At many condominium guardhouses, the routine has not changed in years. The visitor hands over a MyKad or driving licence, receives a pass, and the document waits in a drawer until the pass comes back. It feels like security. But holding a visitor’s document as collateral goes against a government directive issued in 2007, and the practice records far less than committees assume.
For JMBs and MCs, visitor registration without IC is now a practical question. A 2007 Ministry of Home Affairs circular directed security companies at condominiums and gated communities to stop keeping visitors’ identity documents: a document may be checked and the entry recorded, but it must then be returned. For MyKad specifically, JPN took a stricter position in June 2025, stating that security guards have no authority to request, hold, or scan it.
None of this means guardhouses should stop verifying visitors. It means the document in the drawer cannot be the system.
Visitor Registration Without the IC Starts With What the IC Was Doing
The document exchange survives because it appears to do three jobs. Looked at closely, it does none of them well.
- Collateral. Holding the document is meant to make sure the pass comes back. But a returned pass proves only that a card came back, not which vehicle left or when.
- Accountability. The document puts a name to the visit. It does not confirm that a resident expected the visitor, or link the visit to a unit and purpose.
- Deterrence. The held document is meant to keep visitors in line. Once it is returned, the remaining records may be limited to a logbook entry and CCTV footage, with little connection to the visitor’s earlier visits.
The answer is not a better way to hold the document. It is a visit record that does not depend on one.
What the Guardhouse Should Record Instead
A useful visit record captures the visitor’s details and connects them to four things: who authorised the visit, its purpose, its timing, and the visitor’s history. None of these require holding an identity document.
| What the community needs | Document held at the gate | Digital visit record |
|---|---|---|
| Who authorised the visit | Rarely confirmed | The resident who invited or approved them |
| Why they are here | A logbook line, if written | A defined visit purpose with its own steps |
| When they arrived and left | Inferred from the returned pass | Timestamped check-in and check-out |
| Whether they have been here before | Buried in old logbook pages | An accumulating visitor profile |
1. The host who authorised the visit
Pre-registration establishes who is responsible for inviting the visitor. In iNeighbour, residents create digital invitations from the app — single or multiple entry, valid across several days, shared as a link. An invitation does not verify identity on its own. Guards must still follow the property’s visitor verification procedures. What it establishes is who expected this visitor, for which unit, and when.
2. The purpose of the visit
A dinner guest, a delivery rider, and a renovation contractor carry different risks. The Flow Builder lets the management office give each visit purpose its own sequence — registration, approval, check-in, acknowledgement, check-out — so each community decides which steps each visitor type goes through.
3. The vehicle and the timestamps
Check-in and check-out are recorded against the visit, with vehicle details attached. The Live Activity view shows who is currently checked in, who is expected, and who has overstayed.
4. The person, over time
Every visitor builds a profile across visits — visit history, vehicle records, and tags such as Regular, Restricted, or Security Risk. Guards can see this history in the iVizit guard app before granting access. We covered why this profile matters more than any single check-in in The Visitor Profile Is the Security Layer.
Collect What the Visit Requires, and Protect It
A drawer of documents, a photocopied logbook, and photos on a guard’s personal phone all hold visitors’ personal data, often with no control over who sees it or how long it is kept. This accurately reflects JPN’s reported statement, but could imply that the PDPA applies universally to every private collection of personal data.
That does not put visitor data off-limits. Where the PDPA applies, it means collecting what the visit requires, telling visitors why, keeping the data secure, limiting who can access it, and not keeping it longer than needed.