

Review on a schedule you choose. The SPF's guidance leaves review frequency to building owners and managers, who weigh the evolving threat situation. A practical rhythm is an annual review plus a trigger-based review after any incident, tenant change, renovation, new entry point or change in your data practices. Use the visitor logs themselves as evidence: look at unescorted-visit exceptions, overstays and sign-out rates, then adjust the rules.

Our perspective

Most visitor policies fail at the same point: the rules are sound, but enforcement relies on a person remembering them at 8:55 on a Monday morning. When a visitor arrives, the policy has to be applied by the system, not recalled by the receptionist.

That is how we approach it at BeyondSensor. Our BeyondVisitor line is designed to turn the policy into automated steps: pre-registration, identity confirmation, controlled entry, time-bound access and sign-out in one flow. We pair it with the wider platform so visitor events sit alongside patrol and video data in a single view, which lets teams manage by exception instead of watching every door.

For Singapore sites, localized validation matters as much as the technology. A policy must reflect PDPA limits on NRIC collection, retention discipline and the SPF's zoning concepts, and the tools should make those limits the default setting. We believe that when the system carries the routine work, security staff are free to handle the cases that need judgment.

Eumir

How BeyondSensor can help

If you are turning a written policy into daily practice, BeyondVisitor is our automated visitor management system, built for the pre-registration, verification and tracking stages described above. For sites that want visitor events combined with patrol and video analytics, BeyondSecure brings the security operations view together. System integrators can talk to us about solution integration for multi-vendor deployments.

To discuss your site, start from the BeyondSensor home page and tell us about your premises and visitor volumes.

FAQ

Can we ask every visitor for their NRIC?

Not as a default. The PDPC's guidelines allow NRIC collection only where required by law or necessary to establish identity to a high degree of accuracy, and they point to alternative identifiers for visitor management. Checking a photo ID at the desk and recording a partial number or another identifier is the safer pattern.

How long should we keep visitor records?

The PDPA sets no fixed period. You must stop retaining the data once the purpose is served and it is no longer needed for legal or business reasons, as section 25 explains. Set a period that fits your security needs, write down the reason and delete on schedule.

Do visitors need to consent before we collect their details?

You must notify them of the purposes on or before collection, and obtain consent unless an exception or deemed consent applies. The PDPC's key concepts guidelines set out the conditions. A short notice on the invitation and at check-in is a common way to do it.

Is a visitor policy a legal requirement in Singapore?

No single law demands a document with that title. However, occupiers have a duty under the Workplace Safety and Health Act to keep premises safe for everyone on them, and the PDPA governs the data you collect. A written policy is how you show you meet both.

How often should we review the policy?

There is no fixed interval. The SPF leaves the frequency to owners and managers based on the threat situation. An annual review, plus a review after any incident or change to the site, is a workable standard.

Sources

• MOM: WSH Act responsibilities of stakeholders
• Workplace Safety and Health Act 2006, Singapore Statutes Online
• MOM SGSecure bulletin: physical protection measures
• PDPC Advisory Guidelines on Key Concepts in the PDPA
• PDPC NRIC Advisory Guidelines
• PDPC Media Release on NRIC Advisory Guidelines
• MDDI: Collection of NRIC by security officers
• PDPC: The Notification Obligation
• PDPC: The Retention Limitation Obligation
• PDPC: Advisory Guidelines on the PDPA for Selected Topics
• PDPC: The Protection Obligation
• PDPC: Advisory on collection of personal data
• PDPC: Responsible Use of Biometric Data in Security Applications
• SPF: Guide for Responsible Person, Annex E
• SPF: Contingency Planning and Protective Security Advisories for Workplaces
• MOM: SGSecure guide for workplaces
• SPF: Guidelines for Enhancing Building Security (GEBSS)

Recommended

• Visitor Pre-Registration: A Practical Guide for Singapore Sites
• Avoid 90 Second Chaos: Visitor Watchlist Screening for Singapore Teams
• Digital Permit to Work in Singapore: A Practical Guide
• Physical Security Tools Comparison for Singapore Facilities