The Health and Safety at Work Act 2015 (HSWA) is New Zealand's primary workplace health and safety legislation. Administered by WorkSafe New Zealand, it places duties on every business — from sole traders to large corporations — to manage risks to people in their workplace.
One area that trips up many businesses is site access. Who's allowed on your site? What records do you need to keep? What are your obligations toward contractors and visitors? This guide covers what the HSWA 2015 requires, in plain English.
Who is responsible under the HSWA 2015?
The Act uses the term PCBU — Person Conducting a Business or Undertaking. If you operate a business that has a workplace with other people in it, you're a PCBU. PCBUs have a primary duty of care to ensure the health and safety of their workers and others who may be affected by their work — as far as is reasonably practicable.
"Others" includes visitors, contractors, subcontractors, labour hire workers, customers, members of the public who might be affected by your work, and anyone else who enters your site.
Key point: Your duty of care doesn't stop at your employees. It extends to everyone on your site — including people employed by other companies, if they're on your premises or affected by your operations.
What the HSWA says about site access records
The HSWA 2015 does not prescribe a specific format or system for site access records. However, it does require businesses to identify hazards, assess risks, and implement controls — and a core part of that is knowing who is on your site at any time.
WorkSafe New Zealand's guidance makes clear that effective risk management includes:
- Knowing who is on site and what work they're doing
- Being able to account for all people in an emergency
- Ensuring contractors have received relevant information about site hazards
- Verifying that workers have completed required inductions before starting work
A paper sign-in book can technically satisfy some of these requirements — but only if it's consistently used, always current, and accessible in an emergency. In practice, paper systems frequently fail on all three counts.
Principal contractor duties on construction sites
Construction sites have additional obligations under the Health and Safety at Work (General Risk and Workplace Management) Regulations 2016. If your business is the principal contractor on a construction project, you are responsible for coordinating health and safety across all work carried out on site — including work done by subcontractors.
This includes:
- Ensuring all workers receive a site-specific induction before starting work
- Coordinating emergency procedures and maintaining an up-to-date evacuation list
- Managing the overlap between different trades working simultaneously
- Keeping records that demonstrate compliance, in case of a WorkSafe audit or incident investigation
Important: If a subcontractor's worker is injured on your site, WorkSafe will investigate how the principal contractor managed site access and induction compliance. Being able to produce records showing who was on site, when they arrived, and what inductions they'd completed can significantly affect the outcome of that investigation.
Visitors and contractors — what's the difference?
Under the HSWA 2015, contractors are treated as workers — they fall under your duty of care the same as employees. Visitors (delivery drivers, clients, inspectors) are "others" — you still owe them a duty of care, but the obligations are slightly different.
For contractors and subcontractors, you need to:
- Ensure they've received a site induction
- Verify they hold any required certifications or licences
- Include them in your emergency procedures
- Coordinate their work to minimise risks from overlapping activities
For visitors, the minimum is:
- Notifying them of relevant hazards on site
- Knowing who is on site in case of emergency
- Supervising or escorting them through hazardous areas
Emergency evacuation requirements
The Health and Safety at Work (General Risk and Workplace Management) Regulations 2016 require businesses to have emergency procedures in place, including procedures for evacuating the workplace. A core component of any credible evacuation procedure is knowing who is on site.
An evacuation list that is incomplete, out of date, or locked inside the building being evacuated is not a functional evacuation procedure. WorkSafe's expectations are that your evacuation list reflects who is actually on site at the time of an emergency — not who was on site this morning, or who you think might be there.
How SiteKey supports HSWA compliance
SiteKey doesn't replace your health and safety programme — but it does automate the site access record-keeping that sits at the foundation of HSWA compliance. With SiteKey:
- Every check-in is time-stamped and logged automatically
- Compliance gates prevent non-inducted workers from checking in
- Your evacuation list is always current and accessible from any device
- Historic records are stored and exportable for WorkSafe audits
- Automatic sign-out keeps records accurate without manual intervention
Sort your site access compliance
Most SiteKey customers are up and running within a few days — no IT project required.
Talk to us about your siteFrequently asked questions
Does the HSWA 2015 require businesses to keep site access records? +
The HSWA doesn't prescribe a specific format, but it requires businesses to manage risks to everyone on site — and knowing who is on site is fundamental to that. WorkSafe may ask to see evidence of your site access records during an audit or following an incident.
What are a principal contractor's obligations under HSWA 2015? +
Principal contractors are responsible for managing health and safety across all work carried out on their site — including work by subcontractors. This includes site inductions, emergency procedures, and maintaining a current site occupancy record.
Are contractors considered workers under the HSWA 2015? +
Yes. The HSWA defines 'worker' broadly to include contractors, subcontractors, and labour hire workers. Your duty of care applies to them the same as to your direct employees, if they're working under your management or on your site.
What records do I need to keep for a WorkSafe audit? +
WorkSafe may ask for evidence of who was on site, when they arrived and departed, what inductions they completed, and how you manage hazard identification. Digital systems like SiteKey make these records easy to produce — paper systems often can't.