Maintaining records of staff, customers and visitors to support NHS Test and Trace

From Friday 18th September, some sectors MUST have a system in place by law to record contact details for every customer, visitor and member of staff.

The sectors are:

– hospitality, including pubs, bars, restaurants and cafés

– tourism and leisure, including hotels, museums, cinemas, zoos and theme parks

– close contact services, including hairdressers, barbershops and tailors

– facilities provided by local authorities, including town halls and civic centres for events, community centres, libraries and children’s centres

– places of worship, including use for events and other community activities

Click here for more information, assets and advice.

This guidance applies to any establishment that provides an on-site service and to any events that take place on its premises. It does not apply where services are taken off site immediately, for example, a food or drink outlet which only provides takeaways. If a business offers a mixture of a sit-in and takeaway service, contact information only needs to be collected for customers who are dining in.

In addition to maintaining and sharing records where requested and displaying an official NHS QR poster, you must also continue to follow other government guidance to minimise the transmission of COVID-19. This includes maintaining a safe working environment and following social distancing guidelines.

Displaying an official NHS QR poster

Organisations should display official NHS QR code posters at their venue entrances to help support contact tracing. It’s quick and simple to use for both businesses and users. Ask visitors to scan the QR code when they arrive, using the NHS COVID-19 app. This is to help trace and stop the spread of coronavirus (COVID-19). Organisations should still maintain an alternative means to maintain contact details for people who do not have a smartphone or do not want to use the NHS COVID-19 app.

Official NHS QR posters can be generated online.

How records should be maintained

To support NHS Test and Trace, you should hold records for 21 days. This reflects the incubation period for COVID-19 (which can be up to 14 days) and an additional 7 days to allow time for testing and tracing. After 21 days, this information should be securely disposed of or deleted. When deleting or disposing of data, you must do so in a way that does not risk unintended access (for example shredding paper documents and ensuring permanent deletion of electronic files).

Records which are made and kept for other business purposes do not need to be disposed of after 21 days. The requirement to dispose of the data relates to a record that is created solely for the purpose of NHS Test and Trace. All collected data, however, must comply with the General Data Protection Regulation and should not be kept for longer than is necessary.

Click here for more information, assets and advice.