The Government guidance requires some businesses to collect details and maintain records of staff, customers and visitors on their premises to support NHS Test and Trace.
Businesses required to collect this information are:
- hospitality, including pubs, bars, restaurants and cafés
- tourism and leisure, including hotels, museums, cinemas, zoos and theme parks
- close contact services, including hairdressers, barbershops and tailors
- facilities provided by local authorities, including town halls and civic centres for events, community centres, libraries and children’s centres
- places of worship, including use for events and other community activities
You should collect a name and contact details (email or phone number is fine) and the date of their visit. This data needs to be securely kept for 21 days, after which point it should be destroyed. The data must not be left visible for others to see and cannot be used for marketing purposes. GDPR compliance is essential.
NHS Test and Trace may ask for these records if necessary. This could be because someone who has tested positive for COVID-19 has listed your premises as a place they visited recently, or because your premises have been identified as the location of a potential local outbreak of COVID-19.
More details can be found here.
