Documents
Part of Visitor management software
Reviewing visitor data retention settings
Review visitor-log retention by mapping invitations, answers, media, messages and exports to the organisation’s records rule.
Review visitor data retention by listing what each visit creates, why it is needed and which copies remain after the configured period. A single disposal setting may not cover invitations, answers, photos, documents, host messages and exports alike.
Establish the records rule first
Ask the organisation’s privacy and records owners to set the purpose and required period for each category. Do not choose a period because it appears in a software menu.
For an entity covered by the Australian Privacy Principles (APPs), APP 11 requires reasonable steps to protect personal information and, subject to exceptions, to destroy or de-identify it when it is no longer needed for a permitted purpose.
A Commonwealth record or a requirement under Australian law or a court or tribunal order may require retention. The APPs do not prescribe one visitor-log period.
Record or copy / Question to resolve
- Invitation
- What remains if it is cancelled or unused?
- Visit entry
- What remains after personal fields are discarded?
- Answers and media
- Do photos, signed documents and uploads follow the rule?
- Host message
- What personal information left the visitor system?
- Export
- Who keeps downloaded lists, and for how long?
- Backup or archive
- What disposal or de-identification route applies?
Review collection as well as retention. APP 3 limits an APP entity’s collection of personal information to what is reasonably necessary for its functions or activities, with additional conditions for sensitive information.
APP 5 requires reasonable steps to notify people of relevant collection matters or ensure they are aware of them.
Key Compliance Requirements Under Australian Privacy Principles (APPs)
- APP 3 – Collection LimitationOnly collect personal information reasonably necessary for functions or activities
- APP 5 – Notification of CollectionReasonable steps to notify individuals about collection matters
- APP 11 – Security of Personal InformationTake reasonable steps to protect personal information; destroy or de-identify when no longer needed
- Retention PeriodNot prescribed by APPs – set based on organisational purpose and legal obligations
Inspect the actual vendor setting
On Envoy’s Visitors Standard and Premium plans, customers can set a location-level retention period, without field-level or sign-in-flow selection. On Enterprise, administrators can select fields and visitor media for disposal.
New sign-in fields are not automatically included in the retention policy, and new visitor flows must be opted in for their corresponding data to be deleted.
Visit and invitation records can remain labelled “discarded” after their personal data has been anonymised.
By default, Envoy retains data indefinitely. Shortening a configured period immediately deletes older covered data and cannot be undone.
Confirm the proposed plan and the treatment of exports before relying on any setting.
For another shortlisted product, request the same details: fields and media covered, treatment of invitations, role permissions, what happens when a period is shortened, and the exit process. A broad privacy statement does not replace a demonstration of the offered controls.
Reconcile a fictional sample
Use fictional entries with only the fields your intended process requires. Write down what should remain at each stage, then ask the supplier to show the setting and a safe demonstration of the resulting record. Do not shorten a live Envoy retention period to test it.
Inspect a host email and a downloaded report separately. Platform disposal cannot remove a copy already sent or saved elsewhere.
Assign owners for those copies and review the configuration whenever the sign-in flow or records purpose changes.
