See what visitor control is, the difference between a visitor and a contractor, what Brazil's LGPD requires regarding their data, and a step-by-step guide to organising the gate.
By: Vitória Willemann
Content based on Brazil's General Data Protection Law (LGPD, Law No. 13,709/2018), consulted on 11/11/2026.
Visitor control is the process of recording who enters the company without working there, such as customers, suppliers attending meetings, auditors and job candidates. It defines who authorised the visit, which areas the person may access, who accompanies them and when they left. Because it involves personal data, registration must comply with the LGPD.
| Topic | What to consider |
|---|---|
| Who is a visitor | Anyone who enters without performing a service: customers, suppliers in meetings, auditors, candidates, delivery drivers |
| Difference from a contractor | A contractor performs a contracted service and needs documents and training; a visitor does not perform a service |
| Personal data | Registering a visitor is processing of personal data and must comply with the LGPD (Law No. 13,709/2018) |
| Photos and biometrics | Biometric data is sensitive personal data (LGPD, art. 5, II) and may only be processed in the cases set out in art. 11 |
| Safety during the visit | Visitors in operational areas need a safety briefing, PPE and an escort |
It is the set of rules the gate follows to receive people who do not work at the company. Good control answers five questions: who the person is, who invited them, where they are going, who is accompanying them and what time they left.
In offices, the focus is usually property security. In industry, occupational safety also comes into play: a visitor walking through the production area is exposed to the same risks as the people who work there.
A contractor is a professional from a contracted company who will carry out a service, such as maintenance, cleaning or construction. Before entering, they must have up-to-date documents and training, because they will be working at the plant.
A visitor does not perform a service. Their control is simpler, but it cannot be skipped: registration, authorisation, briefing and escort.
If the person is going to do any work, even something quick, they are no longer a visitor and must go through contractor access control.
Ask only for what is necessary to identify the person and control the visit:
Photos and biometrics should only be used when there is a clear need. Under the LGPD, biometric data is sensitive personal data (art. 5, II). It may only be processed with specific consent or, without consent, in the cases set out in art. 11, such as fraud prevention and the data subject's security in identification and authentication processes (art. 11, II, g).
When a visit goes through operational areas, some precautions are basic:
In an emergency, the gate needs to know how many visitors are on site and where. That is why recording exits is just as important as recording entries.
| Method | How it works | Limitation |
|---|---|---|
| Logbook or spreadsheet at the gate | The gatekeeper writes down the name, document and time | Hard to search and no reliable exit control |
| Pre-registration by the host | Whoever invites the visitor registers them before the visit | Depends on the host remembering to register them |
| System with badge or QR Code | The visitor receives a badge or code valid only for that day | Requires integration with the gate |
| Turnstile with facial recognition | The turnstile lets in the registered visitor | Involves biometric data and requires care with the LGPD |
Do you also receive service providers? See how contractor access control works.
It is the process of recording and authorising the entry of people who do not work at the company, such as customers, suppliers attending meetings and auditors. It defines who authorised the visit, which areas can be accessed, who accompanies the visitor and the time they left.
A service provider, or contractor, carries out contracted work and must have up-to-date documents and training. A visitor does not perform a service. If the person is going to do any work at the plant, they must go through contractor control.
Yes, but with care. Under the LGPD, biometric data is sensitive personal data (art. 5, II) and may only be processed in the cases set out in art. 11, such as specific consent or fraud prevention and the data subject's security in identification processes.
If the visit goes through areas with risks that require PPE, yes. The visitor must receive equipment suited to the area, be briefed on the risks and be escorted throughout the visit.
To know who is still on site. In an emergency or evacuation, the company needs to account for everyone present, and a visitor without a recorded exit may be searched for unnecessarily or, worse, forgotten.
Learn what a plant shutdown is, what Brazil's NR 13, NR 33 and NR 35 require during the shutdown, and how to control contractors and work permits.
See what contractor access control is, what Brazil's Law 6,019 requires of the contracting company, what to check before granting entry and how to use biometrics in line with the LGPD.
Understand what MoC (management of change) is, what Brazil's NR 20 and NR 13 require when something changes in the operation, and how to build a 7-step MoC process.
Understand what NR 29 is, who it applies to, the role of the OGMO, SESSTP and CPATP, the inspection of lifting equipment and the rules for dangerous cargo.
Understand what NR 28 is, how labour inspection works, how fines are calculated (I1 to I4), the criteria for shutdowns and the standard's update for agribusiness.
Understand what NR 26 establishes, the official rules for safety signage, the use of the GHS in labelling and the preparation of the Safety Data Sheet.
Simplify your Risk Management, reducing liabilities and ensuring safe, standardized, and auditable operations with fast implementation and advisory support.
