Visitor management systems in Australia

A visitor management system is software that records who is on a site and when. Instead of a paper sign-in book at reception, people sign in by scanning a QR code with their own phone or by tapping through a tablet at the door. The system timestamps the arrival, tells the host their visitor is here, and keeps that person on a live on-site list until they sign out. Because the list is live rather than handwritten, it can be used as an evacuation roll during a drill or a real emergency, and because each visit is a record rather than a line of biro, it can be searched, kept for a defined period, and deleted. Entrica is a visitor management system of this kind, built for organisations in New Zealand and Australia.

Entrica adds a third way in: NFC. The visitor holds their phone against a small tag at the door and the same sign-in form opens in their browser, with nothing to install and no camera to aim. We explain what NFC is, how tap-to-sign-in works, and when it beats a QR code on its own page.

The people it covers are broader than the word “visitor” suggests: clients in reception, a courier at the loading dock, a tradesperson in the ceiling, an auditor in for the afternoon, a job candidate, a parent at a school office. If they are inside your gate and not on your payroll, they belong on the list.

Every state and territory except Victoria has adopted the model Work Health and Safety laws. Western Australia was the most recent: its Work Health and Safety Act 2020 took effect on 31 March 2022. Under those laws a PCBU (a person conducting a business or undertaking) must, so far as is reasonably practicable, look after the health and safety of its workers, and must also make sure that the health and safety of other persons is not put at risk by its work. That second duty covers the people signing in at your front door. Whoever manages or controls a workplace also has to keep the workplace, and the ways in and out of it, without risks to anyone who is there.

Visitors carry a duty of their own: anyone at a workplace must take reasonable care for their own safety and comply with reasonable instructions, such as signing in or reading the site rules.

Victoria is the exception.Its main workplace safety law is still the Occupational Health and Safety Act 2004, and the duty sits with the “employer” rather than a PCBU. The substance is similar: an employer must ensure, so far as is reasonably practicable, that people other than its employees, including visitors and the public, are not exposed to risks from its work.

Under regulation 43 of the model WHS Regulations, a PCBU must prepare, maintain and implement an emergency plan for the workplace. It has to cover an effective response to an emergency, evacuation procedures, notifying emergency services, medical treatment and assistance, and effective communication between whoever coordinates the response and all persons at the workplace. It also has to cover testing of those procedures, including how often, and the plan must take into account the number and composition of the workers and other persons at the workplace. The national code of practice on the work environment adds two practical expectations: that emergency procedures account for visitors, shiftworkers and tradespeople, and that someone is responsible for accounting for everyone on site during an evacuation.

Victoria has no single regulation that requires every workplace to have an emergency plan, but WorkSafe Victoria’s compliance code expects employers to have an emergency management plan that includes the controlled exit of people from the workplace, and its guidance asks whether someone is responsible for accounting for employees, contractors, customers and visitors in an evacuation, suggesting attendance records for the purpose.

Most organisations plan against AS 3745-2010, Planning for emergencies in facilities, the Australian Standard regulators point to for emergency planning committees, wardens and evacuation exercises. WorkSafe Victoria notes that it recommends an evacuation drill at least annually. The Standard is not law on its own; it becomes binding where a regulation, a building approval or a contract calls it up. Queensland goes further in law: under the Building Fire Safety Regulation 2008, building occupiers must have a fire and evacuation plan, carry out an evacuation at intervals of not more than one year, and keep a record of each one.

In practice, all of that comes down to someone standing at the assembly point working out whether anyone is still inside. A paper book cannot answer that reliably. Almost nobody signs out, so by mid-afternoon it lists people who left at 10am; it is one physical object, usually on the counter you are evacuating away from; and after a notifiable incident, which you must report to your state or territory regulator immediately, it is a poor record of who was present and when. A visitor management system does not remove the duty. It gives the person running the evacuation a live roll on their own phone, including everyone who arrived after the clipboard went to a meeting, and a record you can use to evidence the drill afterwards.

A visitor record is personal information: a name, usually a phone number or email address, often a company, the host they came to see, and the times they arrived and left. The Privacy Act 1988 and its 13 Australian Privacy Principles (APPs) apply to Australian Government agencies and to organisations with an annual turnover above $3 million. They also apply to some smaller organisations regardless of turnover, including health service providers, private schools, child care centres, businesses that trade in personal information, and Commonwealth contractors. At the time of writing the small business exemption still applies; the government has released draft reforms for consultation, and they do not remove it. Even where the APPs do not bind you, they are the standard visitors expect.

The principles that matter most for a sign-in record:

• APP 3, collection. Collect only what is reasonably necessary to run a safe site. Health questions or biometrics are sensitive information and generally need consent.
• APP 5, notification. Tell people at the sign-in screen who is collecting their details, why, and where your privacy policy explains access, correction and complaints.
• APP 6, use and disclosure. Details collected for site safety should not quietly become a marketing list.
• APP 8, overseas disclosure. Where your visitor data is hosted, and who can reach it, matters. Ask any provider, including us.
• APP 11, security and retention. Keep records secure, and destroy or de-identify them once you no longer need them. In practice that means choosing a retention period and applying it.
• APP 12 and 13, access and correction.Be able to find, show and correct a visitor’s record if they ask.

If a data breach is likely to result in serious harm, organisations covered by the Act must notify the OAIC and the people affected under the Notifiable Data Breaches scheme. And since 10 June 2025, people can sue for serious invasions of privacy that are intentional or reckless, under a statutory tort that is not limited to organisations covered by the APPs.

This is where the paper book fails a second time. Every person who signs in can read the names, employers, phone numbers and hosts of everyone before them, which is exactly the unauthorised disclosure APP 11 asks you to guard against. A system that shows each person only their own form closes it. How Entrica handles the records it holds is set out in our privacy policy and on the security page.

Construction. The principal contractor must prepare a written WHS management plan before work starts, including site-specific safety rules and how everyone at the workplace is told about them, and workers need general construction induction training (the white card). A sign-in step that records acceptance of the site rules is an easy way to show that everyone who came through the gate was told.

Schools.Requirements vary by state and sector. Victorian government schools, for example, must record every visitor arriving and departing during school hours and keep that record for emergencies and investigations. NSW public schools use the Department of Education’s own School Visitor Check-In system, so a third-party system there is a question for independent and Catholic schools rather than government ones.

Ask to see the evacuation roll, not a screenshot of it. Can the warden open it on their own phone, outside the building? Can several wardens work the same list at once, and see each other’s ticks? Can people confirm they are safe themselves, so the list that remains is the list of people to go looking for?

Check what happens when people forget to sign out. Without automatic sign-out, the on-site list fills with people who left hours ago, and a roll of ghosts can send someone back inside.

Record the acknowledgement. If people must accept site rules or an induction before entry, you want that attached to the visit with a timestamp, not on a laminated sign nobody can prove was read.

Choose the doorway before the hardware. A staffed reception suits a tablet; a gate, a yard or a site with several entrances usually suits a printed code or a tag. We have written up QR code visitor sign-in, NFC visitor sign-in and tablet kiosk sign-in separately. If you are comparing products, our comparison with Sine is sourced and dated.

Entrica’s emergency capability is in the Core plan, not an upgrade. Core includes the evacuation list (the live roll of who is on site, shared by everyone working the evacuation), emergency alerts by SMS and email, mark safe / self-safe so people can be accounted for or confirm their own status from a link in the alert, an emergency PDF you can carry out of the building, and an emergency sign-in block that stops new arrivals signing into a site that is being evacuated. Core also covers QR, NFC or tablet kiosk sign-in (one location, one device), sign-out, host search, host email on arrival, automatic sign-out and activity logging.

Company policies and digital signature, the pieces you need if visitors have to accept site rules or an induction before entry, are in the Professional plan, along with pre-registration, digital badges, SMS notifications and multi-site support. The full split is on the features page, and the plans are on pricing.

What Entrica does not do is make the decisions for you. It is a visitor management system, not a compliance programme or legal advice. Your emergency plan, your wardens, your drills and your judgement about what is reasonably practicable remain yours; the system is the part that makes them workable on a Tuesday afternoon with a half-full building.