The front door is a security system: visitors, safety and data at the point of entry

More than a welcome

Walk into most offices, schools, clinics and factories and the first system you meet is a desk, a person and a book. The book asks for a name, a phone number, who you are visiting and the time. Sometimes it asks for an ID card, which is photocopied. You write, you are waved through, and the page stays open for the next visitor to read.

That arrangement does three jobs badly at once. It is meant to control who enters, but anyone can write any name. It is meant to tell the organisation who is inside, but no one can count a handwritten list in an emergency. And it collects personal data, in plain view, with no notice, no retention rule and no security.

This article argues that the front door should be treated as what it is: a security system with three duties. It must know who is inside, let in only the people who should be there, and handle what it collects lawfully. It sets out the evidence on why each matters, what Ghanaian law and international practice expect, and what good looks like in an ordinary organisation.

Duty one: know who is inside

The case for knowing who is in a building rests on a grim fact: emergencies happen, and they happen often.

The Ghana National Fire Service recorded 5,596 fires from January to November 2024, 6.43% more than in the same months of 2023.¹ In the first half of 2025 it recorded 3,595, including 579 commercial and 147 institutional fires, with damage estimated at GH₵188.4 million.² There was better news in early 2026: fires in the first quarter fell by 10% and fire deaths by more than half, though domestic and commercial fires rose slightly and the Service said it would step up fire-safety audits of commercial premises.³

When a building has to be evacuated, the first question for fire crews is whether anyone is still inside. International rules make answering it an explicit duty. In the United States, workplace emergency action plans must include procedures to account for all employees after evacuation.⁴ British government guidance for offices and shops tells employers to hold a roll call at the assembly point as soon as possible, to report anyone unaccounted for to the fire service on arrival, to tell visitors what to do, and to keep records of drills held at least once a year.⁵

The United Kingdom's Grenfell Tower inquiry, whose final report in September 2024 concluded that every death in the 2017 fire was avoidable, led the government in February 2025 to accept all 58 of its recommendations, including ones on evacuation strategies that account for the time vulnerable people need.⁶

None of this works if the list of people inside is a page of handwriting at an unattended desk. A roll call needs a live register of staff and visitors that can be read at the assembly point, by someone with a phone, while the building is empty.

Duty two: let the right people in

The second duty is access: letting in the people who are expected and stopping those who are not.

Physical access matters for information security as much as for safety. The 2022 edition of ISO/IEC 27001, the most widely used information security standard, includes controls for physical security perimeters and physical entry, and added a new control for physical security monitoring.⁷ Banks, insurers and technology suppliers increasingly ask their partners to show these controls in due diligence.

The threats are rarely dramatic. Verizon's 2026 Data Breach Investigations Report found that a third party was involved in 48% of breaches, and that social engineering by phone and mobile succeeded 40% more often than email phishing.⁸ A 2025 study of insider risk by the Ponemon Institute, sponsored by a security vendor, put the average annual cost of insider incidents at US$17.4 million for the organisations surveyed, with 55% of incidents caused by negligence rather than malice.⁹ Contractors, cleaners, couriers and visitors are third parties too; a front door that cannot tell a booked engineer from someone who says he is one is an open door.

Visibility is weaker than most organisations think. In a 2026 survey of 1,076 security, compliance, IT and facilities leaders, published by a visitor-management vendor, 44% said they could not say who had been in their building the previous day, and 79% reported at least one incident of unauthorised access in the past year.¹⁰ Vendor surveys deserve caution, but the finding fits ordinary experience: very few organisations can produce yesterday's visitor list in a minute.

Good access control at a front door is not about guards and gates. It is about expectation. A visitor who was invited, with a name, a host and a time, can be welcomed quickly and checked against that invitation. An unexpected arrival is handled differently: the host is asked, the person waits, and the decision is recorded. People on a watchlist, such as someone barred after an incident, are flagged discreetly to security, not announced at the desk.

Duty three: handle what you collect lawfully

Every visitor log is a database of personal data. Ghana's Data Protection Act, 2012 (Act 843) applies to it like any other: data must be necessary, relevant and not excessive, kept no longer than needed, and protected by appropriate technical and organisational measures.¹¹ An open book on a desk, readable by every later visitor and kept indefinitely in a cupboard, meets none of those tests.

Identity documents need particular care. From 9 June 2026, regulations enforced by the National Identification Authority bar organisations from requesting, keeping or relying on photocopies, scans or images of the Ghana Card, with a transition period ending on 2 November 2026; identity must be verified through the Authority's systems.¹² For many receptions, that ends the habit of photocopying cards at the door.

Regulators elsewhere model the lighter approach. The UK's data protection regulator asks visitors to its own offices to show identification but says the ID is used only for verification and not recorded, relying on legitimate interests as its lawful basis.¹³ The principle travels: check what you need to check, record that you checked it, and do not keep what you do not need.

Ghana's Data Protection Commission began spot checks of organisations in October 2026, and its inspectors have asked health facilities about privacy impact assessments for new systems.¹⁴ A reception desk that collects names, phone numbers and identity details from hundreds of people a month is exactly the kind of processing that deserves the same thought.

What regulators and insurers expect

In Ghana, the duties come from several laws rather than one.

• Safe workplaces. The Labour Act, 2003 (Act 651) requires every employer to ensure that workers work under satisfactory, safe and healthy conditions, to provide information, instruction, training and supervision, and to supply suitable fire-fighting equipment.¹⁵
• Fire certificates. Under the Fire Precaution (Premises) Regulations, commercial and residential premises need a fire permit before construction and a fire certificate on completion. In September 2026 the Fire Service moved permits and certificates to an online system and began tagging fire equipment with QR codes.¹⁶
• Personal data. Act 843 governs visitor logs, staff records and CCTV footage.¹¹
• Identity. The 2026 Ghana Card regulations govern how identity is checked and what may be kept.¹²

Elsewhere, the expectations are becoming explicit. The United Kingdom's Terrorism (Protection of Premises) Act 2025, known as Martyn's Law, received Royal Assent in April 2025. Premises expecting 200 to 799 people must have procedures for evacuation, invacuation, lockdown and communication; those expecting 800 or more must also put in place measures such as monitoring the premises and its immediate surroundings, and designate a senior individual responsible.¹⁷ Penalties for the larger premises can reach £18 million or 5% of worldwide revenue.¹⁸

Insurers look at the same questions through the lens of loss. In the Allianz Risk Barometer for 2026, a survey of 3,338 risk professionals, business interruption ranked third among global business risks, and fire and explosion ninth.¹⁹ One year after the January 2025 fire that destroyed nearly two-thirds of Accra's Kantamanto market and affected about 10,000 traders, traders reported that insurers regarded the market as high-risk because of its wooden structures.²⁰²¹ Insurers price what they can see. An organisation that can show a working fire certificate, drill records, a live register of who is on site and controlled access is easier to insure than one that cannot.

What good looks like

None of this requires turnstiles. A well-run front door in an ordinary organisation does a few things consistently:

1. Expected visitors are invited in advance. The host registers the visit; the visitor receives a pass with the time and place. Arrival takes seconds, and the host is told at once.
2. Every arrival is recorded, digitally. Name, host, time in and time out, and nothing more than the visit needs. Previous visitors' details are never on display.
3. There is a privacy notice at the point of collection. It says what is collected, why, for how long and how to ask about it, and the organisation keeps a record of which wording each visitor saw.
4. Identity is checked, not copied. Where a check is needed, it is done through the proper route and recorded as done.
5. The register is live in an emergency. When the alarm sounds, wardens can see who is on site, staff and visitors alike, and mark them safe at the assembly point.
6. Drills are held and recorded. At least once a year, with the roll call timed and the gaps fixed.⁵
7. Contractors and deliveries have their own route. Couriers drop parcels without wandering the building; contractors are tied to a host and a job.
8. Watchlists are discreet. Barred individuals are flagged to security quietly, under a clear policy on who may be added and why.
9. Records are kept on a schedule. Visitor records are deleted or anonymised after a defined period, and access to them is limited and logged.
10. The system works when the network does not. Power and connectivity fail; the front door cannot stop working when they do.

The front desk will always be about welcome. The organisations that also treat it as a control will be safer in an emergency, easier to insure and better placed when an inspector, an auditor or a fire officer asks who was in the building.