skip to Main Content

Latest lockdown guidance – what it means for Sutton

With a third national lockdown now underway, people are being instructed to stay at home to control the virus, protect the NHS and save lives.

The rules are the same as those enforced during the first lockdown in March 2020, with hospitality and events companies and non-essential business and service providers having to close again, if they hadn’t already under Tier 4 restrictions.

However, some shops remain open – as they are deemed essential businesses. Supermarkets, opticians, newsagents, garden centres and banks are allowed to stay open. Pubs, restaurants and cafes are allowed to continue takeaway or click and collect services, but the sale of takeaway alcohol is no longer allowed.

Places of worship are also allowed to remain open – but sports facilities must close.

For more information about what you can or cannot do, visit this page.

Successful Sutton BID is continuing to monitor the developments and how they could affect our local and business community, including the impact the emergency legislation is likely to have on businesses. We are making representations at a national level and will continue to keep all levy payers and stakeholders updated. If you have any questions, or would like to share best practice, please email us.

Coronavirus Job Retention Scheme update

The Coronavirus Job Retention Scheme (CJRS) has been extended to 30 April 2021, with government paying 80% of furloughed workers’ salaries, up to a maximum of £2,500 a month. Employers now only have to pay pension and National Insurance contributions.

Find out more here to check if you’re eligible and how to calculate and make a claim online.

Additional grant funding

Retail, hospitality and leisure businesses could be eligible for up to £9,000 in grant funding, to help them through to the Spring. The one-off top-ups will be granted to closed businesses as follows:

  • £4,000 for businesses with a rateable value of £15,000 or under
  • £6,000 for businesses with a rateable value between £15,000 and £51,000
  • £9,000 for businesses with a rateable value of over £51,000

Any business legally required to close, which cannot operate effectively remotely, is eligible for a grant.

Find out more here.

Business coronavirus support finder

For more information on coronavirus on financial support for businesses, follow this link, which allows employers to find out what support is available for themselves and their business.

Can Sutton businesses insist employees are vaccinated?

The well-publicised roll-out of COVID-19 vaccines is gathering pace. While it is initially being reserved for the high-risk categories and frontline health and care workers, it will not be long before millions of other people of working age are invited for a jab. It raises key questions for employers regarding their stance on the vaccine. Click here to read Helen Colechin from The HR Dept South London discussing some of the issues.

Successful Sutton COVID-19 business support mailer

If you would like to receive our regular COVID-19 business support mailer, which features the latest news and information, sign up here.

How employers can help working parents through school closures

In efforts to control the spread of coronavirus as vaccinations get underway, the government has temporarily closed schools to most pupils. Schools remain open for children who are vulnerable or whose parents are key workers and need the cover so they can go out to work. The closure of schools coincides with stay-at-home guidance, meaning that many working parents who can work from home, are also juggling childcare and now home schooling. HR Dept has published the below information to help employers help working parents through school closures. For more information on HR support, visit

This lockdown is different to the last

After nearly a year of lockdowns, enforced to varying degrees, being at home has been dubbed “the new normal” and some people have become accustomed to their new remote working routine. However, not everyone will be feeling this way. For the working parents on your team, the situation now is quite different to the lockdowns of 2020. Perhaps you can relate?

What’s changed?

With the bulk of 2020 interrupting the education system in one way or another, parents may feel under pressure to make sure their children do not miss out on any more learning. Suggested learning timetables and expectations on parents vary from one school to the next. They could involve a full day of activities requiring access to the internet, a need for printed materials, new online learning systems, calls with teachers and more. This is on top of the usual time and attention that childcare requires and responsibilities for work.

Why should employers support working parents?

Businesses have had more time to adjust to working through lockdowns with more tasks and processes becoming accessible to remote workers. In addition, employee absences due to the ongoing pandemic can create heavier workloads for employees in attendance. It is important employers remain aware of working parents who are currently home-schooling and the mounting pressures they may be under. If these employees are left unsupported, they may experience increased levels of stress which can have long-term damaging effects on both their mental and physical health.

January is already a tough time for many people, and life interruptions as a result of the pandemic can be hard on your employees. The good news is, there are ways in which you can help.

Ways to help the working parents in your business

There are plenty of ways in which you can support working parents on your team at this difficult time.

  • Flexible furlough – HMRC have updated rules to the furlough scheme meaning that employees can be furloughed if they are unable to work due to caring responsibilities resulting from coronavirus. This includes the event of school closures. It is up to you whether to furlough employees and depends on the needs of your business. Don’t forget that flexible furlough is an option which would see employees working part time.
  • Expect interruptions – Not everyone will have a dedicated home office, and with curiosity playing a big role in child development, you can expect to see them pop up occasionally mid-Zoom meeting. By expecting and allowing minor interruptions, employees will be better able to manage them with a clear head.
  • Flexible working – If suitable to the role, a temporary change to employee working hours may be helpful. By focusing on work completed rather than hours worked, employees can work around their home life to meet their obligations. Be sure to discuss this with concerned employees as they would need to agree to a change in contractual hours, even temporarily.
  • Keep in touch – Keeping in regular contact with employees and maintaining 1-2-1s is vital to monitor well-being and be able to offer support when needed. Talk to employees and ask them how they are coping since having the kids at home full time. You may be able to come up with some ways to help there and then. For example, you may have spare devices that could be loaned to them to avoid a whole family trying to work from one laptop.
  • Professional help – An Employee Assistance Programme (EAP) is a cost-effective and confidential support option for better worker well-being. EAPs give employees direct access to counselling, resources, and support on a variety of issues, from mental health to financial concerns, family issues, substance abuse and more. If you have one in place, a gentle reminder to all employees, including those on furlough, is a good idea.

Don’t forget yourself either. Your mental health matters and the business needs you. If you could do with some support with people management contact your local HR Dept today.

How to apply for the Coronavirus Job Retention Scheme

HMRC is advising all businesses that in order to make a claim, they will need to:

  • have a Government Gateway (GG) ID and password – if you don’t already have a GG account, you can apply here, or by going to GOV.UK and searching for ‘HMRC services: sign in or register’
  • be enrolled for PAYE online – if you aren’t registered yet, you can do so now, or by going to GOV.UK and searching for ‘PAYE Online for employers’.

There is step by step guidance on how to make a claim. In addition, the Coronavirus Job Retention online calculator tool has been updated, so it covers more employment circumstances including working out what businesses who can claim for most employees who are paid variable amounts each pay period, as well as those who are paid fixed amounts.

HMRC is also advising businesses to ensure they retain all records and calculations for your claims, in case they need to contact you about them. Provided your claim is made in accordance with HMRC’s published guidance, you can expect to receive the funds six working days after your application.

Coronavirus support from Sutton Council

Sutton Council is working with businesses and partner organisations to support businesses across the borough.

This page includes social distancing advice for customers, staff and deliveries/services, and further support including resources for high street businesses and licensing FAQs.

The council has also collated the grants available to businesses affected by the COVID-19 pandemic, across the different tier and national lockdown restrictions.

Each scheme requires a separate application. Please visit this page for more information and if you have any questions, please email or

What to do if you or an employee is contacted by NHS Test and Trace

NHS Test and Trace provides provides testing for anyone who has symptoms of coronavirus to find out if they have the virus, gets in touch with anyone who has had a positive test result to help them share information about any close recent contacts they have had and alerts those contacts, where necessary, and notifies them they need to self-isolate to help stop the spread of the virus.

By following instructions to self-isolate, people who have had close recent contact with someone with coronavirus will be protecting their family, friends, colleagues and other people around them, and will play a direct role in stopping the spread of the virus.

See further information on how NHS Test and Trace works.

The NHS COVID-19 app is an important part of NHS Test and Trace and enhances the contact tracing process by enabling users with a compatible smartphone to check symptoms, order tests and receive results and advice. The app will also provide alerts to self-isolate if a user has been in close contact of a confirmed case. This will help to break chains of transmission, keep people safe, and avoid the need for further societal and economic restrictions.

Guidance for employers

It’s critical employers take steps to keep workers and visitors safe. By following the sector-specific guidance, employers can reduce the risk of co-workers having to self-isolate if a member of staff tests positive for COVID-19. Working from home, where possible, is essential to limiting contacts between households. It’s recommended people continue to work from home, unless it’s not reasonably possible to do so.

If you need to leave your home to carry out your usual work duties you can do so. If necessary, you can also travel for work purposes and stay away from home.

It is vital employers play their part by:

  • making their workplaces as safe as possible (where working from home is not possible)
  • supporting their workers when in self-isolation

It is a legal requirement for employers to not knowingly allow an employee who has been told to self-isolate to come into work or work anywhere other than their own home for the duration of their self-isolation period. Failure to do so could result in a fine starting from £1,000.

NHS Test and Trace will support businesses and economic recovery by:

  • providing free testing for anyone who has symptoms of coronavirus
  • asking those that test positive and their close contacts to self-isolate to stop the spread of the virus in the workplace
  • enabling the government to safely lift lockdown measures

Employers (and the self-employed) must continue to ensure the health, safety and welfare of their employees. They also have similar obligations in respect of other people, for example agency workers, contractors, volunteers, customers, suppliers and other visitors.

Workplace risk

Employers must review risk assessments to ensure they remain suitable and sufficient. Where COVID-19 is a risk in the workplace, it must form part of the risk assessment. The Health and Safety Executive has published guidance to help you conduct a risk assessment.

Employers have a duty to consult their workers, and unions where applicable, as part of their risk assessment. Involving workers in this will help build trust and confidence that all reasonably practicable steps are being taken to reduce risks of COVID-19, so that people can return to work safely. Employers should share the risk assessment with workers and consider publishing the risk assessment on their website.

If a worker develops symptoms and orders a test

If a worker develops symptoms, they should request a free test as soon as their symptoms start. Once they have ordered the test, they’ll be asked by NHS Test and Trace to provide details of anyone who they have been in close recent contact with. This will not automatically be all their co-workers, but anyone who meets the definition of a close contact. A close contact is a person who has been close to someone who has tested positive for COVID-19 with a polymerase chain reaction (PCR) test. You can be a contact anytime from two days before the person who tested positive developed their symptoms, and up to 10 days after, as this is when they can pass the infection on to others.

A close contact can be:

  • anyone who lives in the same household as someone with COVID-19 symptoms or who has tested positive for COVID-19
  • anyone who has had any of the following types of contact with someone who has tested positive for COVID-19 with a PCR test:
    • face-to-face contact including being coughed on or having a face-to-face conversation within one metre
    • been within one metre for one minute or longer without face-to-face contact
    • sexual contacts
    • been within two metres of someone for more than 15 minutes (either as a one-off contact, or added up together over one day)
    • travelled in the same vehicle or a plane

An interaction through a Perspex (or equivalent) screen with someone who has tested positive for COVID-19 is not usually considered to be a close contact, as long as there has been no other contact such as those in the list above.

The contact tracers will not consider the wearing of personal protective equipment (PPE) as a mitigation when assessing whether a recent contact is likely to have risked transmitting the virus. Only full medical-grade PPE worn in health and care settings will be considered. Medical-grade PPE should not be purchased to circumvent self-isolation, as this risks disrupting critical supplies needed by the NHS and social care sector.

Alerting close contacts

When someone first develops symptoms and orders a test, they will be encouraged to alert the people they have had close contact with in the 48 hours before symptom onset. If any of those close contacts are co-workers, the person who has developed symptoms should consider asking their employer to alert those co-workers.

Close contacts at this stage do not need to self-isolate unless requested to do so by NHS Test and Trace or a public health professional, but they should:

  • avoid contact with people at high increased risk of severe illness from coronavirus, such as people with pre-existing medical conditions
  • take extra care in practising social distancing and good hygiene
  • watch out for symptoms and self-isolate if they also show signs of coronavirus

Employers may need to keep staff informed about COVID-19 cases among their colleagues. However, employers should not name the individual. If a co-worker is at risk because of close contact with the positive case, then they will be notified to self-isolate by NHS Test and Trace. Employers should make sure their workplaces are safe by regular cleaning and by encouraging good hygiene practice.

If the test is positive

If the person with symptoms tests positive for COVID-19, NHS Test and Trace will notify their close contacts and instruct them to self-isolate. This will occur by either a phone call, text message, email or letter. The period of self-isolation will be for 10 days from the point of most recent contact with the person who has tested positive for coronavirus. It is important for all contacts to self-isolate in this way because even if they do not experience symptoms, they could still be infectious to others. When NHS Test and Trace advises contacts to self-isolate, it does not tell them the identity of the person who has tested positive.

When a case would be escalated to local public health experts

Contact tracing will be taken over by local public health experts where the person who has a positive test result works in or has recently visited:

  • a health or care setting, for example a hospital, GP surgery or care home
  • a prison or other secure establishment
  • a school for children with special needs
  • any setting where there’s a risk of a local outbreak

Make sure your workers self-isolate

You should help your employees self-isolate if they have coronavirus symptoms and are waiting for a test result, or if they are a member of the same household as someone who has symptoms or has tested positive for COVID-19. You have a legal requirement to ensure your employees self-isolate if they:

  • have tested positive for coronavirus
  • have been in close recent contact with someone who has tested positive and received a notification to self-isolate from NHS Test and Trace

You should not share the identity of a worker who has tested positive with other workers.

Where workers are asked to self-isolate because they are a close contact of a positive case

If a worker is asked by NHS Test and Trace to self-isolate, you have a legal duty to not knowingly allow them to come into work, or encourage them to work anywhere other than their place of self-isolation.

If a worker is asked by NHS Test and Trace to self-isolate, you should:

  • continue to communicate with them and provide support
  • allow them to work from home if they remain well and it is practicable to do so, for example, by finding alternative work that can be completed at home

If a worker cannot work from home, you:

  • must ensure they receive Statutory Sick Pay (SSP) provided they meet the eligibility criteria
  • may consider giving them the option to use their paid leave days if they prefer

Employees in self-isolation are entitled to SSP for every day they are in isolation, as long as they meet the eligibility conditions. You may be able to reclaim SSP. NHS Test and Trace will provide evidence to your worker that they have been told to self-isolate. You should ask them to follow the instructions on getting an isolation note if you require evidence. You may need this evidence to reclaim SSP.

If contacted by NHS Test and Trace, your employee will need to self-isolate for 10 days from when they last came into contact with the positive case. They will not be able to leave self-isolation early even if they are not symptomatic. They should not take a test if they are not symptomatic as this could generate a false negative and they may then go on to develop symptoms in the following days.

Multiple cases in the workplace

If there are five or more COVID-19 cases in 14 days in a workplace, employers should contact their local health protection team to report the suspected outbreak.

Find your local health protection team.

The heath protection team will:

  • undertake a risk assessment
  • provide public health advice
  • where necessary, establish a multi-agency incident management team to manage the outbreak

Collecting customer and visitor data for NHS Test and Trace

It’s now mandatory organisations in designated sectors are allowed to remain open:

  • ask at least one member of every party of customers or visitors (up to six people) to provide their name and contact details if they have not scanned the official NHS QR code
  • keep a record of all staff working on their premises and shift times on a given day and their contact details
  • keep these records of customers, visitors and staff for 21 days and provide data to NHS Test and Trace if requested
  • display an official NHS QR code poster, so that customers and visitors can ‘check in’ using this option as an alternative to providing their contact details
  • adhere to General Data Protection Regulations

In addition, the hospitality sector is required to ensure that anyone visiting pubs, restaurants and other venues provides their contact information or checks in using the official NHS QR code before being allowed entry to the venue. Any designated venue found not to be compliant with these regulations will be subject to financial penalties. It is vital relevant venues comply with these regulations to help keep people safe, and to keep businesses open.

Designated venues will need to keep records of customers, visitors and staff for a period of 21 days and make them available when requested by NHS Test and Trace or local public health officials to help contain clusters or outbreaks.

NHS COVID-19 app and QR code poster

Designated venues must display an official NHS QR code poster to enable customers and visitors to scan the NHS QR code when they arrive by using the NHS COVID-19 app. The information stays on the user’s phone. As you are likely to already have a record of your employees and staff, they do not need to scan the NHS QR code. However, staff can scan the QR code, in addition, if they wish. Find out more about these requirements.

Employers should facilitate and support employee use of the app within their workplaces wherever possible, while recognising the app is not mandatory. Businesses and venues that are not currently expected to maintain staff, customer and visitor logs are encouraged to display official NHS QR code posters if they have indoor areas where individuals are likely to congregate or sit down in close contact. By displaying an official NHS QR code poster and encouraging people to use the NHS COVID-19 app, businesses will be helping to protect their customers, staff and themselves from the impact of the virus.

Official NHS QR posters can be generated online. Organisations can find out more about NHS QR codes and how to generate them on the NHS COVID-19 app website.

If you’re told to self-isolate you must stay at home

If you’re told to self-isolate you have a legal duty to inform your employers you have been instructed to self-isolate, as soon as possible before you are next due to work. Failure to do so could result in a £50 fine. If you’re told to self-isolate you should:

If you develop symptoms while you’re self-isolating, then you must be tested as soon as possible. Request a free test. Do not order a test if you do not have symptoms. A negative test does not mean that you can stop self-isolating as you will still be in the incubation period, and you could go on to develop COVID-19 in the following days.

If you’re already unable to work and have a fit note

If you have a ‘fit note’ due to an existing illness covering the period you’ve been told to self-isolate, you must follow the public health advice that you’ve been given.

If workplace contacts may have infected you

If you think you’ve been infected by your workplace colleagues, you should ask your employer to consider what they could do to reduce the risk of COVID-19. This could include:

  • other ways of working safely during COVID-19
  • ‘cohorting’ to reduce the number of people each person has contact with
  • using screens or other protective interfaces to separate people or manage workplace risk

Getting financial help if you’re asked to self-isolate

If you can continue to work while remaining at home then you must do so, by agreement with your employer. If it’s not possible for you to work, you can get SSP, as long as you meet the eligibility criteria. Some employers choose to offer more than the statutory minimum and provide more financial support to their workers while they’re off work. This is known as ‘contractual’ or ‘occupational’ sick pay.

If you’re no longer able to claim SSP you may be able to claim Universal Credit and/or Employment and Support Allowance. Further guidance is available on what to do if you’re employed and cannot work.

Using the NHS COVID-19 app

Once you’ve downloaded the app, it should be left on as much as possible. However, there are some specific workplace scenarios when you should pause the contact tracing feature. These are:

  • when you are working behind a Perspex (or equivalent) screen
  • if you are putting your phone in storage, such as in a work locker, and it will not be on your person
  • if you are a health or care worker practising infection prevention and control (IPC) working in a clinical setting

Contact tracing can be paused within the app by moving the contact tracing toggle on the home screen. It’s important you turn the contact tracing toggle back on as soon as you are not in one of the above scenarios, for example, when you retrieve your phone from your locker. To make it easier to remember to do this, you will be given the option to pause the feature for different time periods and you will then receive a reminder to turn the contact tracing feature back on.

Guidance for self-employed people

If you’re self-employed, you must continue to work from home if you can. If you cannot, you should follow the sector-specific advice.

Working from home, where possible, is essential to limiting contacts between households. It’s recommended that people continue to work from home, unless it’s not reasonably possible to do so.

If you need to leave your home to carry out your usual work duties you can do so. If necessary, you can also travel for work purposes and stay away from home.

When you must self-isolate

To help stop the spread of the disease, you’ll need to self-isolate if:

  • you or another household member develop symptoms
  • you test positive for coronavirus
  • NHS Test and Trace tells you to because you’ve had close recent contact with someone with coronavirus

If your business has been affected by coronavirus, you may be eligible for a grant through the Self-Employment Income Support Scheme.

Maintaining records of staff, customers and visitors to support NHS Test and Trace

Designated venues in certain sectors must have a system in place to request and record contact details of their customers, visitors and staff to help break the chains of transmission of coronavirus.

Venues in hospitality, the tourism and leisure industry, close contact services, community centres and village halls must:

  • ask at least one member of every party of customers or visitors (up to six people) to provide their name and contact details
  • keep a record of all staff working on their premises and shift times on a given day and their contact details
  • keep these records of customers, visitors and staff for 21 days and provide data to NHS Test and Trace if requested
  • display an official NHS QR code poster so that customers and visitors can ‘check in’ using this option as an alternative to providing their contact details
  • adhere to General Data Protection Regulations (GDPR)

Hospitality venues must also take reasonable steps to refuse entry to those who refuse to participate. Failure to do any of these requirements could result in fixed penalty fines.

This guidance provides further instructions on how to fulfil these requirements.

NHS Test and Trace

NHS Test and Trace is a key part of the country’s ongoing COVID-19 response. NHS Test and Trace includes dedicated contact tracing staff working at national level who work closely with local public health experts. Local public health experts include Public Health England (PHE), health protection teams and local authority public health staff.

You can read further information on how NHS Test and Trace works.

The purpose of maintaining records and displaying an official NHS QR poster

By maintaining records of staff, customers and visitors, and displaying an official NHS QR poster, you will help NHS Test and Trace to identify and notify people who may have been exposed to the virus.

You must register for an official NHS QR code and display the official NHS QR poster. The NHS COVID-19 app has a feature that allows users to quickly and easily ‘check in’ to your venue by scanning the code. The information stays on the user’s phone. In England, you do not have to ask people who choose to ‘check in’ using the official NHS QR code to provide their contact details. If there is an outbreak associated with a venue, a message will be sent to the relevant app users with the necessary public health advice.

In addition to maintaining and sharing records where requested and displaying an official NHS QR poster, you must also continue to follow other government requirements and guidance to minimise the transmission of COVID-19. This includes maintaining a safe working environment and following social distancing guidelines.

Sectors this guidance applies to

There is a higher risk of transmitting COVID-19 in premises where customers and visitors spend a longer time in one place and potentially come into close contact with other people outside of their household.

To manage this risk, establishments in the following sectors, whether indoor or outdoor venues or mobile settings, must request contact details from staff, customers and visitors, and display the official NHS QR code poster:

  • hospitality, including pubs, bars, restaurants and cafés
  • tourism and leisure, including hotels, museums, cinemas and amusement arcades
  • close contact services, including hairdressers, barbershops and tailors
  • community centres, libraries and village halls

A full list of organisations within scope in these sectors can be found in annex A.

This requirement applies to any establishment that provides an on-site service and to any events that take place on its premises. It does not apply where services are taken off site immediately, for example, a food or drink outlet which only provides takeaways. If a business offers a mixture of a sit-in and takeaway service, contact information only needs to be sought for customers who are dining in.

This could be asked for at the counter, rather than the point of entry, when servers can more easily ask the customer whether they are dining in or taking away. If you have multiple points of entry you will need to ensure you have a system that meets the legal requirements. This may mean adapting the way customers and visitors circulate in your premises.

Multi-use premises

If your business contains several individual venues, then you as the wider venue are still required to collect details of staff, customers and visitors at the main entrance. If your business is within a larger venue then you are only required to collect details of customers, visitors and staff in addition to the main entrance if you are a hospitality service, for example a cafe within a museum. Other types of businesses are not required to collect details, when they exist within a larger premises in scope.


Food and drink sold in cinemas will be considered a takeaway service, and there is no requirement to refuse custom to people who do not provide their contact details or check in with the NHS QR code.

Venues with open-plan dining areas

Some venues might have communal or open-plan dining areas such as food courts. In this situation, the responsibility lies with the legal owner of the space, who is liable for these requirements. If your business operates within a food court, where food and/or drink is sold and consumed solely in communal dining areas, then you as an individual business owner within the food court are not required to collect details of customers, visitors and staff. However, the legal owner of the wider venue is required to collect visitor details at a designated entrance to the food court. Where an outlet has their own seating area, the legal owner of that outlet is responsible.

Workplace canteens

Workplace canteens which are open only to staff at that workplace are not required to collect the details of their staff who visit the canteen. If a workplace canteen may be accessed by members of the public however (for example, anyone who is not an employee), then this venue would be required to collect the details of customers, visitors and staff.

Heritage sites

The requirement to collect contact details does not apply to unstaffed, unticketed heritage sites that are open to the public (for example, ruins or prehistoric sites) or archaeological and historic sites which are not open to the public.

Further education settings

If a venue within a further education college is open to the public, such as a café or swimming pool, then that venue is required to collect details of customers, visitors and staff and to display an official NHS QR code poster. These requirements are not applicable to these venues when they are accessed by students only.

Community centres and village halls

Community centres and village halls, which may host a variety of social, cultural and recreational activities, must collect information for all activities and events taking place within the venue. This should be collected by the person who hires the space. The venue must also display an official NHS QR code poster which can be used for every activity that takes place there.

Places of worship

Places of worship, including when the venue is used for events and other community activities, are not included in these regulations but are still strongly encouraged to maintain staff, customer and visitor logs and to display an official NHS QR code poster. Consent should still be sought from individuals entering your establishment.

Information to collect

Venues must ask every customer and visitor for the following details (unless they have ‘checked in’ using the NHS COVID-19 app):

  • the name of the customer or visitor. If there is more than one person, then you can record the name of the ‘lead member’ of the group (of up to six people) and the number of people in that group
  • a contact phone number for each customer or visitor, or for the lead member of a group of people. If a phone number is not available, you should ask for their email address instead, or if neither are available, then postal address
  • date of visit, arrival time and, where possible, departure time
  • the name of the assigned staff member, if a customer or visitor will interact with only one member of staff (for example, a hairdresser). This should be recorded alongside the name of the customer or visitor

Recording both arrival and departure times (or estimated departure times) will help reduce the number of customers or staff needing to be contacted by NHS Test and Trace. Departure times are not required by law.

All designated venues must also keep a record of all staff working on the premises on a given day, the time of their shift, and their contact details. This covers anyone providing a service or activity including volunteers. Venues must keep these records of staff, but staff can choose to check in using the NHS QR code poster in addition, if they wish. No additional data should be collected for this purpose.

In England, you do not have to request details from people who check in with the official NHS QR poster, and venues should not ask them to do both. Venues must not make the specific use of the NHS QR code a precondition of entry (as the individual has the right to choose to provide their contact details if they prefer). Should someone choose to check in with the official NHS QR poster, a venue should check their phone screen to ensure they have successfully checked in.

Many organisations that routinely take bookings already have systems for recording their customers and visitors – including restaurants, hotels, and hair salons. Due to the COVID-19 outbreak, more organisations have, or are planning to implement, an ‘advanced booking only’ service to manage the numbers of people on the premises. These booking systems can serve as the source of the information that you need to collect. Customers or visitors can still scan the official NHS QR code if they wish, to help remind them where they have been if asked by NHS Test and Trace.

You should collect this information in a way that is manageable for your establishment. If not collected in advance, this information should be collected at the point that visitors enter the premises. It should be recorded electronically if possible, for example through an online booking system, but a paper record is acceptable. If you are keeping a paper record, this should be out of public sight and stored securely. You must ensure that there are options for people to leave their contact details if they do not own a smartphone.

Venues introducing new systems to manage contact details must conduct a data protection impact assessment under the General Data Protection Regulations. The Information Commissioner’s Office (ICO) has guidance to help you minimise data protection risks. You must not use this data for any other purposes other than for NHS Test and Trace, unless you would already collect it for another business purpose. For example, you must not use data collected for NHS Test and Trace for marketing purposes. Failing to do this may lead to penalty fines and enforcement action from the ICO.

Displaying an official NHS QR poster

Designated venues must display an official NHS QR code poster at their entrance, or at the point of service. It’s quick and simple to use for both businesses and users, and enables customers and visitors to scan the NHS QR code when they arrive by using the NHS COVID-19 app. Organisations must have a system for individuals who do not have a smartphone or the NHS COVID-19 app to provide their contact details.

If an app user chooses to use the QR code check-in feature, you should not ask for their contact details. Official NHS QR posters can be generated online. Organisations can find out more about NHS QR codes and how to generate them on the NHS COVID-19 app website.

The NHS COVID-19 app is only able to scan official NHS QR code posters. This is for security reasons and because the NHS QR technology means that venue check-in history remains on the user’s device. In England, if you’re currently using your own QR code system to collect contact details, you should now switch to the official NHS QR code system. By supporting the official NHS system, you’ll be protecting your staff, customers and visitors.

If you use any other QR code system at your venue, you must ensure that it does not show any NHS or NHS Test and Trace logos. You should also explain to your customers and visitors that you are using more than one QR code system in your venue. Unofficial QR codes will not work with the NHS COVID-19 app, can cause confusion for visitors, and could result in them missing important public health advice. If you do not have access to a printer, you can display your QR code poster at your venue using digital signage, for example, a TV screen or iPad.

If someone does not wish to share their details, provides incorrect information or chooses not to scan the NHS QR code

Hospitality venues must take reasonable steps to refuse entry to a customer or visitor who does not provide their name and contact details, is not in a group (for which one other member has provided name and contact details), or who has not scanned the NHS QR code.

Hospitality venues should verify that an individual has checked in using the QR code by reviewing the individual’s phone screen. This is not necessary if they or another ‘lead’ member of the group have provided their contact details.

Venues in other settings do not need to refuse entry but should encourage customers and visitors to share their details or scan the official NHS QR poster in order to support NHS Test and Trace and advise them that this information will only be used where necessary to help stop the spread of COVID-19.

If in the rare case that a customer or visitor becomes unruly, you should follow your own security procedures. This may include calling the police if you feel the individual poses a risk to yourself or others.

The accuracy of the information provided will be the responsibility of the individual who provides it. You do not have to verify an individual’s identity for NHS Test and Trace purposes, and we advise against doing so except where organisations have a reasonable suspicion that customer or visitor details are incorrect. You may refuse to allow entry if you have reason to believe the details are inaccurate.

Exempt visits

You do not need to ask for contact details or check scanning of the NHS QR code if the person is a police officer or emergency responder on duty. You do not need to ask for contact details for people whose visit is for the sole purpose of making a delivery or collection by supplies or contractors, including food or physical goods. You do not need to ask for contact details for those under the age of 16. If an individual says they are under the age of 16, you should not ask for identification unless you judge this to be false. If someone does not have the mental capacity to provide their contact details, hospitality venues should not refuse entry (where they are normally required to do so). Businesses will not be in breach of the requirements if they have reason to believe someone can’t provide the details for disability reasons and don’t ask for them as a result.

Hospitality venues should not deny entry to homeless people who are unable to provide a contact number or email address.

Failure to comply

Collecting contact details and maintaining records for NHS Test and Trace is a legal requirement and failure to comply is punishable by a fine:

  • first fixed penalty: £1,000
  • second fixed penalty: £2,000
  • third fixed penalty: £4,000
  • any further penalty notice: £10,000

The person responsible for the organisation is liable. This could be the owner, proprietor or manager with overall responsibility of the organisation, business or service.

How records should be maintained

To support NHS Test and Trace, you must hold records for 21 days. This reflects the incubation period for COVID-19 (which can be up to 14 days) and an additional seven days to allow time for testing and tracing. After 21 days, this information must be securely disposed of or deleted. When deleting or disposing of data, you must do so in a way that does not risk unintended access (for example shredding paper documents and ensuring permanent deletion of electronic files). Records which are made and kept for other business purposes do not need to be disposed of after 21 days. The requirement to dispose of the data relates to a record that is created solely for the purpose of NHS Test and Trace. All collected data, however, must comply with the General Data Protection Regulation and should not be kept for longer than is necessary.

General Data Protection Regulation (GDPR)

The data you collect is personal data is and must be handled in accordance with GDPR to protect the privacy of your staff, customers and visitors. This section sets out the steps you can take to comply with GDPR.

You need to explain to people why you are collecting this data but this does not mean that you have to inform every customer or visitor individually. You might, for example, display a notice at your premises or on your website setting out what the data will be used for and the circumstances in which it might be accessed by NHS Test and Trace. A template privacy notice can be found in annex B. You may need to offer some people additional support in accessing or understanding this information, for example, if they have a visual impairment or cannot read English.

In places of worship, where this is not a legal requirement, consent to collect the data should still be sought from individuals. Personal data collected for NHS Test and Trace, which you would not collect in your usual course of business, must be used only to share with NHS Test and Trace. It must not be used for other purposes, including marketing, profiling, analysis or other purposes unrelated to contact tracing, or you will be in breach of GDPR.

You should make your staff aware of what they should and shouldn’t do with customer information. You must not misuse the data in a way that is misleading or could cause an unjustified negative impact on people, for example to discriminate against groups of individuals. The ICO may issue penalties against businesses in breach of GDPR.

Appropriate technical and security measures must be in place to protect customer contact information, and the ICO has produced guidance on this. These measures will vary depending on how you choose to hold this information, including whether it is collected in hard copy or electronically. We would prefer you to record and protect information electronically, but we understand this might not be possible.

When information should be shared with NHS Test and Trace

NHS Test and Trace or Public Health Officers will ask for these records only where it is necessary. For example, if your premises has been identified as the location of a potential COVID-19 outbreak. You and your staff must not share this information with anyone else and respect individuals’ privacy. NHS Test and Trace will work with you, if contacted, to ensure that information is shared in a safe and secure way. You must share the requested information as soon as possible to help us identify people who may have been in contact with the virus and help minimise the onward spread of COVID-19. NHS Test and Trace will handle all data according to the highest ethical and security standards and ensure it is used only for the purposes of protecting public health, including minimising the transmission of COVID-19.

If you are contacted by NHS Test and Trace, contact tracers will:

Local contact tracers may contact you from a different phone number or ask you to call them back. If you are unsure if the telephone number is genuine, check with your local council. More information can be found on your local council website.

Contact tracers will never:

  • ask you to dial a premium rate number to speak to them (for example, those starting 09 or 087)
  • ask you to make any form of payment or purchase a product or any kind
  • ask for any details about your bank account
  • ask for your social media identities or login details, or those of your contacts
  • ask you for any passwords or PINs, or ask you to set up any passwords or PINs over the phone
  • disclose any of your personal or medical information to your contacts
  • ask about protected characteristics that are irrelevant to the needs of NHS Test and Trace
  • provide medical advice on the treatment of any potential coronavirus symptoms
  • ask you to download any software to your PC or ask you to hand over control of your PC, smartphone or tablet to anyone else
  • ask you to access any website that does not belong to the government or NHS

How NHS Test and Trace will take steps to minimise transmission

If you receive a request for information from NHS Test and Trace, this does not mean that you must close your establishment. NHS Test and Trace will, if necessary, undertake an assessment and work with you to understand what actions need to be taken.

Depending on the circumstances and the length of time that has elapsed, this could include arranging for people to be tested, asking them to take extra care with social distancing and/or – in some circumstances – asking them to self-isolate. NHS Test and Trace will give you the necessary public health support and guidance. Your staff will be included in any risk assessment and NHS Test and Trace will advise them what they should do.

If a staff member, customer or visitor tells you they have tested positive for COVID-19, you should tell them to stay at home and self-isolate as soon as possible (along with the rest of their household) and encourage the individual to inform NHS Test and Trace of their recent contacts. You must not use the information you have collected to contact people.

NHS Test and Trace will provide the necessary public health advice and support if they assess an individual was on your premises while potentially infectious. If NHS Test and Trace identifies more than one case of COVID-19, or any other specific risk circumstances, at your venue you will be contacted to receive support and to share the contact details you have collected so that they can contact anyone who may have been exposed to the virus.

If you identify there is more than one case of COVID-19 on your premises, you should contact your local health protection team to report the suspected outbreak.

Registration with the ICO

Every organisation or sole trader who processes personal information, including for the purposes of contact tracing for COVID-19, must be registered with the ICO and pay a data protection fee unless they are exempt. If you are unsure whether you need to register, please contact the ICO via their helpline on 0303 123 1113, or visit the ICO website.

The cost of the data protection fee depends on the size and turnover of the business, but for most businesses it will cost £40 or £60. The registration form will take around 15 minutes to complete.

The ICO has published its own detailed guidance on collecting customer and visitor details for contact tracing.

Letters from the Secretary of State for Business, Energy and Industrial Strategy to the Manufacturing Industry, Construction Sectors and their Supply chains

The Secretary of State for Business Energy and Industrial Strategy, Rt Hon Kwasi Kwarteng, has written to the Manufacturing and Construction sectors regarding operating during the national lockdown.  He:

  • recognised the contribution of the sectors as valuable and as critical elements of the economic recovery the government is building and the fight against COVID-19;
  • encouraged firms and trades people in manufacturing and their supply chains, should continue to operate during the national lockdown;
  • stressed the importance for industry to ensure that it is safe to operate whilst carrying out work and that the safer working guidance is available and updated on a regular basis, and can be found on

To view the Secretary of State’s letter to the Manufacturing sectors, Click here.

To view the Secretary of State’s letter to the Construction sector, click here.

The Adjudicator has also written an open letter to tied tenants, from the Pubs Code Adjudicator (PCA), explaining important tenant rights in the Pubs Code that may help them especially during the current period of COVID-19 restrictions. To view this, click here.

Useful links

Business support packages: latest information & updates

The Coronavirus Business Support Hub is now available at

Funding and support

Self-employed people and sole traders

Your responsibilities as an employer

Managing your business during coronavirus

Business closures

Coronavirus Business Support Blog

The Department for Business, Energy and Industrial Strategy have created the Coronavirus Business Support Blog to help business get the support they need to help with the impact of coronavirus.

The latest Government information on Coronavirus can be found here, where you can also sign up for email updates for when any coronavirus information is changed on the GOV.UK website.

The Department of Health and Social Care’s Twitter feed also provides accurate information about Coronavirus.

For the latest TfL response to Coronavirus, visit this page.

The latest coronavirus information from Sutton Council can be found here.


A helpful factsheet for employers on the Coronavirus Job Retention Scheme, put together by Pilgrim Law (PDF Download)

COVID-19 – Financial Business Support (PDF Download)

Metropolitan Police – Empty Commercial Premises Advice (PDF Download)

COVID-19 – Guidance Employers and businesses – Poster – Public Health England (PDF Download)

Essential Retail Outlets (PDF Download)

GOV.UK Guidance – Further Business and Premises to close (PDF Download)

Coronavirus Control Guide – Hospitality and Catering, compiled by Navitas (PDF Download)

Coronavirus Control Guide – Office Premises, compiled by Navitas (PDF Download)

Coronavirus Control Guide – Non-food Retail (PDF Download)

NHS Test and Trace Workplace Guidance (PDF Download)

UK Protect national bulletin – 5 June 2020 (PDF Download)

Back To Top
×Close search