Collecting too much data creates a privacy liability, but collecting too little creates a safety catastrophe during an emergency. In Australia, the Privacy Act requires that you only collect information necessary for your functions, while the WHS Act 2011 mandates that PCBUs maintain accurate site occupancy records. Balancing these means collecting only what is essential to ensure everyone gets out safely.
Privacy laws don’t override your duty to keep people alive
The WHS Act 2011 requires Australian PCBUs to ensure the health and safety of all visitors on site. In our work with Australian organisations, we’ve found this requires collecting enough data to identify a person and their location during a crisis without infringing on privacy principles.
Paper logs create privacy leaks and safety blind spots
Many organisations still use paper logs that expose every visitor’s private details to the next person in line. These logs are useless during an emergency because they record who arrived, not who is actually still inside.
- Visitor phone numbers and details are visible to anyone signing in, violating basic privacy expectations.
- Manual logs fail to track check-outs, leading to bloated and inaccurate real-time evacuation reports.
- Forcing irrelevant data collection, such as asking family members for an “organisation,” creates friction and reduces sign-in compliance.
- The absence of automated data retention policies means personal information is stored indefinitely in physical files.
Digital systems balance data minimisation with life safety
A cloud-based visitor management system allows you to customise exactly what data is collected based on the visitor type. This ensures you meet privacy obligations while maintaining a live site occupancy report that works during a crisis.
- Configure optional fields so visitors, such as parents in education or family in aged care, can skip unnecessary organisation questions.
- Set automatic data deletion after a specific period to ensure personal information is not retained longer than necessary.
- Utilise ISO 27001 certified storage to ensure data is sent to secure local servers without third-party processing.
- Replace manual passes with digital identifiers, such as 3D barcodes, to streamline the check-in and check-out process.
- Ensure all external workers complete a mandatory contractor induction and check-in before gaining site access.
Time and People: Visitor Management That Works When It Has To
We convert complex compliance obligations into working infrastructure through cloud-connected visitor management and real-time evacuation reporting. We’ve found that applying high-standard data controls—like the automatic deletion functionality we developed for GDPR—solves critical privacy problems for our clients across Australia and the United States. We build the technology so you can focus on the people being protected.
Content prepared by Time and People — visitor and contractor management across Australia and the United States.