Skip to content
LobbyExpress
Search

Analysis

The real cost of the paper sign-in book

The visitor book on the reception desk looks free. In practice it shows every visitor's details to the next one, cannot run a roll-call, and quietly keeps personal data for as long as nobody throws it away.

By LobbyExpress Editorial

The paper visitor book survives because it asks for nothing. No budget line, no procurement, no training, no network. It sits open on the reception desk with a pen on a string, and it has done so for decades.

Its costs are real, but they do not appear on an invoice. They appear when a visitor reads the page above their own entry, when a fire warden stands at an assembly point with a list nobody can reconcile, and when someone asks what personal data the organisation holds about them and the honest answer is “it is in a box in a cupboard, somewhere”.

This piece sets out where those costs fall, and what to do about them, whether or not you replace the book.

Every page is on show

The defining feature of a sign-in book is that it is shared. Each visitor writes on the same page as the people before them, and to find the next empty line they have to look at the full ones.

An illustrative page from a paper sign-in book, annotatedAn illustrative ledger page with columns for name, company, visiting, car registration, time in and time out. Entries are shown as grey bars rather than real names. Four numbered callouts point out the problems: every earlier entry is visible to the next visitor; some handwriting is illegible; the time-out column is blank for several rows; and nothing on the page says when it will be destroyed.ILLUSTRATIVENameCompanyVisitingCar regInOut12341Every earlier entry is visibleThe newest visitor (blue) can readeveryone above them on the page2Some entries cannot be readA name nobody can decipher isno use in an evacuation or an audit3Sign-out is left blankGone home, or still in a meeting?The page cannot say4No destroy-by dateNothing says how long the bookwill be kept, or by whom
Illustrative example; entries are shown as bars, not real data. Four problems are visible on a single page before anything goes wrong.

A typical book asks for a name, a company, the person being visited, often a car registration, and times in and out. Every visitor who signs in can read those details for everyone who signed in before them on that page, and often on the pages before it. A courier can see which consultancy visited the finance director. A job candidate can see who else interviewed that morning. A former partner can see when someone arrived and what car they drove.

Under UK and EU data protection law those entries are personal data, and the law expects organisations to keep personal data secure and confidential. A ledger that displays it to strangers by design is a difficult thing to square with that expectation. Whether a particular book is acceptable in a particular setting is a question for your data protection officer, not for us, but it is worth asking them directly rather than assuming the book is exempt because it is traditional.

It cannot run a roll-call

The usual reason facilities teams give for keeping a sign-in record is fire safety: in an evacuation, the record should tell the people at the assembly point who is still unaccounted for. A paper book is poorly built for that job.

An evacuation with a paper book compared with a live listTwo lanes of four steps each. Paper book lane: the alarm sounds; the book is on the desk inside and someone has to remember to take it; at the assembly point the book shows who signed in, not who left; unticked names cannot be resolved from the book. Live list lane: the alarm sounds; the list is already on wardens’ phones or can be printed away from the building; it shows who is still signed in; missing names can be checked with their hosts. Three steps in the paper lane are marked as failure points.Paper bookLive list1Alarm soundsReception leaveswith everyone else2Book is insideSomeone must thinkto pick it up3Who signed inNot who has left,over days of pages4Open questionsBlank sign-outsstay unresolved1Alarm soundsReception leaveswith everyone else2List is already outOn wardens’ phones orprinted elsewhere3Who is still inOnly open sign-ins,for today only4Follow upMissing names goto their hosts
The paper lane fails at three of four steps. A live list is only as good as sign-out discipline, but it starts outside the building and shows only the people who matter.

The book is on the desk, and the desk is inside the building being evacuated. If the receptionist remembers to take it, the warden then has pages of names spanning days or weeks, with a sign-out column that visitors routinely forget. The book can tell you that someone signed in at 10:40. It cannot tell you whether they left at 11:15 without writing it down.

In England and Wales, the Regulatory Reform (Fire Safety) Order 2005 places duties on the responsible person for fire safety in non-domestic premises, and evacuation arrangements are part of the fire risk assessment. How visitors are accounted for is a question for your fire risk assessor; the point here is narrower. If your arrangements assume the sign-in book will be used for roll-call, test that assumption in the next drill.

Legibility, searching and the cupboard problem

Three smaller costs compound over time.

Legibility. Handwriting at a standing desk, often in a hurry, is not always readable. An entry nobody can decipher is no help in an evacuation, a security investigation or a contractor audit.

Searching. Questions about visitors almost always arrive later: who came to see a particular person last spring, which contractors were on site the week a fault appeared. Answering them from paper means reading every page by hand. The same applies when someone exercises their right of access and asks what personal data you hold about them.

Retention. Data protection law expects personal data to be kept no longer than necessary, which in practice means setting a retention period and sticking to it. Paper books are rarely given one. A full book goes into a drawer, then a cupboard, then an archive box. It is destroyed when someone clears the cupboard, not when the retention period ends.

Open book, single-entry slips and digital sign-in comparedA comparison grid with five rows and three columns. Earlier visitors hidden: open book no, single-entry slips yes, digital sign-in yes. Records searchable for a later request: open book no, slips partly, digital yes. Live list for roll-call: open book no, slips no, digital yes. Retention period enforced: open book no, slips partly, digital yes if configured. Works in a power or network outage: open book yes, slips yes, digital partly, depending on the product’s offline mode.Open bookSingle-entry slipsDigital sign-inEarlier visitors hidden from the nextSearchable for a later requestLive list for roll-callRetention period enforcedWorks in a power or network outageYesPartly, or depends on set-upNo
Single-entry slips fix the privacy problem cheaply but not the roll-call one. Digital sign-in fixes most rows, provided retention is actually configured, and its weak spot is the one paper is best at.

Paper still has one real strength

It would be wrong to pretend paper has no advantages. It does not need power, Wi-Fi or a working tablet. When a site loses its network, the book carries on. That is precisely why many organisations that move to a digital system keep a paper fallback at reception.

The difference is the role it plays. As a fallback, paper is used for a few hours, its entries are typed into the main system afterwards, and the sheets are destroyed. As the system of record, it accumulates for years.

If paper stays, make it safer

Whether you are keeping paper by choice, by budget or as a fallback, a few changes remove most of the avoidable risk:

  • Stop showing earlier entries. Use single-entry slips or tear-off badges, or a book with a privacy cover that hides previous lines.
  • Collect less. Ask whether you need a car registration from every visitor, or only from those using the car park.
  • Tell people why. Put privacy information at the point of sign-in, saying what is collected, why, and for how long.
  • Set a retention period and keep to it. Write the destroy-by date on each completed book or batch of slips, and dispose of them as confidential waste.
  • Store completed records securely, not in an unlocked cupboard behind reception.
  • Make someone responsible for the list in an evacuation, and check in drills that it actually leaves the building.
  • Agree with your DPO how you would find a person’s entries if they asked for them.

Those steps cost little. They also make the case for replacing the book easier to see: most of them are things a digital system does by default, and the one it does less well — working without power — is the one the paper fallback covers.

Where to go next