Keeping a record of staff and visitors – what do I need to do?
To help prevent the spread of Covid-19 the Department of Health and Social Care has asked businesses and organisations to keep a temporary record of visitors and staff at their premises. In the event of a local outbreak of the virus this data may be used to assist NHS Test and Trace. This could help contain clusters or outbreaks of Covid-19.
Premises that should keep a record include:
- Hospitality - including pubs, bars, restaurants and cafés
- Tourism and leisure - including hotels, museums, cinemas, zoos and theme parks
- Close contact services - including hairdressers, barbershops and tailors
- Facilities provided by local authorities - including town halls and civic centres for events, community centres, libraries and children’s centres
- Places of worship, including use for events and other community activities
Take a look at the government guidance for these sectors.
The new guidance requires businesses in these sectors to have a system in place to request and record contact details of all their customers, visitors and staff to help control the spread of the coronavirus.
- Where a group attends premises for dining in or when on site, the requirement to provide contact details applies to all those in the group and not only to one person
- This information must be stored for 21 days and, if requested, must be shared with NHS Test and Trace or local public health officials
- Hospitality businesses must prevent entry to any customers who fail to provide complete contact details, or if it’s believed the contact details provided are inaccurate
- All reasonable measures must be taken to ensure their customers follow social distancing requirements and comply with the ‘rule of six’
Whilst there are exemptions, including for ‘household bubbles’, in principle businesses must not take bookings for more than six people, must not allow groups of more than six people to be admitted to their premises and must not allow separate groups to mingle. They must ensure appropriate distance is maintained between tables of different groups.
From 24 September, businesses must display an official NHS QR code poster so that customers and visitors can ‘check in’ using this option as an alternative to providing their contact details.
Information to collect
The following information should be collected by the venue, where possible:
- The names of staff who work at the premises
- A contact phone number for each member of staff
- The dates and times that staff are at work
Customers and visitors
- The name of the customer or visitor. If there's more than one person you can record the name of the ‘lead member’ of the group and the number of people in the group
- A contact phone number for each customer or visitor, or for the lead member of a group of people
- Date of visit, arrival time and, where possible, departure time
- If a customer will interact with only one member of staff (eg a hairdresser), the name of the assigned staff member should be recorded alongside the name of the customer
You may already have an existing system to collect most of this information or be starting from scratch. We've also provided a spreadsheet which you may wish to use to record this information. This can be done electronically or on paper. If you do use paper please don't share pens. We're aware that online apps are available, but we're not able to recommend any particular one. Please ensure that if you're using apps you follow GDPR requirements.
Keeping the information
- The information needs to be available for 21 days from the point of contact
- You need to keep this information securely for that time in accordance with GDPR requirements. Find out more from the ICO website
- The information needs to be destroyed after 21 days, and shouldn't be used for any other purposes
We've provided a template which you may wish to use to keep your customers informed about how their data may be used.
It's not your responsibility to check that the information given is correct, and some attendees may choose not to volunteer this information. However, we would emphasise that by volunteering their details customers are supporting the prevention of further clusters and outbreaks of Covid-19 in their own community.
Always follow data protection rules including GDPR. Find out more from the Gov.UK website.