Test and Trace Record Keeping
17 July 2020
A guide for groups for keeping records for the purposes of COVID-19 test and trace.
If your charity or community group is reopening your premises to staff and visitors, you are being asked to keep a temporary record of staff and visitors to your premises, so that NHS Test and Trace can ask for that data if needed.
This applies to premises where customers and visitors spend a longer time in one place and potentially come into close contact with other people outside of their household, whether indoor or outdoor venues or mobile settings. It does not apply where services are taken off site immediately nor to drop-off deliveries made by suppliers or contractors.
You should collect the information in a way that is manageable for your establishment. You could collect it in advance, at the point that visitors enter the premises, or at the point of service if impractical to do so at the entrance. It should be recorded digitally if possible, but a paper record is acceptable too. If it’s practical to do so, recording both arrival and departure times (or estimated departure times) will help reduce the number of people needing to be contacted by NHS Test and Trace.
The following information should be collected by the venue, where possible:
staff:
- the names of staff who work at the premises
- a contact phone number for each member of staff
- the dates and times that staff are at work
visitors:
- the name of the visitor. If there is more than one person, then you can record the name of the ‘lead member’ of the group and the number of people in the group
- a contact phone number for each visitor, or for the lead member of a group of people
- date of visit, arrival time and, where possible, departure time
- if a customer will interact with only one member of staff, the name of the assigned staff member should be recorded alongside the name of the customer
No additional data should be collected for this purpose – see the information below about complying with GDPR.
The full guidance is here:
General Data Protection Regulation (GDPR)
There’s also some guidance to make sure that when doing this you also comply with GDPR:
You should hold these records for 21 days, after which this information should be securely disposed of or deleted. When deleting or disposing of data, you must do so in a way that does not risk unintended access (e.g. shredding paper documents and ensuring permanent deletion of electronic files).
If you are keeping the same records for other purposes as well, they don’t necessarily have to be disposed of after 21 days but must comply with the General Data Protection Regulation and should not be kept for longer than is necessary.
Ideally, you should encourage customers and visitors to share their details in order to support NHS Test and Trace and advise them that this information will only be used where necessary to help stop the spread of COVID-19, but If people refuse to give their details, you cannot insist that they do. People can opt out by informing you that they do not want their details shared for the purposes of NHS Test and Trace and, if they do, you should not share their information used for booking purposes with NHS Test and Trace.
The accuracy of the information provided will be the responsibility of the individual who provides it. You do not have to verify an individual’s identity for NHS Test and Trace purposes.
GDPR allows you to request contact information from your staff, customers and visitors and share it with NHS Test and Trace to help minimise the transmission of COVID-19 and support public health and safety.
It is not necessary to seek consent from each person, but you should make clear why the information is being collected and what you intend to do with it. The data must be handled in accordance with the principles of GDPR and you should make staff and visitors aware that their contact information may now also be shared with NHS Test and Trace. You do not have to inform every customer individual; you could, for example, display a notice at your premises or on your website setting out what the data will be used for and the circumstances in which it might be accessed by NHS Test and Trace.
You may need to offer some people additional support in accessing or understanding this information, for example, if they have a visual impairment or cannot read English.
A notice could say, for example
We are keeping a temporary record of staff and visitors to our premises, so that NHS Test and Trace can ask for that data if needed.
We will make a record of your name, contact telephone number and the date/time of your visit.
We will hold this information securely for 21 days, after which it will be securely disposed of.
This information will only be used where necessary to help stop the spread of COVID-19 by sharing it with NHS Test and Trace.
You can opt out by informing us that you do not want your details shared for the purposes of NHS Test and Trace.
For full information, see the ICO guidance.
