0370 270 6000

‘Test and Trace’ managing data in times of Covid-19

3 September 2020

Please note: the information contained in this legal update is correct as of the original date of publication.

As schools reopen for pupils and staff, a number of questions are being raised concerning steps that must be taken should an individual who has been on the school site be confirmed positive for Coronavirus.

In particular, there have been concerns raised about what information should be collected about visitors to the school site and what information should be shared with other agencies, such as NHS Test and Trace, and the legal basis for doing so under Data Protection requirements.

Guidance from the Department of Health and Social Care has been issued to other sectors outside of Education, including Hospitality and Tourism, as to what support NHS Test and Trace can provide in locating those who may have been exposed to the virus. Whilst this is not directed at education providers specifically, as schools record the attendance of pupils and staff etc., it is a useful approach to manage the information of visitors to your premises. Many schools following risk assessments are limiting visitors on to the school site at any one time, but where it is necessary a system to record their contact details should be adopted alongside your usual approach of recording data of their attendance, including time of visit and organisation details.

Where information is being collected from visitors, you will need to inform them as to the purpose for which you are collecting the data and who you will share it with (if necessary), i.e. NHS Test and Trace. This could be done by sharing a notice with them as they complete the visitor log-in system that you use.

Something to the following effect could be used:

As a visitor to [enter school name], we are required to request the following details from you for the purposes of safeguarding and health and safety. However, in addition, in the current climate we also require your immediate contact details, in the event that anyone at the school tests positive for Coronavirus within the next 21 days. In this instance we may be asked for the information you have provided to us by Government or health agencies such as NHS Test and Trace for the purposes of locating and advising those who may be at risk or be may be required to self-isolate. We would be sharing this information for such purposes under the legitimate interest basis, and we would therefore not require your consent. Further information about how we manage personal data can be found on our website at [enter website link].

You should also revisit your privacy notices (for students and staff) and ensure that these cover the sharing of their details with agencies such as NHS Test and Trace in the interests of public health. On this basis it would not be necessary to seek the consent of the individuals to then process the data and share it for the purposes of Test and Trace should this become necessary.

For further information about managing personal data on your site, please contact us.

Coronavirus support

We are helping across business, health, education and government sectors:

Focus on...

Legal updates

Keeping Children Safe in Education 2022: updated Governor and Trustee training requirement

The two biggest changes in the new safeguarding guidance revolve around sourcing high quality governor and trustee training and the new requirement to carry out online searches for shortlisted candidates.


Legal updates

Health and safety successes at trial highlighting need for engaging staff compliance training

Our insurance litigation specialists have recently successfully defended claims brought against two schools for alleged health and safety failings.


Published articles

KCSIE: How to research applicants' online profiles

The Department for Education published the draft 2022 version of Keeping Children Safe in Education. A few changes caught the eye and the one that most of us in education are discussing relates to a new set of text that suggested checking the online presence of job applicants.


Published articles

Five top tips for strong data compliance in 2022

This article has five excellent top tips for strong data compliance in 2022, including; embracing near misses, leading from the top, outcomes-focused training, learning walks, consequences.


The content on this page is provided for the purposes of general interest and information. It contains only brief summaries of aspects of the subject matter and does not provide comprehensive statements of the law. It does not constitute legal advice and does not provide a substitute for it.

Mailing list sign up

Select which mailings you would like to receive from us.

Sign up