0370 270 6000

already registered?

Please sign in with your existing account details.

need to register?

Register to access exclusive content, sign up to receive our updates and personalise your experience on brownejacobson.com.

Privacy statement - Terms and conditions

‘Test and Trace’ managing data in times of Covid-19

3 September 2020

Please note: the information contained in this legal update is correct as of the original date of publication.

As schools reopen for pupils and staff, a number of questions are being raised concerning steps that must be taken should an individual who has been on the school site be confirmed positive for Coronavirus.

In particular, there have been concerns raised about what information should be collected about visitors to the school site and what information should be shared with other agencies, such as NHS Test and Trace, and the legal basis for doing so under Data Protection requirements.

Guidance from the Department of Health and Social Care has been issued to other sectors outside of Education, including Hospitality and Tourism, as to what support NHS Test and Trace can provide in locating those who may have been exposed to the virus. Whilst this is not directed at education providers specifically, as schools record the attendance of pupils and staff etc., it is a useful approach to manage the information of visitors to your premises. Many schools following risk assessments are limiting visitors on to the school site at any one time, but where it is necessary a system to record their contact details should be adopted alongside your usual approach of recording data of their attendance, including time of visit and organisation details.

Where information is being collected from visitors, you will need to inform them as to the purpose for which you are collecting the data and who you will share it with (if necessary), i.e. NHS Test and Trace. This could be done by sharing a notice with them as they complete the visitor log-in system that you use.

Something to the following effect could be used:

As a visitor to [enter school name], we are required to request the following details from you for the purposes of safeguarding and health and safety. However, in addition, in the current climate we also require your immediate contact details, in the event that anyone at the school tests positive for Coronavirus within the next 21 days. In this instance we may be asked for the information you have provided to us by Government or health agencies such as NHS Test and Trace for the purposes of locating and advising those who may be at risk or be may be required to self-isolate. We would be sharing this information for such purposes under the legitimate interest basis, and we would therefore not require your consent. Further information about how we manage personal data can be found on our website at [enter website link].

You should also revisit your privacy notices (for students and staff) and ensure that these cover the sharing of their details with agencies such as NHS Test and Trace in the interests of public health. On this basis it would not be necessary to seek the consent of the individuals to then process the data and share it for the purposes of Test and Trace should this become necessary.

For further information about managing personal data on your site, please contact us.

Coronavirus support

We are helping across business, health, education and government sectors:

training and events


PraxisAuril 2021 Conference Online

Come and meet our Head of Higher Education and IP specialist Helen Jones at this two day event. We’ll be on hand to discuss how our full service team can help your institution realise your goals. Please note that this event was postponed from June 2020.

View event

focus on...

Rising to the challenge: Digital transformation in schools - Part 2

Catch up for part 2 of our education training videos, exploring the role of digital transformation on our education system.


Legal updates

Delivering live remote learning to pupils – some data protection considerations

Education providers have become more innovative with their delivery of lessons to ensure all students are able to and are participating. Delivery of lessons include live teaching sessions through video conferencing platforms, but it does create a number of additional issues.


Rising to the challenge: Digital transformation in schools - Part 1

Catch up on our on-demand video to see the latest in our series looking at how the education sector is rising to the challenge and should look forward with optimism.


Legal updates

New year, new approach – getting compliance right

Compliance is a broad term and covers the three Ps – paper, people and practice. Be it safeguarding, GDPR or health and safety, there is a direct link between high-quality, outcomes-focused training and the impact on staff and children in your setting and to help you get it right, here are my eight tips for excellent compliance training.


The content on this page is provided for the purposes of general interest and information. It contains only brief summaries of aspects of the subject matter and does not provide comprehensive statements of the law. It does not constitute legal advice and does not provide a substitute for it.

mailing list sign up

Select which mailings you would like to receive from us.

Sign up