[Withdrawn] Maintaining records of staff, customers and visitors to support NHS Test and Trace (2023)

While cases are high and rising, everybody needs to continue to act carefully and remain cautious. This is why we are keeping in place key protections:

  • testing when you have symptoms and targeted asymptomatic testing in education, high risk workplaces and to help people manage their personal risk
  • isolating when positive or when contacted by NHS Test and Trace
  • border quarantine for those arriving from red list countries and for those people not fully vaccinated arriving from amber list countries
  • cautious guidance for individuals, businesses and the vulnerable whilst prevalence is high including:
    • while government is no longer instructing people to work from home if they can, the government would expect and recommend a gradual return over the summer
    • government expects and recommends that people wear face coverings in crowded areas such as public transport
    • being outside or letting fresh air in
    • minimising the number, proximity and duration of social contacts
    • encouraging and supporting businesses and large events to use the NHS COVID Pass in high risk settings. The government will work with organisations where people are likely to be in close proximity to others outside their household to encourage the use of this. If sufficient measures are not taken to limit infection, the government will consider mandating certification in certain venues at a later date

Although it is no longer a legal requirement for venues to display an NHS QR code or request that customers, visitors and staff ‘check in’, this is still encouraged. People can check in by scanning the NHS QR code poster via their NHS COVID-19 app or by providing their contact details. This will support NHS Test and Trace to contact people exposed to COVID-19, so that they can book a test. This will help us to stop the spread of the virus, protect society and support businesses to stay open.

Establishments in the following sectors should encourage attendees to check in and maintain records of staff, customers and visitors who choose to provide their contact details:

  • hospitality, including pubs, bars, nightclubs, restaurants and cafes
  • tourism and leisure, including theatres, museums and cinemas
  • close contact services
  • places of worship
  • facilities provided by local authorities such as libraries and community centres

Venues should:

  • ask every customer or visitor (over the age of 16) to ‘check in’ by:
    • scanning the NHS QR code poster via their NHS COVID-19 app; or
    • providing their name and telephone number (this can be done in advance, for example, via a pre-booking system). You should also note the date of entry
  • keep a record of all staff working on your premises, their shift times and dates, and their contact details
  • keep these records of customers, visitors and staff for 21 days and provide this information to NHS Test and Trace, if requested
  • display an NHS QR code poster so that customers and visitors can ‘check in’ using the NHS COVID-19 app (as an alternative to providing their contact details)
  • adhere to data protection legislation, including the UK General Data Protection Regulation (GDPR) and Data Protection Act 2018

By asking individuals to check in and sharing the records of those who provide their contact details with NHS Test and Trace, you will help us to identify people who may have been exposed to COVID-19. If there is an outbreak linked to a venue, that is 2 or more COVID-19 cases on the same day, the ‘venue alert’ process will be triggered. This will lead to individuals who checked in to the venue on the same day receiving advice to book a test; there is no requirement to self-isolate unless the recipient tests positive for COVID-19. NHS Test and Trace will only ask for your records if there is an outbreak at your venue.

Venue alerts

In the event of an outbreak linked to a venue, individuals who checked in will receive a venue alert. This is a notification from their NHS COVID-19 app if they scanned the NHS QR code, or a text message if they provided their contact number.

Venue alerts:

(Video) 4 Things Social Security Disability Recipients Should Not Do

  • are triggered if there are 2 or more cases at your venue
  • are facilitated by NHS Test and Trace obtaining the records of your customers, visitors and staff who were there on the same day. If you are asked by NHS Test and Trace for this information, please share it as soon as possible. Do not inform customers or visitors directly, alerts will be managed by NHS Test and Trace
  • inform the attendee of their potential exposure to COVID-19 and advises them to book a test
  • are anonymous – your venue will never be named in an alert
  • do not close your venue. You will be given guidance at the point you are contacted by NHS Test and Trace so that you can continue to operate safely

You should contact your local health protection team or environmental health department at your local council if you need further support to manage an outbreak in your establishment.

Systems for checking in

Venues should display an NHS QR code poster at their entrance. It’s quick and simple to use for both businesses and users, and enables customers and visitors to scan the NHS QR code when they arrive by using the NHS COVID-19 app.

Official NHS QR code posters can be generated online. Organisations can find out more about NHS QR codes and how to generate them on the NHS COVID-19 app website. If you do not have access to a printer, you can display your QR code poster at your venue using digital signage, for example, a TV screen or iPad.

For those unable to check in using the NHS COVID-19 app, venues should ask customers and visitors (over the age of 16) for their name and telephone number, and you should record the date of visit.

You should also keep a record of staff working on the premises on a given day and their contact details.

How records should be maintained

To support NHS Test and Trace, you should hold these records for 21 days before securely disposing of them. When deleting or disposing of data, you must do so in a way that does not risk unintended access (for example shredding paper documents and ensuring permanent deletion of electronic files).

Records which are made and kept for other business purposes do not need to be disposed of after 21 days. Only data related to a record that is created solely for the purpose of NHS Test and Trace needs to be destroyed at this point. All collected data, however, must comply with UK GDPR and should not be kept for longer than is necessary.

Data Protection Regulation Legislation

The data that you collect is personal data and must be handled in accordance with data protection legislation to protect the privacy of your staff, customers and visitors. Please refer to the guidance from the Information Commissioner’s Office to ensure you have appropriate technical and organisational security measures in place to protect customer, visitor and staff contact information.

GDPR allows you to request contact information from your staff, customers and visitors and share it with NHS Test and Trace to help minimise the transmission of COVID-19 and support public health and safety. It is not necessary to seek consent from each person, but you should make clear why the information is being collected and what you intend to do with it.

(Video) GDPR Guidance for the Hospitality Industry (in light of the NHS Test and Trace requirements)

For example, if you already collect this information for ordinary business purposes, you should make staff, customers and visitors aware that their contact information may now also be shared with NHS Test and Trace.

You do not have to inform every customer individually. You might, for example, display a notice at your premises or on your website setting out what the data will be used for and the circumstances in which it might be accessed by NHS Test and Trace. A template privacy notice can be found at Annex A.

While consent is not required, we recommend that consent is sought in sensitive settings such as places of worship and for any group meetings organised by political parties, trade unions, campaign or rights groups, philosophical and religious groups or health support groups. This is because of the potentially sensitive nature of the data collected in these circumstances.

Personal data that is collected for NHS Test and Trace, which you would not collect routinely in the course of your business, must be used only to share with NHS Test and Trace. It must not be used for other purposes, including marketing, profiling, analysis or other purposes unrelated to contact tracing, or you will be in breach of UK GDPR.

You should make your staff aware of what they should and shouldn’t do with customer information. You must not misuse the data in a way that is misleading or could cause an unjustified negative impact on people, for example to discriminate against groups of individuals. Misuse of data in this way is a breach of UK GDPR.

How to know if a request from NHS Test and Trace is genuine

If you are contacted by NHS Test and Trace, contact tracers will:

  • call you from 0300 013 5000
  • send you an email containing a template spreadsheet and a secure link to upload your logbook to the secure Egress system
  • the email will come from dhsctesttrace.venue-alerts@nhs.net

If we cannot get hold of you in the first instance, we will send you an email asking you to provide the best name, contact phone number and time to call. This email will come from nhs.test.and.trace.venue.alert@notifications.service.gov.uk.

Local contact tracers may contact you from a different phone number or ask you to call them back. If you are unsure if the telephone number is genuine, check with your local council. More information can be found on your local council website.

Contact tracers will never:

(Video) ENGAGE 2022 Opening Keynote & Customer Panel

  • ask you to dial a premium rate number to speak to them (for example, those starting 09 or 087)
  • ask you to make any form of payment or purchase a product of any kind
  • ask for any details about your bank account
  • ask for your social media identities or login details, or those of your contacts
  • ask you for any passwords or PINs, or ask you to set up any passwords or PINs over the phone
  • disclose any of your personal or medical information to your contacts
  • ask about protected characteristics that are irrelevant to the needs of NHS Test and Trace
  • provide medical advice on the treatment of any potential coronavirus symptoms
  • ask you to download any software to your PC or ask you to hand over control of your PC, smartphone or tablet to anyone else
  • ask you to access any website that does not belong to the government or NHS

Annex A: template privacy notice

Please note this privacy notice is intended for non-sensitive venues only. If you are a place of worship please see alternative guidance

Recording customer details: how we use your information

To support NHS Test and Trace (which is part of the Department for Health and Social Care) in England, DHSC has provided guidance which we have chosen to follow. The guidance recommends that we collect and keep a limited record of staff, customers and visitors who come onto our premises for the purpose of contact tracing.

By maintaining records of staff, customers and visitors, and sharing these with NHS Test and Trace where requested, we can help to identify people who may have been exposed to coronavirus.

As a customer or visitor of [insert name of business] you might be asked to provide some basic information and contact details. The following information will be collected:

  • the names of all customers or visitors
  • a contact phone number for each customer or visitor
  • date of visit

The venue or establishment as the data controllers for the collection of your personal data, will be responsible for compliance with data protection legislation for the period of time it holds the information. If that information is requested by the NHS Test and Trace service, the service would at this point be responsible for compliance with data protection legislation for that period of time. NHS Test and Trace as part of safeguarding your personal data, has in place technical, organisational and administrative security measures to protect your personal information that it receives from the venue or establishment, that it holds from loss, misuse, and unauthorised access, disclosure, alteration and destruction.

In addition, if you only interact with one member of staff during your visit, the name of the assigned staff member will be recorded alongside your information.

NHS Test and Trace as part of its guidance, has recommended that we retain this information for 21 days from the date of your visit, to enable contact tracing to be carried out by NHS Test and Trace during that period. We will only share information with NHS Test and Trace if it is specifically requested by them. For example, if other customers at the venue subsequently tested positive, NHS Test and Trace can request the log of customer, visitor and staff details on a particular day.

We may/will [delete as necessary] require you to pre-book appointments for visits or to complete a form on arrival.

Under government guidance, the information we collect may include information which we would not ordinarily collect from you and which we therefore collect only for the purpose of contact tracing. Information of this type will not be used for other purposes, and NHS Test and Trace will not disclose this information to any third party unless required to do so by law (for example, as a result of receiving a court order). In addition, where the information is only collected for the purpose of contact tracing it will be destroyed by us 21 days after the date of your visit.

(Video) Video shows alleged abuse of Alzheimer's resident at assisted-living facility

However, the government guidance may also cover information that we would usually collect and hold onto as part of our ordinary dealings with you (perhaps, for example, your name and phone number). Where this is the case, this information only will continue to be held after 21 days and we will use it as we usually would, unless and until you tell us not to.

Your information will always be stored and used in compliance with the relevant data protection legislation.The use of your information is covered by the UK General Data Protection Regulations Article 6 (1) (f) – legitimate interests of the venue or establishment. The legitimate interest in this case is the interest of the venue/establishment in co-operating with NHS Test and Trace in order to help maintain a safe operating environment and to help fight any local outbreak of coronavirus.

Collection of information from or about children under the age of 18 requires the consent of their parent or guardian.

[Venue or establishment please add text whether or not you transfer personal data outside the UK, the EU or to anywhere else (if known).]

By law, you have a number of rights as a data subject, such as the, right to be informed, the right to access information held about you, the right to rectification on any inaccurate data that we hold about you. You have the right to request that we erase personal data about you that we hold (although this is not an absolute right). You have the right to request that we restrict processing of personal data about you that we hold in certain circumstances. You have the right to object to processing of personal data about you on grounds relating to your particular situation (also again this right is not absolute). If you are unhappy or wish to complain about how your information is used, you should contact a member of staff in the first instance to resolve your issue.

If you are still not satisfied, you can complain to the Information Commissioner’s Office.

[Please insert the data protection officer details or whoever is in charge of data protection duties of your venue or establishment.]

We keep our privacy notice under regular review, and we will make new versions available on our privacy notice page on [your venue or establishment website]. This privacy notice was last updated on 12 July 2021.


Is NHS Test and Trace mandatory? ›

If you're exempt from self-isolation, you are not required to inform your employer that you have been contacted by NHS Test and Trace and notified that you are a contact of a positive case, but you may choose to do so. Employers are not expected to check whether you are exempt.

Do you have to answer test and trace? ›

If you have been notified via NHS Test and Trace, it's important that you respond as soon as possible so that NHS Test and Trace can give appropriate advice to those who need it. You will be told to do this online via a secure website or you will be called by one of the contract tracers.

Is NHS Test and Trace still valid? ›

Since 1 April 2022, free LFD tests are no longer available to the public and individuals should only report the results of LFD tests they received prior to this date. In-person testing (at regional test sites, local test sites and mobile testing units) also ended on 1 April 2022.

What is NHS Test and Trace service? ›

NHS Test and Trace: provides free testing for anyone who has symptoms of COVID-19 to find out if they have the virus. gets in touch with anyone who has had a positive PCR test result or reported a positive LFD test result to collect information about their close contacts, who may also be infectious.

Can I stop isolating if I test negative? ›

If your results are negative, you can end your isolation.

When did NHS Test and Trace stop? ›

As of 24 February 2022, the Test and Trace Support Payment scheme in England was ended.

How accurate is the NHS screening test? ›

Screening tests are not 100% accurate. You could be told you have a problem when you do not – this is called a "false positive" and may lead to some people having unnecessary further tests or treatment as a result of screening.

Why NHS test is not valid for travel? ›

COVID-19 testing for the purposes of international travel is not available on the NHS. Testing for this reason is only available through private providers who must have self-declared that they meet the UK Government's minimum standards for the type of commercial COVID-19 testing service they offer.

Can you go out after 5 days with Covid? ›

Many people with COVID-19 will no longer be infectious to others after 5 days. If you have a positive COVID-19 test result, try to stay at home and avoid contact with other people for 5 days after the day you took your test. There is different advice for children and young people aged 18 and under.

Can I stop isolating even if im testing positive? ›

Isolation can be discontinued at least 5 days after the first positive viral test (day 0 is the date the specimen was collected for the positive test, and day 1 is the next full day thereafter). A high-quality mask should be worn around others at home and in public through day 10.

Are you still contagious after 5 days of Covid? ›

People with COVID-19 illness are most contagious for the first 5 days of their illness. But that actually means they're most contagious 1 to 2 days before they develop symptoms and until 2 to 3 days after their symptoms start. So how can you decide when to start and end your isolation?

Who is in charge of test and trace? ›

The Department of Health & Social Care (DHSC) rapidly increased testing capacity in England from April and launched the NHS Test and Trace Service (NHST&T) at the end of May to lead the overall test and trace programme. NHST&T's budget for 2020-21 has grown over time and now stands at £22 billion.

What are two risks of false positive screening test results? ›

Studies have found that women receiving false-positive test results experience increased anxiety and psychological distress. This anxiety and distress is greater in women who undergo invasive procedures rather than additional imaging only.

Do doctors call if test results are negative? ›

Yes, most doctors will call, or have a proxy (sometimes a nurse) notify the patient, or make an appointment to see you in person to give you bad news and what needs to be done.

How does NHS test and trace notify? ›

If you report a positive coronavirus test result, other app users who have been near to you during the last 2 weeks will receive an alert, telling them that they may have been exposed to coronavirus. They will not be told who reported symptoms, or when the contact occurred.

How long is a positive test valid for travel? ›

For international travel, the Recovery certificate is available 10 days after your positive test and will only be valid for up to 180 days after the date of the positive PCR test.

What medical conditions prevent you from traveling? ›

This includes those with cardiac failure, recent myocardial infarction (heart attack) or stroke, angina (chest pain) at rest, heart rate or rhythm disorders, uncontrolled arterial hypertension, severe anemia, sickle-cell anemia, acute mental disorders, epilepsy, and any serious or contagious diseases.

What happens if I test positive for Covid before my flight home to UK? ›

If you test positive for COVID-19 abroad, you must follow local public health advice. You may need to quarantine or self-isolate and stay longer than planned.

Are screening tests accurate? ›

While screening tests are not 100% accurate in all cases, it is generally more valuable to have the screening tests at the appropriate times, as recommended by your healthcare provider, than to not have them at all.

Can screening test be wrong? ›

False-negative results occur because screening tests are imperfect, with sensitivity less than 100%, meaning they are unable to detect all disease present, especially early disease.

Are screening tests more accurate than diagnostic tests? ›

Though screening tests may detect irregularities or potential issues, they may not provide answers. If there is need for further diagnosis, that's where diagnostic tests are used. What makes diagnostic tests so valuable is their accuracy and specificity when it comes to results.

How accurate is carrier screening? ›

Accuracy of Prenatal Birth Disorder Testing

Some tests are more accurate than others. On average, carrier screens have a detection rate greater than 90%.


1. Best-Practices in Nursing Management of Opioid Use Disorder and Acute Withdrawal
(CA Bridge)
2. New Scams to Watch Out For in 2022
3. HJ Goes Live: How to Keep your Staff and Clients Safe
(Hairdressers Journal)
4. Medical Record Issues: Content, Maintenance and Retention
(Holland & Hart LLP)
5. Webinar NHS Test Trace
(Warwickshire County Council)
6. Working safely during Coronavirus: updated pubs, restaurants and bars
(Business Support)
Top Articles
Latest Posts
Article information

Author: Dr. Pierre Goyette

Last Updated: 11/19/2022

Views: 5853

Rating: 5 / 5 (50 voted)

Reviews: 89% of readers found this page helpful

Author information

Name: Dr. Pierre Goyette

Birthday: 1998-01-29

Address: Apt. 611 3357 Yong Plain, West Audra, IL 70053

Phone: +5819954278378

Job: Construction Director

Hobby: Embroidery, Creative writing, Shopping, Driving, Stand-up comedy, Coffee roasting, Scrapbooking

Introduction: My name is Dr. Pierre Goyette, I am a enchanting, powerful, jolly, rich, graceful, colorful, zany person who loves writing and wants to share my knowledge and understanding with you.