How long do you keep visitor sign-in logs and building access records, and can you scan and shred the paper sheets?

Visitor sign-in logs and building access records (badge swipes, key-card reads, guard registers) document who entered a facility and when. They are operational security records, and how long you keep them and whether you can scan-and-shred depends on your retention schedule and the purpose the records serve.

How long to keep them

There is no single universal number. Retention is set by your records schedule, which weighs operational, security, legal, and privacy needs. A few principles apply:

• Map them to a schedule. Federal agencies generally cover routine facility access and visitor logs under a General Records Schedule, which typically assigns a short retention measured in a small number of years and then disposal. Many private and state organizations adopt similar short periods.
• Match retention to use. Logs kept only for day-to-day security can have a short life. If a log is tied to an incident, investigation, litigation hold, or a facility under heightened security or classification rules, keep it as long as that obligation lasts — and never destroy records under hold.
• Mind privacy. These logs hold personal data (names, signatures, sometimes ID numbers). Limit retention to what you actually need, restrict access, and dispose of them securely. Over-retention increases privacy and breach risk.

When unsure, set retention in policy with input from security, legal, and privacy stakeholders rather than keeping records indefinitely “just in case.”

Can you scan and shred the paper?

Often yes — but scan-and-shred (digitizing the original, then destroying the paper) is only defensible when the digital copy is trustworthy and complete. Before you shred:

• Confirm there is no legal barrier to destroying the paper original and that your retention period and any holds are satisfied by the digital copy.
• Capture a faithful image. Follow recognized imaging practices so the scan is legible, complete, and accurately reproduces the original, including both sides and any annotations.
• Preserve metadata and integrity. Keep capture dates, indexing, and access controls so the image stays findable and tamper-evident for its full retention period.
• Document the process in a digitization and disposition policy, and destroy both the paper and the eventual digital records securely when their retention ends.

If the paper is the only legally required form, or you cannot verify image quality, retain the originals until you can.

Learn more on the digitization and imaging topic hub.