Help stop the spread of COVID-19 by maintaining records

As the hospitality industry is preparing to reopen this weekend, businesses can find further information on the Gov.uk website on how to maintain records of staff, customers and visitors in line with NHS Test and Trace measures.

The aim of this service is to keep a temporary record of your customers and visitors for 21 days, in a way that is manageable for your organisation, and assist NHS Test and Trace with requests for that data if needed. This could help contain further outbreaks.

The records will help NHS Test and Trace to reach anyone who may at a later date be found to have potentially been in contact with a positive coronavirus case whilst at a particular venue, helping to quickly contact people at risk of the virus and prevent localised outbreaks before they occur.

The requirement to collect this data applies to:

• hospitality, including pubs, bars and restaurants (it does not apply to businesses operating a takeaway/delivery only basis).
• tourism and leisure, including hotels, museums, cinemas, zoos and theme parks. 
• close contact services, including hairdressers, and others as defined here.
• facilities provided by local authorities, including town halls and civic centres for events, community centres, libraries and children’s centres.
• places of worship, including use for events and other community activities.

This guidance applies to any establishment that provides an on-site service and to any events that take place on its premises. It does not apply where services are taken off-site immediately, for example, a food or drink outlet which only provides takeaways. If a business offers a mixture of a sit-in and takeaway service, contact information only needs to be collected for customers who are dining in. It does not apply to drop-off deliveries made by suppliers.

The data that needs to be collected is:

Staff

• The names of staff who work at the premises.
• A contact phone number for each member of staff.
• The dates and times that staff are at work.

Customers and visitors

• The name of the customer or visitor. If there is more than one person, then you can record the name of the ‘lead member’ of the group and the number of people in the group.
• A contact phone number for each customer or visitor, or for the lead member of a group of people.
• Date of visit and arrival and, where possible, departure time.

If a customer interacts with only one member of staff, the name of the assigned staff member should be recorded alongside the name of the customer If you have a large booking, for example, at a restaurant, you only need to collect the name and contact phone number of the lead member of the party. This data needs to be kept for 21 days.

The details visitors share must be stored securely and handled in line with GDPR regulations. They will only be shared, if asked, with the NHS Test and Trace service to manage local coronavirus outbreaks if they occur.

The ICO has also published a statement and a short data protection A,B,C checklist today.

Statement from Deputy Chief Executive Paul Arnold from the ICO:

“For the public health benefits to be realised from these new measures it is important people feel able to share their personal detail with confidence. So people can have this trust and confidence in the way their personal data will be kept safe and used properly as they prepare to return to their favourite pubs, restaurants and local businesses, we want to help businesses to get things right first time as they adapt to new ways of working.”

Find the ICO’s full statement and checklist below:

• Checklist
• Statement

To stay up-to-date with all the latest news and guidance on how to operate your business safely through Covid-19, visit our Coronavirus Hub.