Office Visitor Checks: Front of House Security Guide (2026)
How office security and reception teams can check visitor identity quickly, stop tailgating and social engineering, and keep visitor data compliant with UK GDPR.
This article is general guidance and is not legal advice. Always follow your employer’s policy and your site’s assignment instructions.
Every office building has one door that matters more than the others: the front door. Front-of-house security officers decide, dozens of times a day, who gets in. Check too slowly and visitors wait, hosts complain and queues form. Check too loosely and the building is open to theft, data breaches and people with worse intentions.
The good news is that speed and security are not opposites. With the right process, a well-trained officer can check in most pre-registered visitors in under a minute, before the host arrives to collect them.
Key Takeaways
- Pre-registration is the single biggest time saver at reception.
- Check photo ID against the person and the booking, then confirm with the host.
- Visitor passes should be visible, dated and recovered at sign-out.
- Tailgating and fake contractors are the most common ways in, so challenge politely.
- Visitor records are personal data, so UK GDPR applies.
Why visitor verification matters
Unauthorised access is behind many workplace security incidents. An unchecked visitor can steal laptops and phones, photograph confidential documents, plug a device into the network, or map out a building for a later crime. In some cases, people carry out hostile reconnaissance, studying a site before an attack.
Good visitor checks also help in emergencies. If the fire alarm sounds, the visitor list tells fire marshals who is in the building and who still needs to be found. Insurers, clients and auditors increasingly expect to see a clear, documented visitor process.
Martyn’s Law (the Terrorism (Protection of Premises) Act 2025) does not list offices as qualifying premises. However, many office buildings share space with shops, restaurants or event areas that hold 200 or more people, and those parts may be covered when the law comes into force, expected in 2027. Strong visitor control is good practice either way.
What "efficient" really means at reception
An efficient process does three things at once:
- It knows who is coming. Most visitors should be expected before they arrive.
- It checks only what matters. Name, photo ID, host and purpose. Not a long interview.
- It hands responsibility to the host. The visitor is collected, escorted and signed out by the person they came to see.
Want to work front of house?
The SIA Security Guard course covers access control, patrolling and conflict management, with Emergency First Aid on day one.
Visitor types and how to handle them
Different visitors need different checks. Use this table as a starting point and follow your site’s assignment instructions.
| Visitor type | Key checks | Common risk |
|---|---|---|
| Business guests | Pre-registration, photo ID, host collection | Wandering unescorted |
| Contractors | Named on planned works list, company ID, site induction, permit to work | Unplanned “maintenance” visits |
| Couriers and delivery drivers | Company, parcel details, delivery area only | Using a delivery to reach office floors |
| Interview candidates | Name on HR list, photo ID, host collection | Arriving with unannounced guests |
| Unexpected visitors | Purpose, photo ID, contact the named person before admitting | Social engineering and pretexting |
| VIPs and executives’ guests | Pre-registration and discreet but full checks | Staff skipping checks to avoid awkwardness |
When a visitor cannot show ID
Office buildings are private property, so security can refuse entry under the building’s access policy. Refusal should be the last option, not the first. Contact the host, explain the situation and ask them to come to reception and identify the visitor in person. If the policy allows it, the host can then sign the visitor in and stay with them for the whole visit. Record what was agreed in the visitor log. If the host cannot be reached, the visitor waits in reception or rebooks.
The six-step visitor verification process
1. Pre-register every expected visitor
Ask hosts to register guests in advance, through a visitor management system, email or a shared list. Record the visitor’s name, organisation, date, arrival time and host. Pre-registered visitors can be checked in quickly, and anyone who is not expected stands out immediately.
2. Greet and ask for photo ID
Welcome the visitor and ask for photo ID, such as a passport, a photocard driving licence, a national identity card issued by another country (for example an EU or EEA country), or an official work ID from a known organisation.
3. Check the ID properly
Look at the document, not just the name. Check that:
- the photo matches the face in front of you;
- the name matches the booking;
- the document is in date and not visibly damaged or altered;
- the details make sense, for example the age matches the person’s appearance.
4. Confirm with the host
Call or message the host to confirm the visit. Ask them to come down and collect the visitor. Never send a visitor up to an office floor alone just because they say they are expected, however confident they seem.
5. Issue a visible, time-limited pass
The pass should show the visitor’s name, the date and whether an escort is required. Use colour-coding or daily designs so an old pass cannot be reused. If access cards are issued, set them to expire at the end of the day and limit them to the floors needed.
6. Brief, then sign out
Tell visitors where the fire exits and assembly point are, and what to do if the alarm sounds. At the end of the visit, record the sign-out time and collect the pass. Deactivate any card that is not returned. Ask whether the visitor would need any help to leave the building in an emergency, and tell the host and the fire marshal if they would.
Spotting social engineering at the front desk
Many unauthorised entries rely on confidence, not force. Watch for these common tactics:
- The busy professional. “I’m late for a meeting with the director, just let me through.” Urgency is a pressure tactic. Stay polite and follow the process.
- The uniform. Hi-vis jackets, lanyards and clipboards make people look like they belong. Always check against the works list.
- The name-dropper. Knowing a senior name is not the same as having an appointment. Call the person.
- The helper. Someone carrying boxes who asks you to hold the door.
- The tailgater. Following a member of staff closely through a turnstile or door.
Also look out for unusual interest in cameras, exits or shift patterns, and people taking photos of access control points. Record and report these behaviours even if the person leaves. Report suspicious behaviour to your control room or supervisor straight away. Non-urgent concerns can be passed to the police on 101 or to the Anti-Terrorist Hotline on 0800 789 321. If there is an immediate threat, call 999.
Licence expiring? You need refresher training first
Door supervisors and security guards must complete SIA refresher training before they renew. One and two-day courses run across London and in Birmingham, Liverpool and Manchester, from £200.
Centres include Stratford, Aldgate and Bethnal Green.
How to challenge someone politely
Many staff avoid challenging people because it feels rude. A friendly, consistent script solves this:
- “Good morning, can I help you? Who are you here to see today?”
- “No problem, I’ll just give them a quick call to let them know you’re here.”
- “Sorry, I can’t let you through without a pass, but I can get this sorted for you.”
Keep the tone helpful. Genuine visitors appreciate good security. People with bad intentions often leave when they realise they will be checked.
Stopping tailgating
Tailgating is one of the most common ways into an office. Effective controls include:
- speed gates or turnstiles that only allow one person per card;
- an officer positioned where they can see the gates;
- staff awareness campaigns so employees do not hold doors for strangers;
- door-held-open alarms on side and rear entrances;
- regular patrols of fire exits, loading bays and smoking areas.
Keeping visitor data compliant with UK GDPR
Visitor records contain personal data, so the UK GDPR and the Data Protection Act 2018 apply. The Information Commissioner’s Office (ICO) publishes guidance for organisations. In practice:
- Collect only what you need. Name, company, host and times are usually enough.
- Keep records out of sight. Paper visitor books that show earlier visitors’ details to everyone are a privacy risk.
- Do not copy ID documents unless there is a clear, documented reason.
- Set a retention period and delete records when it ends.
- Provide a privacy notice at reception or in the pre-registration email.
- Know your lawful basis. For most offices this is legitimate interests: keeping people and property safe. Write it down.
- Take extra care with biometrics. Facial recognition or fingerprint sign-in uses special category data and needs a data protection impact assessment before it is switched on.
Visitor checks in multi-tenant buildings
In most London office buildings, the landlord’s security team runs the ground-floor reception and each tenant has its own reception upstairs. Agree in writing who checks ID, who issues passes and who keeps the visitor record. Without this, each desk assumes the other one has done the check.
Produce an instant evacuation list for the fire roll call
Digital visitor management systems can send QR code invitations, print badges, notify hosts automatically and create instant fire rolls. They save time, but they only work if officers use them properly. Technology cannot tell when a photo does not match a face, or when a “contractor” has no real reason to be there. A trained, alert officer is still the most important control.
What employers look for in front-of-house security officers
Corporate reception work offers a professional setting, mostly daytime hours and a route to supervisor roles. Employers usually ask for:
- an SIA licence. Officers supplied under contract to guard premises normally need a Security Guard licence, and a Door Supervisor licence also covers this work
- an Emergency First Aid certificate
- ACT counter-terrorism awareness
- a CCTV licence if the role includes the control room
- strong customer service and clear written reports
You can book the SIA and first aid courses at our partner centres in London. ACT is free online through ProtectUK, and our ACT training guide shows you how.
Measuring success at front of house
Track a few simple measures to keep standards high:
- average check-in time for pre-registered visitors;
- percentage of visitors pre-registered;
- number of passes not returned;
- tailgating incidents recorded;
- results of internal “test visitor” exercises.
Managing a reception or security team? Ask us about group bookings for first aid and SIA training.
Start your career in corporate security
Access control, customer care, emergency procedures and reporting are all covered on the SIA Security Guard course. Train at one of our London centres and get ready for office and front-of-house roles.