In force for three years now (since 25 May 2018), the General Data Protection Regulation, or GDPR (1), is not limited to IT processing and cyber security.

When you welcome visitors on site, they usually have to sign in on a paper or digital register to access your offices. This register therefore involves collecting personal information and falls directly within the scope of the GDPR. In this sense, every European company processing personal data (2) must comply with the GDPR.

Moreover, “81% of French people say they are now more sensitive to data protection issues.” (3)
There is therefore a good chance that your visitors are also very attentive to this.

Here is an overview of your obligations and of the solutions that will allow you to keep welcoming your visitors in a modern, friendly way while remaining GDPR compliant.

The principles to follow to be compliant

In France, the Commission nationale de l’informatique et des libertés, or CNIL (4) (France’s data protection authority), regulates personal data and therefore ensures that the GDPR is respected and applied.

As a reminder, if the CNIL identifies a breach of the GDPR during an inspection or following a complaint, the offender faces financial penalties of “up to €20 million or, in the case of a company, up to 4% of annual worldwide turnover.” (5)

To avoid this, there are a few key principles to follow: (6)

  • Minimise the data collected, notably the visitor’s first name and surname, company, and date and time of arrival and departure.
  • Limit how long data is kept in line with the legal retention period.
  • Inform visitors about how their data is processed.
  • Restrict access to the register (authorised people only).

Thanks to technology, IT solutions adapt and help you make your visitor reception procedure compliant.

Solutions for GDPR-compliant visitor management

If you are reading this article, there is a good chance that you already have a visitor management solution, that you are looking to change it, or that you are wondering whether you need one.

In any case, it is essential that the software has features that allow you to meet legal requirements.

These include, in particular:

– Periodic data purging, automatic or manual.
– Signature of documents relating to the conditions of data processing
– Role assignment according to each employee’s authorisation level
– Anonymisation of personal data

In addition to these prerequisites, it can be worthwhile to have the provider assist you in setting up such a solution, so that you benefit from its specific expertise in visitor management.
The provider can then work hand in hand with facilities management, the safety and security department and the legal department to best meet your compliance expectations.

At Hamilton Apps, we are aware that these issues are strategic for your organisation. That is why we have rigorously applied the principle of “compliance by design” in designing our visitor management solution: Hamilton Visitor.

Would you like to know more about the GDPR compliance of our solutions? Contact one of our experts.

Sources:

(1) CNIL – GDPR (in French)
(2) CNIL – GDPR (Article 4, No. 1) (in French)
(3) IFOP survey – April 2019 (in French)
(4) CNIL (in French)
(5) CNIL – Penalties (in French)
(6) CNIL – GDPR (Article 5, No. 1) (in French)