Outsourced reception: who is responsible for your visitor data?

Many companies outsource their reception, their security or their entire facility management (FM). The external staff on the front desk then often work in your visitor management system (VMS). But outsourcing your reception does not mean outsourcing responsibility for your visitor log.

Under the GDPR, there is a clear line between the data controller and the data processor. When you outsource your reception, your organization stays the data controller and the FM provider becomes the data processor. That is why you need a data processing agreement. It sets out who has access, which security measures apply and what happens to the data when the contract ends.

So what should that agreement cover? What happens to your visitor log when you part ways with your FM provider? And how do you keep evacuation lists accurate when a different temp is on the desk every week? In this article, we explain how to split the responsibilities and stay in control of your visitor data.

Who Is Responsible for Visitor Data When Reception Is Outsourced?

With outsourced reception, an external provider runs your front desk day to day. Often this is part of a wider outsourced facility management contract that also covers security or other services. External staff then work at your reception, and the FM provider takes care of rotas, cover for sickness and holidays, and supervision of the receptionists.

None of this moves responsibility for your visitor log to the provider. If your organization decides why visitors are registered, which details you collect and how long you keep them, the legal responsibility stays with you. The fact that external receptionists do the actual signing in does not change that.

The GDPR makes a distinction here between the data controller and the data processor. Each role comes with its own obligations. In the next section, we look at what that means for you and your FM provider.

Data Controller vs Data Processor: What Is the Difference?

The difference comes down to one question: who decides why and how personal data is processed? Article 4(7) and (8) of the GDPR define both roles. In short:

• The data controller decides on the purpose and the means of the processing: why personal data is collected and how.
• The data processor processes personal data on behalf of the controller and follows its instructions.

When you outsource your reception, you are usually the data controller and the FM provider that staffs the desk is the data processor. You decide, for example, which visitor details are needed, what they are used for and when they are deleted. The external receptionists put those decisions into practice.

This split determines what each party has to do and what each party is liable for. Here is an overview:

When Does Your FM Provider Become a Data Controller?

In most cases, the company that outsources its reception is the data controller and the FM provider running the desk is the processor. But the roles depend on what each party actually does and decides, not on what the contract calls them. For some processing, an FM provider can be a data controller in its own right.

A few examples:

• Does the FM provider also use visitor data to market its own services? Then it is adding a purpose of its own, which makes it a controller for that processing. It has to meet the GDPR requirements for that use separately.
• Do you and the FM provider decide together on the purpose and essential means of visitor registration, for example because you design an access and safety process as a team? Then you may be joint controllers. In that case, you need to agree on who takes care of which GDPR obligations.

What Should the Data Processing Agreement Cover?

When an external reception company handles your visitor data, you need to put the arrangements in writing in a data processing agreement (DPA). It sets out how the provider must handle the data and what each party is responsible for.

Article 28(3) of the GDPR lists what the agreement must include:

1. A Description of the Processing

The agreement describes:

• the subject matter and duration of the processing;
• the nature and purpose of the processing;
• the types of personal data involved, such as names, contact details and arrival and departure times;
• the categories of people concerned, such as visitors, suppliers and contractors;
• the rights and obligations of the data controller.

2. Instructions for the Processing

The processor may only handle visitor data on the documented instructions of the controller. It cannot decide to use the data for its own purposes.

The instructions explain how the processor must handle visitor data. That could cover the visitor management system it must use, which details may be recorded, which retention periods apply, who has access and whether data may be transferred outside the European Economic Area (EEA).

If the processor believes an instruction breaches the GDPR or other privacy law, it must tell the controller straight away.

3. Confidentiality

The processor must make sure that everyone authorized to handle the visitor data is bound by confidentiality, either through a confidentiality agreement or a legal duty.

That includes temporary receptionists and stand-ins who have access to the visitor log.

4. Security

The agreement must require the processor to take appropriate technical and organizational security measures. For visitor registration, think of personal user accounts, restricted access rights and encryption.

It also covers restoring access to the data after an incident and testing security regularly.

5. Sub-processors

The agreement states whether the processor may bring in sub-processors. It can only do so with the controller’s prior written authorization.

That authorization can be specific, for a named sub-processor, or general. With general authorization, the processor must tell you about any new sub-processor in advance, so you have the chance to object.

Sub-processors must be held to the same obligations by contract. If a sub-processor fails to meet them, the original processor remains liable to you.

6. Help With Privacy Requests

Visitors can ask to exercise their privacy rights, such as the right to access, correct or delete their data.

The agreement must set out how the processor helps you deal with these requests. For example, by passing requests on to you and by finding, correcting or deleting data when you ask.

7. Help With Other Obligations

The processor must also help you with the security of the processing, with data breaches and, where needed, with a data protection impact assessment (DPIA) and prior consultation with the supervisory authority.

Agree on how incidents are reported, too. The processor must notify you of a data breach without undue delay after becoming aware of it.

8. What Happens When the Contract Ends

When the service ends, the processor must delete or return the visitor data, whichever the controller chooses. Any existing copies must also be deleted, unless the law requires them to be kept. Make this concrete: in what format is the data handed over, by when, and how does the provider confirm that everything else has been deleted?

9. Information and Audits

The processor must make available all the information you need to check that it meets its obligations. It must also allow and contribute to audits and inspections carried out by you or an auditor you appoint.

Agree on how an audit is requested and carried out, without limiting your right to audit more than necessary.

Whose System Should Hold the Visitor Log?

The GDPR does not say whose system the visitor log should live in. In practice, it is best kept in a visitor management system (VMS) on an account that you manage yourself. External receptionists then get their own user profiles, with only the access they need to do their job.

That way, as the data controller, you stay in control of the settings, the access rights and the visitor data. If you change FM provider, you simply remove access for the outgoing staff and set up the new team, without moving your visitor log to another system.

Does the FM provider use its own system or account? Then agree in writing how you keep access to the data, how it can be exported and how it is returned or deleted when the contract ends.

One more thing: if you use a cloud-based VMS, you will usually need a data processing agreement with the VMS provider as well. The provider stores visitor data on your behalf, so it is a data processor too.

End of Contract: What Happens to Your Visitor Log?

The data processing agreement should spell out what happens to the visitor log when the contract ends. As the data controller, you decide whether the processor returns it or deletes it. Any existing copies must also be deleted, unless the law requires them to be kept.

The practical steps depend on how you register visitors today. The infographic below shows what you and your provider need to do in each scenario.

Whatever your situation, keep these steps in mind when the contract ends:

• Check what you agreed. Go through the contract and the data processing agreement. Which deadlines, export formats and procedures apply to the handover and deletion of data?
• Keep the front desk running. Set up access for the new receptionists in good time. Will a new provider act as your data processor? Then make sure the data processing agreement is signed before it starts handling visitor data.
• Remove access on time. Revoke access as soon as people no longer need it. That includes the VMS, other internal systems, the Wi-Fi and building access badges.
• Check your retention periods. Changing provider does not restart the clock. Delete any data that is past its retention period, including in files that were handed over.

Evacuation Lists When Reception Staff Keep Changing

When you outsource your reception, you may see a new face behind the desk now and then. Or the staff may change every day or every shift. In that case, you need a watertight way to produce evacuation lists. If there is a fire, the list has to be right, no matter who is on the desk that week.

The most reliable way to know who is in the building at any moment is to go digital. A digital visitor management system records who has signed in and out. So you always have an up-to-date attendance list, whoever is on the front desk.

With changing reception staff, whoever is on the desk when an emergency happens must know how to export the current list, and must have the rights to do it. Build this into your emergency plan and make sure everyone gets the right training and instructions.

A few practical tips:

• Put together an evacuation kit, such as a bright red folder that always sits in the same place at reception. Include instructions for exporting the current attendance list, a floor plan with escape routes and assembly points, and a list of emergency numbers and internal contacts for fire wardens and first aiders. Ask reception staff to check every day, or at the start of each shift, that the folder is there.
• Make changing reception staff a scenario in your evacuation drills. Check that everyone knows their role, that whoever is on duty can quickly export an evacuation list and work with it, and that the list is accurate.

Conclusion

An external provider can take over the day-to-day work at your reception, but not the responsibility for your visitor data. Your organization remains the data controller. You decide which data is recorded, who can see it and how long it is kept. A solid data processing agreement with your FM provider puts those arrangements in writing, including what happens when the contract ends.

A digital visitor management system turns those arrangements into everyday practice. When your organization manages the account, you control the settings and retention periods, give external receptionists their own profile with only the rights they need, and remove their access the moment you change provider. Your visitor log stays in your own system, and you always have an up-to-date attendance list, whoever is behind the desk.

Want to see how Vizito keeps you in control of your visitor log, even with an external reception provider? Try Vizito free for 14 days or book a demo.