What is contractor access control?
Contractor access control is the set of rules and checks that decide which contractors may enter a site, where they may go and for how long. It also keeps a record of each visit.
A good process has five parts: pre-approval, identification at the gate, zone limits, a site briefing and a sign-out. Many sites run the gate part with visitor access control software, which scans documents and stores each entry. The process below works on paper too, but it is harder to keep up.
Why do contractors need different rules from visitors?
Contractors stay longer, bring tools and vehicles, and often work in risky or restricted areas. A visitor process that only records a name and a time is not enough.
South African health and safety law also treats contractors differently. Section 1 of the Occupational Health and Safety Act (OHSA) defines a "mandatary" to include a contractor or subcontractor. Section 9(1) requires every employer to conduct its undertaking so that people who are not its employees are not exposed to hazards, as far as is reasonably practicable.
Section 37 goes further. An employer can be presumed responsible for an offence under the Act committed by its mandatary. Section 37(2) removes that presumption only where the parties have agreed in writing on arrangements and procedures to ensure the contractor complies. This is a summary, not legal advice.
How do you control contractors on a site, step by step?
Run every contractor through the same eight steps, from the booking to the end of the day.
- Approve the job before the visit. The person who asked for the work books it: company, workers, vehicles, dates, the work to be done and the zones needed.
- Check the paperwork. Before the first visit, confirm that the safety documents your site requires are in place, such as the written section 37(2) agreement and any work permits.
- Identify each worker at the gate. The guard scans the worker's ID card or driving licence and the vehicle's licence disc, and checks the face against the photo.
- Match the worker to the booking. If the name, company or date does not match an approved job, the guard calls the host before letting anyone in.
- Brief the worker. A short site induction covers emergency exits, assembly points, no-go areas and who to call. Record the date it was done.
- Issue a card and set the zones. Give each worker a contractor card or badge, and record the zones they may enter. Escort them into sensitive areas.
- Sign out every worker and vehicle. At the end of the day, record the time out, collect the card and check tools and materials against what came in.
- Reconcile at shift change. Compare the list of contractors signed in with those signed out. Anyone still on site after hours needs an answer.
Steps 1 and 2 happen in the office, before anyone arrives. If they are skipped, the guard at the gate has no list to check against and ends up phoning around while a truck waits in the road.
What should you record for each contractor visit?
Record enough to show who was on site, why, where they were allowed to go and when they left. The table lists the fields most sites need.
| Field | Why it matters | Example |
|---|---|---|
| Company and job reference | Links the worker to an approved job and a host | ABC Electrical, job 1042, host: facilities manager |
| Worker name and ID or licence scan | Proves who entered, not who was booked | Driving licence scanned, photo checked |
| Vehicle registration and photo | Shows which vehicle came and went, and what it carried | Bakkie, plate captured, photo of load bin |
| Approved zones | Tells guards and patrols where the worker may be | Plant room B and roof only |
| Induction date | Shows the worker was briefed on site hazards and exits | Inducted 14 October, valid for this job |
| Card or badge issued | Makes sure every card comes back | Contractor card 07 |
| Tools and materials in | Lets the guard check what leaves against what arrived | Ladder, 2 toolboxes, cable reel |
| Time in and time out | Proves who was on site at a given time | 07:12 in, 16:40 out |
| Guard on duty | Shows who processed the entry | Gate officer's name or user login |
Leave out anything the purpose does not need. A contractor's home address, for example, rarely helps site security. Keeping fewer fields also means less to protect.
How do you limit contractors to the right zones?
Divide the site into named zones and approve each job for specific zones only. A plumber booked for the ablution block has no reason to be in the server room.
- Name the zones on a site map. Use the same names in bookings, on cards and in patrol instructions.
- Mark sensitive zones as escort-only. Server rooms, cash offices, stores and high-risk plant need a staff member present.
- Make the zones visible. A card or badge that shows the approved zones lets any staff member challenge a worker who is out of place.
- Brief the patrol guards. Tell them which contractors are on site and where they should be.
- Close the day. At sign-out, check that everyone who entered a zone has left it.
Illustrative example: a warehouse has a roofing team of six, two electricians and one courier on the same morning. The roofers are approved for the roof and the yard, the electricians for the plant room, and the courier for the loading bay only. At 17:00 the gate list shows eight signed out and one electrician still in. The guard radios the plant room before locking up.
What does POPIA require for contractor records?
Contractor names, ID numbers, licence details and photos are personal information under the Protection of Personal Information Act (POPIA). The site owner or managing body is usually the responsible party, and must meet these conditions:
- Purpose (section 13). Collect contractor information for a specific, defined and lawful purpose, such as controlling access and site safety.
- Minimality (section 10). Collect only what is adequate, relevant and not excessive for that purpose.
- Notice (section 18). Before collecting, tell contractors what you collect, who you are, why, and that they may complain to the Information Regulator. A sign at the gate and a clause in the booking form are practical ways to do this.
- Retention (section 14). Do not keep records longer than the purpose needs, unless a law, a contract, a lawful need of your organisation or consent allows it.
- Security (section 19). Protect records against loss and unlawful access, for example with personal logins for guards and limited export rights.
- Operators (section 21). If a guarding company or software supplier processes the records for you, a written contract must require it to keep the same safeguards.
This is a summary, not legal advice. For the full set of gate rules, including breach notification, see our visitor management and POPIA guide.
How do contractor records help after an incident?
They show who was on site, where they were allowed to be and when they left. That narrows an investigation into theft, damage or an injury from everyone to a short list.
Electronic records can be used as evidence. Section 15 of the Electronic Communications and Transactions Act says a data message may not be refused as evidence merely because it is electronic. Its weight depends on how reliably it was created, stored and kept intact, and how its author was identified.
So a record is stronger when each entry carries the time, the guard who made it and the scanned document. Records that are typed up later from scraps of paper are weaker. For how scanned licences and discs work at the gate, read our SADL scanning guide.
How Worxit handles contractor access
Zamatrack's Worxit platform covers the gate part of the process with two modules.
- Visitor Access Control. Guards scan South African driving licences, ID cards and vehicle licence discs with a 2D scanner. SADL photo verification adds a photo check at the gate.
- Vehicle evidence and notes. The guard adds a photo of the vehicle, the number plate and notes, such as the job or the person being visited.
- Zone limits. Access can be limited to approved locations or buildings, for visitors, contractors or vehicles. Visitor access cards can be issued and managed.
- History. Each entry is kept in the site's visitor history, ready for an audit or an investigation.
- Visitor Management. Future-dated invites let staff set up visits ahead of time, including recurring visits for regular contractors. Staff can see who is on site.
The guard needs a device with a 2D scanner, such as the P100s Rugged Tablet. The Worxit dashboard licence is R600 per month, including one admin user, and additional dashboard users are R75 per user per month. Each phone, tablet or radio running the Worxit app needs a mobile device licence at R350 per month. All prices exclude VAT.
Frequently asked questions
What is contractor access control?
Contractor access control is the process a site uses to approve, identify, limit and record contractors who come to work on it. It covers pre-approval before the visit, an ID or licence check at the gate, limits on where each worker may go, a site briefing, and a sign-out that closes the record.
Is a contractor treated the same as a visitor?
Not quite. A contractor comes to do work, often with tools and vehicles, for hours or days, and sometimes in risky areas. The gate process starts the same way, with identity and vehicle details, but adds a work approval, zone limits, a safety briefing and a firm sign-out.
What is a section 37(2) agreement?
It is a written agreement between an employer and a contractor under section 37(2) of the Occupational Health and Safety Act. It sets out the arrangements and procedures that ensure the contractor complies with the Act. Without one, the employer can be presumed liable for the contractor's offences. Take legal advice on yours.
Can we scan a contractor's ID or driving licence at the gate?
POPIA allows it under conditions. You need a specific, lawful purpose, such as site security and safety, and you should collect only what that purpose needs. Tell contractors what you collect and why before you collect it, keep the records secure and do not keep them longer than necessary.
How do you stop contractors wandering into other areas?
Approve each job for named zones only, tell the worker those zones at the gate, and issue a card or badge that shows them. Escort workers into sensitive areas. In Worxit Visitor Access Control, access can be limited to approved locations or buildings for each entry.
Sources
- Occupational Health and Safety Act 85 of 1993. gov.za. Section 1 (definition of "mandatary"), section 9(1) and section 37(1) and (2), as published in Government Gazette 14918. Check the current consolidated text for later amendments.
- Protection of Personal Information Act 4 of 2013. gov.za. Sections 10, 13, 14, 18, 19 and 21.
- Electronic Communications and Transactions Act 25 of 2002. gov.za. Section 15: admissibility and evidential weight of data messages.
- Information Regulator. The independent body that monitors and enforces compliance with POPIA.