Complete guide · Visitor registration in Norway
Visitor registration: legal requirements, GDPR, NIS2 and the path to digital solutions.
Visitor registration is documentation of who arrives and leaves the business premises. This guide gives Norwegian businesses a complete picture of which rules actually apply, what the Data Protection Authority says – and how digital visitor registration meets the requirements without manual work.
- What is visitor registration?
- Why more important now
- Legal requirements in Norway
- GDPR and the Danish Data Protection Agency
- NIS2
- HSE and evacuation
- Paper vs. digital
- This is how it works
- Choosing a system
- Frequently Asked Questions
30 000
guests are registered daily in onVisit
3 000+
Norwegian and international businesses
10-90 days
recommended storage time with automatic deletion
2026
NIS2 is expected to be implemented in Norwegian law
Definition
What is visitor registration?
Visitor registration is the process of documenting who arrives and leaves a business’s premises. It sounds trivial – and it was, as long as a receptionist stood at the front desk with a book and a pen. In 2026, the picture is different: regulations are stricter, security requirements are higher, and expectations from guests and employees are more professional.
In practice, visitor registration covers a series of events:
- Advance invitation with practical information for the guest
- Arrival and check-in – manually, via kiosk or with QR code
- Notification to host, typically via SMS or email
- Any confirmation of HSE instructions, confidentiality agreement or ID verification
- Access through gates, doors and locks
- Check-out upon departure
- Automatic deletion in line with privacy regulations
Additionally, a professional setup provides two important byproducts: a real-time evacuation list , and an audit log for safety and compliance work.
Background
Why visitor registration is becoming increasingly important
Three parallel trends have made visitor registration a topic that management teams, IT managers, and HSE managers are actively discussing.
1
The regulations have tightened
The 2018 GDPR set clear boundaries for the processing of personal data about guests. NIS2 expands the requirements for critical infrastructure to include traceability and access control. The Norwegian Data Protection Authority has repeatedly stated that paper-based solutions rarely satisfy the data minimization principle.
2
The reception has changed.
Hybrid work models, shared commercial buildings and pressure to streamline have made the full-time reception a costly setup that many no longer see the value of. At the same time, guests expect a professional arrival experience.
3
The security picture is more complex
Norwegian businesses – from municipalities to industry – are experiencing increased risk of both physical and cyber threats. An up-to-date overview of who is in the building is part of basic security.
Did you know?
30,000 guests are registered every single day in onVisit. This is spread across 3,000+ Norwegian and international businesses – from the Municipality of Oslo and DNB to SINTEF and industrial companies along the entire coast.
Regulations
Legal requirements for visitor registration in Norway
Many people ask whether visitor registration is required by law in Norway. The answer is nuanced: no single law states "all businesses must register visitors". However, several regulations create direct and indirect requirements that in practice make digital visitor registration necessary.
Hunting
Working Environment Act Section 3-1
The employer must "ensure that systematic health, environmental and safety work is carried out". In practice: documented routines for evacuation - which require knowing who is in the building.
Regulation
Internal control regulations
Specific requirements for documented routines for the allocation of responsibilities, risk mapping and follow-up of measures. Visitor registration is part of this documentation for most businesses.
Hunting
Security Act
Security-approved businesses – offshore, defense, critical infrastructure – are required to have documented access control. Here, visitor registration is a prerequisite for maintaining approval.
Directive
NIS2 (expected in Norway 2026)
For businesses in critical and important sectors – energy, transport, health, finance, water and digital infrastructure – NIS2 requires both physical and logical access control, with access logs and traceability.
Hunting
The Personal Data Act and GDPR
If you register visitors, you are subject to the Personal Data Act and GDPR. This is where most businesses go wrong – often with paper-based solutions.
onVisit
Built for NIS2 and GDPR
Operating in Microsoft Azure in the EU, ISO/IEC 27001-based management system, encryption in transit and at rest, and 24/7 monitoring from Visma Security Center. Data processor agreement and documentation for purchasing and auditing on request.
Data Privacy (GDPR)
GDPR and visitor registration – what the Norwegian Data Protection Authority actually says
When you register a visitor, you are processing personal data. GDPR applies in full. Here are the most important things from the Norwegian Data Protection Authority's statements about visitor registration.
Art 6
Legal basis – not consent
The most common basis is legitimate interest (GDPR art. 6 no. 1 letter f). The Norwegian Data Protection Authority has pointed out that consent can hardly be "freely given" when registration is a condition for access.
Art 13
Obligation to provide information
The visitor has the right to information about the processing before it takes place. A good visitor system shows this directly in the registration flow – not in a long privacy statement that no one reads.
Art 5
Data minimization
Don't collect more than the purpose requires. Do you really need a social security number, license plate number, or photo? Each field must be justified.
Art 5
Storage limitation
Data should not be stored longer than necessary. Recommended practice is 10–90 days with automatic deletion. Configurable retention time is a minimum requirement for a serious visitor system.
Art 28
Data Processor Agreement
If you use an external supplier, the supplier is the data processor and you are the data controller. GDPR requires a signed data processing agreement.
Roller
Who's in charge?
The business receiving visitors is the data controller for the visitor registration. The provider of the visitor system is the data processor and acts on their instructions.
Common mistake: paper-based guestbook
The Norwegian Data Protection Authority has concluded that a paper-based guest book where guests can read each other's names and companies normally violates the GDPR principles of data minimization and confidentiality. Many Norwegian businesses still have such books – without knowing that they are breaking the law every day.
Critical infrastructure
The NIS2 Directive and visitor registration
NIS2 (Network and Information Security Directive 2) is expected to be implemented in Norwegian law in 2026 and tightens security requirements for businesses in critical and important sectors. Many people think of NIS2 as “something the IT department handles” – but the directive sets requirements that directly affect visitor registration.
This requires NIS2 of the visitor registration
- Physical and logical access control must be documented and traceable
- Access logs shall be maintained and available to supervisory authorities.
- Supplier risk must be assessed and documented – also for the visitor system supplier
- Incident management requires knowing who was in the building during an incident
How a digital visitor system contributes
A digital visitor system contributes to NIS2 compliance on all these points: encrypted access logs, documented deletion in line with retention policy, integration with access control and supplier transparency via data processing agreement.
As part of the Visma Group, onVisit delivers the subcontractor transparency that NIS2 requires – something smaller, independent suppliers often cannot offer.
HMS
HSE, evacuation and the requirements of the Working Environment Act
The most important practical argument for visitor registration is simple: during an evacuation, the fire chief needs to know who is in the building. Without that, it is impossible to verify that everyone has made it out.
praise
What does the law say about evacuation?
The Working Environment Act's requirements for systematic HSE work, combined with the Fire Prevention Regulations, require documented evacuation routines. In practice: an updated overview of everyone in the building – including guests, suppliers and electricians who "just happened to be dropping by."
The tool
The digital evacuation list
The list is automatically generated and updated in real time. The fire safety manager retrieves it on his mobile phone at the meeting point – not from a computer at a reception that may not be available. Guests receive an SMS notification with the meeting point.
Oversight
Traceable documentation
After a fire, accident or other critical incident, regulatory authorities often require documentation of who was present. A digital visitor log provides this immediately; a paper book is often incomplete or damaged.
Comparison
Paper-based vs. digital visitor registration
Many Norwegian businesses still have paper-based visitor registration – a book at the reception or a spreadsheet that the receptionist updates manually. Here's an honest comparison.
| Requirements / function | Paper book | Digital visitor registration |
|---|---|---|
| GDPR – other guests cannot see data | No – violation | Ja |
| Automatic deletion after X days | No – manually | Ja |
| Notification to host upon arrival | No – phone call | Yes – automatic SMS/email |
| Evacuation list available on mobile | in this | Ja |
| Audit traceability | Limited | Full audit log |
| Scales to multiple locations | in this | Ja |
| Pre-registration from Outlook | in this | Ja |
| HSE instructions at check-in | Rarely in practice | Yes – configurable |
| Requires receptionist | Ja | Optional |
| Cost per month | Almost zero | From approx. 1,700 kr |
The only real argument for paper is the price – and even that quickly fades when you factor in the cost of a receptionist or the risk of a privacy breach.
The process
How digital visitor registration works
A modern visitor system like onVisit handles the entire visitor flow through five connected steps.
1
Pre-registration via Outlook
The host sends a regular meeting invitation in Outlook or Google Calendar. The system captures it and sends the guest a confirmation with meeting time, address, map, parking, public transportation, any HSE instructions, and a unique QR code.
2
Arrival and check-in
QR code on your own mobile, touch-free and without queues – or self-service kiosk screen on iPad/Surface – or registration by receptionist where the reception is staffed.
3
Notification and access
The host is immediately notified via SMS or email. With integration with access control, the QR code opens relevant locks and doors. If necessary, identity is verified with BankID.
4
During the visit
The guest is on the evacuation list, and the fire manager has a real-time overview. If the visit lasts longer than planned, the system can send reminders or extend access.
5
Checkout and deletion
The guest checks out using a QR code or kiosk. After a configured retention period (typically 10–90 days), all personal data is automatically deleted.
Would you like to see onVisit in practice?
30-minute demo with the product team. We show you exactly what the flow looks like for your situation – staffed or unstaffed reception, single or multi-location.
Checklist
How to choose the right visitor system
The market for visitor registration in Norway has grown rapidly. This is something we recommend Norwegian buyers to look out for – regardless of whether you end up with us or a competitor.
1
Data storage within the EU/EEA
Data must be stored in jurisdictions that comply with Norwegian data protection legislation. Ask specifically where data is stored, and demand a written answer.
2
Data processing agreement as standard
Should be included – not something you have to negotiate. If DBA is only offered on demand, it's a red flag.
3
Configurable storage time
GDPR requirements. If the storage period is fixed or the deletion is manual, the solution is not mature enough.
4
Norwegian technical support
When something doesn't work on a Monday morning, you want to talk to someone who understands Norwegian requirements, the Norwegian language, and Norwegian working hours.
5
Scalability
Even if you start with one location: check that the system can handle multiple locations without a costly upgrade.
6
Integration with existing tools
Outlook, Microsoft 365, Google Workspace, Entra ID, access control, BankID. A system that is an isolated island is forgotten.
7
Supplier stability
Check credit rating, ownership and history. AAA rating, long-term owners and 10+ years of operation are good signals.
8
Clear pricing
Per location? Per user? Per guest? Commitment period of 3–5 years? Request a binding offer that includes all price elements.
Prices and packages for onVisit can be found on the price page.
Frequently Asked Questions
Frequently asked questions about visitor registration
What is visitor registration?
Visitor registration is the process of documenting who arrives and leaves a business’s premises. It can be done paper-based with a visitor book or digitally with a cloud-based visitor management system. The registration typically includes the guest’s name, company, contact person, arrival time and departure time – and serves as documentation for security, evacuation, GDPR compliance and HSE.
Is visitor registration required by law in Norway?
No single law requires all companies to register visitors. However, several regulations create indirect requirements: the Working Environment Act § 3-1 requires an overview of who is in the building during evacuation, the Internal Control Regulations require documented HSE routines, security-approved companies are obliged to have access control, and NIS2 requires access logs for critical infrastructure.
What rules apply to visitor registration under GDPR?
Visitor registration is the processing of personal data, and GDPR fully applies. The business must have a legal basis (typically legitimate interest), inform the visitors, collect a minimum amount of data, delete it automatically after a defined period of time, and enter into a data processing agreement with an external supplier. According to the Norwegian Data Protection Authority, paper-based visitor books where guests see each other's data are rarely GDPR-compliant.
How does visitor registration comply with the NIS2 directive?
NIS2 requires documented access control and traceability for businesses in critical infrastructure. A digital visitor system contributes with encrypted access logs, documented deletion in line with retention policy, integration with access control and supplier transparency via data processing agreement.
What is the difference between paper-based and digital visitor registration?
Paper-based guestbooks are easy to set up, but all guests can read each other's data (GDPR violation), deletion is not automatic, the host is not notified, and the evacuation list must be handled manually. Digital guest registration solves this with encrypted storage, automatic deletion, SMS notification, and evacuation list on mobile.
How long can we store visitor data?
The law does not set a fixed deadline, but the GDPR principle of storage limitation applies. For typical visitor registration, 10–90 days is recommended, longer only for specific security or audit needs. onVisit supports configurable storage time with automatic deletion.
What does the Danish Data Protection Agency say about visitor registration?
The Norwegian Data Protection Authority has stated that the business receiving visitors is the data controller, while the provider of the visitor system is the data processor. Paper visitor books where guests see each other's data normally violate the GDPR. The legal basis is typically legitimate interest, not consent.
How is visitor registration used during evacuation?
In the event of a fire or other evacuation, the fire chief must know who is in the building. A digital visitor system provides a real-time evacuation list on mobile for fire chiefs and guards, and the list is automatically updated when guests check out.
Can visitors register from their own mobile phone?
Yes. A QR code at the reception or on the front door is scanned with the guest's own phone, the registration form opens in the browser, and no app is required.
Is consent from the visitor required?
Usually not in the GDPR sense. Legal basis is typically legitimate interest (security, evacuation). The Data Protection Authority recommends this because consent is difficult to be voluntary when registration is a condition for access.
Ready for digital visitor registration?
We show how onVisit solves GDPR, NIS2 and HSE in one flow. 30 minutes, no obligations, customized quote within 24 hours.
Read more