Do visitor sign-in logs count as records, and how long do we keep them?

Yes, visitor sign-in logs are almost always records. A record is information created or received in the course of doing business that documents an activity, regardless of format. A sign-in sheet, kiosk database, or badge-system export documents who was on your premises, when, and often why. That evidentiary value is exactly what makes it a record rather than a disposable scrap of paper.

Why sign-in logs qualify as records

The test is function, not format or perceived importance. Visitor logs support several legitimate business needs:

• Security and safety — knowing who was in a facility during an incident or emergency evacuation.
• Access control and audit — verifying that escort, clearance, or restricted-area rules were followed.
• Legal and investigative — responding to subpoenas, litigation holds, or internal inquiries.

Because they serve these functions, they should be captured, protected, and disposed of on a schedule like any other record.

How long to keep them

There is no single universal retention period. The right answer depends on your organization, what the log documents, and the legal environment you operate in. As a principle:

• Routine, low-sensitivity logs (general lobby sign-in) typically carry short retention — often a small number of years — then routine destruction.
• Logs tied to sensitive or controlled areas may need longer retention or may be governed by security, contractual, or sector-specific rules.

Federal agencies should consult the applicable National Archives schedule; many administrative housekeeping records, including facility access logs, are covered by a General Records Schedule that sets a common retention period. Private organizations should map visitor logs into their own retention schedule, informed by any industry, contractual, or jurisdictional requirements.

Practical guidance

1. Classify the record series — define “visitor logs” as a series in your retention schedule rather than treating each sheet individually.
2. Set one defensible period — choose a retention period you can justify and apply it consistently; consistent, scheduled disposition is more defensible than keeping everything forever.
3. Address privacy — visitor logs contain personal information. Limit access, protect them appropriately, and dispose of them securely when retention ends.

The core idea is simple: treat sign-in logs as records, schedule them, and dispose of them on time. For more foundational concepts, see the fundamentals topic hub.