Most building managers don't think of their visitor sign-in book as a privacy document. It's just the book on the front desk. Everyone fills it in. It's always been there.
But under the Privacy Act 1988 (Cth), that book is a collection of personal information — and the way you collect, store, and eventually dispose of it carries real legal obligations.
Does the Privacy Act Apply to My Building?
The Privacy Act applies to organisations with an annual turnover of more than $3 million, as well as certain smaller organisations that handle health information or are related to larger entities. Many body corporates fall below the $3 million threshold. However, there are three important catches.
The Territory Catch
The Northern Territory has its own Information Act 2002 (NT), which contains privacy provisions that apply broadly to NT public sector bodies. Body corporates in the NT operating under the Unit Title Schemes Act 2009 should be aware of this additional layer of obligation.
The Reputational Catch
Even if you're technically exempt, the reputational risk of a privacy incident is the same. A visitor's personal details being accessed by an unauthorised person — from a sign-in book left open on the desk, a drawer anyone can open, or a book thrown in the bin at year's end — is a real incident regardless of whether it triggers a formal regulatory obligation.
The Contractor Catch
If your strata management company has an annual turnover above $3 million (as many do), the Privacy Act applies to them — and visitor data they collect or hold on your behalf may be caught by that.
For practical purposes, it's worth treating your visitor records as if the Privacy Act applies, regardless of your technical status.
What Personal Information Does a Sign-In Book Collect?
A typical visitor sign-in book collects full name, company or employer, mobile phone number, reason for visit, and signature. This is personal information under APP 3. The Australian Privacy Principles require that personal information only be collected if it is reasonably necessary, collected by lawful and fair means, and not collected in an unreasonably intrusive way.
On that last point: an open sign-in book on a front desk, visible to every subsequent visitor, is inherently intrusive. Anyone who signs in can see the names, phone numbers, and employers of everyone who signed in before them.
What Are the Key Obligations?
APP 1 — Transparency
You must have a clear privacy policy and make it available to individuals before or at the time of collecting their information. Does your building have a posted privacy notice near the sign-in book? Does it explain why you're collecting visitor details, who will see them, and how long they'll be kept? Most buildings don't. An “I agree to have my details recorded” line in a sign-in book doesn't cut it.
APP 3 — Collection
Only collect what you need. A visitor sign-in book often collects more than is necessary or doesn't collect enough to be useful in an incident. A well-configured digital system collects exactly what's needed — no more, no less.
APP 6 — Use and Disclosure
Visitor information must only be used for the purpose it was collected. If you collect a visitor's mobile number for building security purposes, you can't use that list to send a newsletter.
APP 11 — Security
You must take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access. A sign-in book sitting on an open desk, accessible to anyone who walks past, does not meet this standard.
APP 11.2 — Destruction
When personal information is no longer needed, you must destroy or de-identify it. What happens to your old sign-in books? Are they shredded? Or do they go in the recycling?
The Notifiable Data Breaches Scheme
For organisations covered by the Privacy Act, the Notifiable Data Breaches (NDB) scheme requires notification to both the OAIC and affected individuals when a data breach is likely to result in serious harm.
A sign-in book being stolen, lost, or photographed by an unauthorised person could constitute an eligible data breach. So could a book being thrown in the general bin without shredding. The cost of managing an NDB notification — internal investigation, legal advice, individual notifications, OAIC reporting — runs into thousands of dollars before you've even considered any legal liability.
What Does a Compliant Visitor Management System Look Like?
A compliant approach should collect only what's needed, make the purpose clear to visitors at the time of collection, restrict access so previous records aren't visible to new visitors, store records in an encrypted access-controlled system, dispose of records securely when no longer needed, and provide a searchable audit trail for incidents.
A digital sign-in screen can display a brief privacy notice before a visitor submits their details. Each sign-in is its own record in an isolated database. Records can be automatically archived and deleted after a configurable period. And in the event of an incident, a report can be produced in seconds.
Switching to a digital visitor management system isn't just a convenience upgrade. It's the step that closes the gap between what your current process does and what your legal and ethical obligations actually require.
Built for compliance from day one
OchreKiosk was designed by building managers who understood this gap from the inside. Privacy notice on sign-in, encrypted per-customer database, automatic record retention controls — compliance built in, not bolted on.
See All Features →