The Visitor Book at Your Reception Is a Data Protection Problem

Walk into most Nairobi office blocks and the same thing happens. A book is pushed across the desk, open, and you are asked to fill in your name, your phone number, your ID number, who you are visiting and sometimes your car registration. While you write, you can read the thirty people who came before you today.

Nobody designed it that way on purpose. It is just what a book does. But look at what is happening: a business is collecting identifying details about people, for security purposes, and showing each person's record to every stranger who arrives afterwards.

That is a data protection problem sitting in your lobby, and under Kenyan law security records are not a casual category.

What the Book Actually Does

Set the law aside for a moment and look at the object. An open visitor book is a list of identifying details about named people, left on a desk in a public area, readable by anybody who walks in and visible to anyone who photographs it.

It records who met whom and when. In some businesses that is harmless. In others it is genuinely sensitive. A law firm's visitor book shows who is taking legal advice. A clinic's shows who attended. An auditor's shows which company was visited the week before results. An NGO's shows which officials came in. None of that is information the business meant to publish, and all of it is published to the next caller.

It also tends to be the only copy. Books get lost, soaked, thrown out during renovations, or stacked in a store room for years with nobody responsible for them.

Why Security Records Are a Special Case

Kenya's Data Protection Act applies to personal data generally, and a name with a phone number and an ID number is clearly that. We have written separately about what the Act asks of a business and who has to register, and it is worth reading alongside this.

The part that matters here is specific. The Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021 carry a Third Schedule listing purposes that make registration with the Data Commissioner mandatory regardless of how small the business is. The second item on that list is:

Read what that does. The small business exemption, which otherwise applies to a business with under five million shillings of turnover and fewer than ten employees, does not apply to an entity processing personal data for that purpose. The schedule names CCTV explicitly, and a visitor log kept for security sits in the same territory. If you run cameras at your gate, you are on that list by name.

What Goes Wrong in Practice

The failures are consistent across the receptions we have seen.

• Collecting the ID number by habit. The most sensitive field on the page, usually gathered because the previous book had a column for it, rarely because anybody decided it was needed.
• No stated purpose. Ask a receptionist why the phone number is collected and the answer is normally that the form asks for it. If nobody can say what it is for, it is hard to argue it was necessary.
• No retention limit. Books from 2019 in a cupboard. Nobody decided to keep them; nobody decided to destroy them either.
• Everybody can read everything. Not just staff. Every visitor, every courier, every person waiting.
• Doubling as a marketing list. Phone numbers from the visitor book being used for promotions later. That is a different purpose from security, and it is the version of this that generates complaints.

That last one deserves emphasis. People hand over a number at a gate because they want to get in, not because they want to hear from you. Treating a security record as a sales list is the clearest way to turn a tidy process into a grievance.

What You Actually Need to Collect

The useful discipline is to ask, field by field, what each one is for and what you would do with it. Most books shrink sharply under that question.

If you cannot say what a field is for in one sentence, stop collecting it. That is both the compliance answer and the practical one, because every field you drop is one less thing to secure, store and eventually destroy.

What a Digital Sign In Changes

Moving off paper is not about looking modern. It changes four specific things that the book cannot do at all.

There is a fifth, less obvious benefit: a digital form makes you decide what you collect. Someone has to configure the fields, which forces the conversation nobody has about a printed book.

Our visitor management system is built around exactly those points, for Kenyan offices, schools, estates and clinics. Each visitor signs in on their own, nobody reads anyone else's details, access is by role, and records age out on a schedule you set rather than sitting in a drawer indefinitely.

How Long to Keep It

There is no single number we can honestly give you, because it depends on why you hold the records and what else applies to your sector. What we can say is how to decide.

1. Write down why you keep them. Usually: knowing who is in the building during an incident, and being able to look back a short while afterwards.
2. Pick the shortest period that serves that reason. For most offices this is months rather than years. If somebody argues for longer, make them say what for.
3. Check whether your sector says otherwise. Some regulated settings have their own record keeping rules that override your preference. That is a question for your compliance adviser.
4. Then actually delete. A retention policy nobody enforces is worse than none, because you have written down the rule you are breaking.

Where to Start

You do not need a project to make this better this week.

1. Close the book. Today. Even on paper, a receptionist filling it in on the visitor's behalf, or a cover sheet, stops each caller reading the last thirty.
2. Delete a column. Pick the field nobody can justify, usually the ID number, and stop collecting it.
3. Deal with the old books. Decide what the oldest one you need is, and destroy the rest properly.
4. Separate the marketing question. If anyone is using visitor numbers for promotions, stop until you have asked permission for that separately.
5. Then look at going digital, with a clear list of what you will and will not collect.

Steps one and two cost nothing and remove most of the exposure. The rest is worth doing properly rather than quickly.

Frequently Asked Questions

Is a paper visitor book against the law in Kenya?

No law bans a paper book as such. The problem is what an open book does in practice: it shows each arriving visitor the names, phone numbers and often ID numbers of everyone before them, and it usually has no retention limit and no access control. Those are the things that create exposure under the Data Protection Act. You can improve a paper process a great deal by having reception fill it in rather than the visitor, using a cover sheet, and cutting the fields you cannot justify. This is general information rather than legal advice.

Does running CCTV mean I have to register with the ODPC?

The Third Schedule to the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021 lists purposes that make registration mandatory regardless of business size, and item 2 reads "Crime prevention and prosecution of offenders (including operating security CCTV systems)." So the small business exemption, which otherwise covers a business under five million shillings in turnover with fewer than ten employees, does not apply to an entity processing personal data for that purpose. Whether your particular setup falls inside it is a question for a Kenyan data protection practitioner.

What should a visitor log actually record?

The name, who they are visiting, and the time in and out. That is the real security purpose, which is knowing who is in the building. A phone number is defensible if you genuinely need to reach somebody who is still inside. Company name is low sensitivity and useful at reception. ID numbers, car registrations without a car park, and signatures are usually collected out of habit and almost never used. A good test: if you cannot say in one sentence what a field is for, stop collecting it.

Can I use visitor phone numbers for marketing?

Not on the strength of a security sign in. People give a number at a gate to be let in, not to receive promotions, so using it for marketing is a different purpose from the one you collected it for. If you want to contact visitors commercially, ask for that separately and keep the permission separate from the sign in itself. Businesses wholly or mainly in direct marketing also appear on the Third Schedule's mandatory registration list, which is worth knowing before you start treating a visitor log as a contact list.

How long should we keep visitor records?

There is no single number that is honest for every business, because it depends on why you hold them and what your sector requires. The method is to write down the reason you keep them, choose the shortest period that serves that reason, which for most offices is months rather than years, check whether anything in your sector sets its own requirement, and then actually delete on schedule. A retention policy nobody enforces is worse than none, because you have documented the rule you are breaking.

What does a digital visitor system do that a book cannot?

Four things. No visitor sees another visitor's details, because each person has their own record. Access can be set by role, so reception sees today while a manager sees history. Records can expire automatically on a schedule instead of depending on somebody clearing a cupboard. And you can search, which matters on the one day you genuinely need to know who was in the building on a particular afternoon. There is a fifth, quieter benefit: configuring the fields forces you to decide what you collect, which is a conversation nobody has about a printed book.