Where is your visitor data stored? A visitor management data residency checklist for European organizations

Every time a visitor signs in through your visitor registration system, personal data changes hands. Often that goes well beyond a name and an arrival time: visitors may also leave contact details, a signature, a license plate number or a photo.

But where does that data actually end up? What does “in the cloud” mean in practice? Who can access it? And could a vendor, a sub-processor or a support engineer outside the European Economic Area (EEA) pull it up? Since the GDPR took effect in 2018, these questions have only become more pressing.

Data residency, meaning the geographical location where data is physically stored, is a key consideration for anyone processing visitor data under European privacy law. That makes it a legitimate selection criterion for business leaders, IT managers and data protection officers choosing a visitor management system (VMS).

The location of the primary data center is only part of the story, though. A system that stores data in the EU is not automatically GDPR compliant. Where backups live, whether data is transferred internationally, who holds access rights and how long records are retained all matter just as much.

Our practical checklist helps you find out where a visitor management system really stores and processes data, who can access it and whether any of it leaves the EEA. With those answers in hand, you can look past the marketing claims and compare vendors on hard facts.

In this article:

• Why it matters where visitor data is stored
• Does the GDPR require visitor data to stay within the EU?
• Checklist: how to assess the data residency of a visitor management system
• Warning signs when comparing vendors
• How Vizito stores, processes and deletes visitor data
• Conclusion

Why it matters where visitor data is stored

During Vizito demos, organizations regularly ask us where visitor data is stored. This is hardly surprising: data residency has rightly become an important consideration for many organizations when selecting a visitor management system.

Visitor registration inevitably involves personal data: names, contact details, photos, signatures, arrival and departure times. Where that data is stored and processed has a direct bearing on your legal compliance and on how well you can manage risk. Being open about it also helps build trust with your visitors.

Privacy law

If your organization processes visitors’ personal data in the EU, the GDPR applies. Where that data is stored and processed partly determines which rules and legal safeguards come into play. As soon as data is processed outside the EEA, or can be accessed from outside it, the additional requirements for international transfers kick in.

Foreign legislation can play a role too. The best-known example is the US CLOUD Act, which can compel American service providers to hand over data under certain conditions.

Risk management

Your organization is accountable for the visitor data it collects. That means knowing where the original records, the backups and any other copies are kept, and who can get to them. The fewer unknowns, the easier it is to keep risks in check. Many organizations therefore write into their privacy and security policies exactly where personal data may be stored and processed.

Read also: Visitor management policy: how to write one (free template)

Visitor trust

People are more aware of privacy and data protection than ever. Keeping data within the EEA reassures privacy-conscious visitors, particularly when you are upfront about where their personal data is kept, why you need it, how long you hold on to it and how you protect it.

Does the GDPR require visitor data to stay within the EU?

The short answer surprises many people: no, it does not.

Nothing in the GDPR says that personal data, visitor data included, has to physically stay inside the EU. What the regulation does do is attach extra conditions to any transfer of personal data outside the European Economic Area (EEA).

Within the EEA

The GDPR applies directly across the European Union, and the same rules extend to the three other EEA countries: Norway, Iceland and Liechtenstein. Storing or processing visitor data in another EEA country therefore triggers no additional transfer conditions.

Outside the EEA

Every country outside the EEA is a so-called third country, and moving personal data there counts as an international data transfer. That obviously includes storing data on a server in a third country, but it also covers a vendor or sub-processor in such a country accessing data that physically sits inside the EEA.

International transfers are allowed, but only when the conditions in Chapter V of the GDPR (Articles 44 to 50) are met. There are several mechanisms for that:

1. Adequacy decision

The European Commission can rule that a country, a territory or a specific sector offers an adequate level of data protection. The United Kingdom, Switzerland, Japan, South Korea and New Zealand all have such a decision. Canada does too, but only for commercial organizations covered by its PIPEDA privacy act.

A transfer covered by an adequacy decision needs no further safeguards. Adequacy decisions are reviewed periodically, however, so always check the European Commission’s current list before relying on one.

2. Appropriate safeguards

Without an adequacy decision, you need to take extra steps to protect the data, using what the GDPR calls appropriate safeguards. The most common are the European Commission’s Standard Contractual Clauses (SCCs) and Binding Corporate Rules (BCRs).

A contract on its own is not always enough. The parties also have to assess whether the law in the receiving country actually allows those contractual commitments to be honored, and depending on the risk, supplementary measures may be required.

3. Derogations

Finally, the GDPR allows a handful of exceptions, known as derogations. A transfer may go ahead, for instance, with the explicit consent of the data subject, or when it is necessary to perform a contract or serves the public interest. These derogations are meant for specific, one-off situations, not as a basis for routinely processing visitor data outside the EEA.

What about the United States?

This is where it gets complicated. The European Commission has approved three successive frameworks for transferring personal data to US organizations. The first, Safe Harbor, was struck down by the Court of Justice of the European Union in 2015. Its successor, the EU-US Privacy Shield, met the same fate in 2020.

The current arrangement, the EU-US Data Privacy Framework, has been in force since July 2023. Under it, personal data can once again be stored in the US without additional transfer safeguards, but only with certified US organizations that appear on the official participant list. For everyone else, appropriate safeguards are still required.

Given that its two predecessors were invalidated, transfers to the US deserve ongoing attention. Always verify that the decision is still valid and that the organization you are dealing with is actually certified.

In short, the GDPR does not oblige you to keep visitor data in Europe. Storing and processing it within the EEA does make the legal assessment considerably simpler, because the extra rules for third-country transfers never come into play. Just remember to look beyond the primary storage location: check where backups and copies are kept, and from which countries your vendors and their sub-processors can access the data.

Read also: GDPR and visitor management: a practical guide

Checklist: how to assess the data residency of a visitor management system

Use this checklist to find out where visitor data is actually stored and processed.

1. Check all storage locations

• In which country or cloud region is the primary database hosted?
• Where are backups and disaster recovery copies stored?
• Where are photos and signed documents kept?
• Where do log files and temporary copies end up?
• Is any personal data stored outside the EEA? If so, which data, and where?

2. Check who has access

• Who is the vendor behind the visitor management system, and in which country is it based?
• Which cloud provider does the vendor use, and where are that provider and its parent company based?
• Which sub-processors handle visitor data, and from which countries?
• Can support or engineering staff access visitor data? If so, when, and from which countries?
• Is that access restricted to authorized staff, properly secured and logged?
• Can anyone outside the EEA get access to the data?

3. Check international transfers

• Is visitor data stored, processed or made accessible outside the EEA?
• To which countries and organizations is it transferred?
• Is the receiving country covered by an adequacy decision?
• If the recipient is a US organization, is it certified under the EU-US Data Privacy Framework?
• If no adequacy decision applies, are appropriate safeguards such as Standard Contractual Clauses in place?
• Have the transfer risks been assessed, and have supplementary technical or organizational measures been taken where needed?
• Can the vendor demonstrate all of this in writing?

One caveat: data residency is only one piece of the data protection puzzle, and it does not guarantee GDPR compliance on its own. Make sure you only collect the personal data you genuinely need for visitor registration (data minimization), and take a close look at the system’s retention periods, deletion procedures, encryption and access controls as well.

Warning signs when comparing vendors

The checklist above gives you a structured way to question vendors. Pay close attention to how specific and complete their answers are. Be wary of a vendor that:

• only says that data is stored “in the cloud” or “in Europe”;
• gives the location of the primary database and nothing else;
• is vague about backups, copies and log files;
• cannot produce an up-to-date list of sub-processors;
• will not say from which countries its staff can access data;
• cannot name a clear legal basis for transfers outside the EEA;
• will not confirm its data residency claims in writing.

How Vizito stores, processes and deletes visitor data

With Vizito, your visitor data stays within the European Union. It is hosted on servers in Amsterdam and Frankfurt, operated by our hosting partner Leaseweb Global B.V. Our other sub-processors and their locations are listed in the data processing agreement.

You decide which visitor data you collect and how long you keep it. Once the retention period you have set expires, the registration is deleted automatically. Vizito processes visitor data purely to deliver the service, never for advertising, profiling or any commercial purpose of its own.

Visitor data is encrypted both in transit and at rest, and Vizito is ISO 27001 certified, meaning our information security management system has been independently audited.

You can read more on our Vizito and the GDPR page.

Conclusion

Where visitor data is stored is far more than a technical detail. The location partly determines which privacy rules and transfer conditions apply, and how much insight your organization has into what happens to that data.

And it is not just about the primary database. Backups and other copies, the sub-processors involved and the countries from which staff can gain access all count.

The GDPR does not force you to keep visitor data inside the EEA, but doing so generally makes compliance a lot more straightforward. Even then, data residency is only one part of the picture: data minimization, security, retention periods and timely deletion remain just as essential.

Want to see for yourself how Vizito keeps visitor data secure and easy to manage? Try Vizito free for 14 days or book a demo.