Visitor data in 2026: a practical GDPR primer
Purpose limitation, lawful basis, retention, photos, ID scans, and the data-subject rights you cannot skip. Written for workplace teams, not lawyers.
Visitor logs, badge photos, and ID scans are personal data. The GDPR work behind a clean lobby is real, and a privacy notice in the entry hall is not the work.
Contents
- Why this is a workplace problem
- Purpose limitation, in practice
- Lawful basis is a small menu
- Retention windows that survive scrutiny
- Photo and ID consent UX
- Data-subject rights are not optional
- What good tooling looks like
- Disclaimer, and what to do next