Home FAQs Test and trace
MENU

Test and trace

Question:
Test and trace
Answer:

Guidance on maintaining records of staff, customers and visitors to support NHS Test and Trace is available on the government website.

NHS QR Codes and App 

Venues in certain sectors should continue to ask customers, visitors and staff to 'check in', to help stop the spread of coronavirus (COVID-19). Those venues must:

  • Ask every customer or visitor (over the age of 16) to provide their name and contact details
  • Keep a record of all personnel working on their premises and shift times on a given day and their contact details
  • Keep these records of customers, visitors and staff for 21 days and provide data to NHS Test and Trace if requested
  • Display an official NHS QR code poster so that customers and visitors can ‘check in’ using the NHS COVID-19 app as an alternative to providing their contact details
  • Adhere to General Data Protection Regulations (GDPR)

  1. The full list of settings that need to display a QR code is available here. The general principle is that events, venues and facilities that are open to the public should use a code; regular office settings do not need to do .

  2. Customised QR codes must be created via the official government website.  Your QR code should be displayed clearly at the access points to your venue. Visitors can use the NHS Covid-19 app on their smartphones to ‘check in’ to your premises (this data stays on their phone and is not shared).

  3. NOTE:  The rules on what you need to do when a group enters your venue have changed. You must now ask every customer and visitor to scan the NHS QR code using their NHS COVID-19 app, or provide their name and contact details, not just a lead member of the group. 

  4. If you are currently using your own QR code to collect contact details you must change to the official NHS code. 
  5. Further help on QR codes and posters is available on the NHS website.
  6. You do not have to ask people who choose to ‘check in’ using the official NHS QR code to provide their contact details. If there is an outbreak associated with a venue, a message will be sent to the relevant app users with the necessary public health advice.

Collecting information

  1. If visitors are not using the NHS app to check in to your venue or event, you should collect the following information from them:
    1. the name of the customer or visitor
    2. a contact phone number for each customer or visitor. If a phone number is not available, you should ask for their email address instead, or if neither are available, then postal address the dates and times that people are at work
    3. Date of visit, arrival time and, where possible, departure time If a visitor is likely to interact with only one member of staff (e.g. for advice appointments) the name of the staff member should be recorded alongside the name of the visitor

  2. All designated venues must also keep a record of all staff working on the premises on a given day, the time of their shift, and their contact details. This covers anyone providing a service or activity including volunteers. Venues must keep these records of staff, but staff can choose to check in using the NHS QR code poster in addition, if they wish.

  3. No additional data should be collected for Test and Trace

  4. You should collect the information in a way that is manageable for your organisation. If not collected in advance, information should be collected at the point that visitors enter the premises or at the point of service.

    How records should be maintained
  1. You should hold records for 21 days. This reflects the incubation period for COVID-19, which can be up to 14 day, plus an additional 7 days to allow time for testing and tracing.

  2. After 21 days, visitor information collected for Test and Trace purposes should be securely disposed of or deleted.

  3. Records which are made and kept for other business purposes do not need to be disposed of after 21 days. The requirement to dispose of the data relates to a record that is created solely for the purpose of NHS Test and Trace. All collected data, however, must comply with the General Data Protection Regulations and should not be kept for longer than is necessary.

Promoting Test and Trace

  1. Visitors may have concerns about how their data will be used, so you may want to provide online information explaining the key points:
    1. Information will be kept for 21 days and will only be used if there are confirmed cases of Covid-19 involving people who have visited
    2. Where there is a confirmed case of Covid-19, NHS contact tracers will contact facilities where visitors have been to provide as much information as possible

  2. You can check the detailed guidance about information sharing and download a template privacy notice from on the government’s coronavirus pages.

  3.  

    Leaflets and posters on Test and Trace, including some in community languages, are available from Public Health England.

Failure to comply

Collecting contact details and maintaining records for NHS Test and Trace is a legal requirement and failure to comply is punishable by a fine:

  • first fixed penalty: £1,000
  • second fixed penalty: £2,000
  • third fixed penalty: £4,000
  • any further penalty notice: £10,000

The person responsible for the organisation is liable. This could be the owner, proprietor, or manager with overall responsibility of the organisation, business or service.