COVID-19 & Data Protection

Contact Tracing

As businesses start reopening their operations and, in some industries, welcoming back members of the public, you may wish or be required to collect personal data for the purpose of contact tracing, should the need arise. The sectors which are required to keep such records include (but are not limited to):

• Pubs & Bars
• Restaurants & Cafes
• Hotels, museums, cinemas, zoos & theme parks

It is important to note that this applies to all the above, regardless of whether service is conducted indoors or outdoors.

Rest assured that this does not need to be complicated and can be done electronically or on paper – as long as you adopt a common-sense approach and treat your customers’ data with due respect.  

• Limitation – only collect the data you would need for the purpose of contact tracing, such as name, contact details and time of arrival

• Transparency – be open and transparent with your customers, letting them know what you need and why. You may wish to do this by displaying a notice in your premises, include it on your website and/or simply telling them in person

• Security – take steps to keep your customers’ data safe. Depending on your method of collection, this could mean keeping it secure on a device or keeping paper records locked away. Only share this data with NHS Track and Trace, taking care to ensure the caller is genuine

• Purpose – you cannot use the data you collect for contact tracing for other purposes, such as marketing

• Deletion – don’t keep the data for longer than Government guidelines specify (currently 21 days in England) and make sure you dispose of the data securely to avoid anyone else accessing it. For example, shred papers and permanently delete digital files from your recycle bin or back-up cloud storage.

Questions? Get in touch with your usual Goodwille contact.