Track and trace: How to comply with the new regulations


The ‘track and trace’ programme is part of the government’s plan to slow the spread of Covid-19. It’s designed to make sure those who have been in close proximity with someone who has tested positive for the virus can be contacted and given advice to follow. Until recently, the government recommended hospitality businesses to collect certain customer information. From 17 September however, this became a legal requirement.

New track and trace regulations

A new set of regulations came into force requiring hospitality businesses to collect certain customer information as part of the colloquially known “track and trace” programme. This legal requirement will ensure NHS Test and Trace and local public health officials have all the information they need to contact people and provide appropriate public health advice with an aim to trace and stop the spread of coronavirus.

If you run a hospitality business, you are required to collect information from the following people:

  • Customers (apart from those under 16 or who are unable to do so for health reasons)
  • Staff
  • Volunteers

However, you don’t need to collect information from these people:

  • Police officers on duty
  • Emergency responders on duty
  • Persons visiting your premises for deliveries or collection

New requirement for QR codes

From Thursday 24 September, you must display or make available a QR code to record when customers and staff are on your premises. It should be at the entrance of your premises and people who visit your business can scan the code with a smartphone to record their entry and exit. 

We recommend that you have your QR code in place as soon as possible to avoid having to collate information manually, which would create a bottle neck at the entrance of your venue. Read more about how to create your own QR code for your venue. 

Track and trace for people without a smartphone

Not everyone will have the ability to scan a QR code. They might not have a smartphone or one with the right technology. In these circumstances, the following rules apply:

For individuals

If an individual has not scanned the QR code, you must ask them to provide their details (these are set out below)

For groups

The current guidance says you can collect details of only one member of a group, but from Thursday 24 September, you must capture the details of each member of the group

You need to collect this information:

  • the name of the individual
  • their contact number 
  • an email address (if the person can’t provide a phone number)
  • a postal address (if the person can’t provide an email address)
  • the date and time the person entered the relevant premises
  • if in a group, the number of the people in that group, including any members who have scanned the QR code 

Situations where contact is limited 

You may have organised your operations so that a customer is only likely to come in contact with one member of staff. For example, they are met at the entrance by their waiter/waitress who will have sole responsibility for their table during their visit. In these situations, you must record the name of that member of staff together with the name of the customer/customers.

Retaining information for track and trace

It can take some time for Covid-19 symptoms to show, which is why you have to keep hold of the information you’ve gathered for a period of 21 days. After this time, it’s vital you destroy these details as soon as is reasonably practicable to help protect this personal information.

Refusing entry

It may feel uncomfortable, but if someone won’t provide the information above (or provides inaccurate or incomplete information), you must refuse their entry. We suggest you record this information in the same way you might record the refusal to sell alcohol.

Failure to comply: offences and penalties 

A breach of these regulations may result in prosecution or in a fixed penalty fine being imposed. These start at £100 for the first offence (reduced to £50 if paid within 14 days). The fine doubles for each subsequent offence up to a maximum of £3,200. These regulations will remain in force until 24 September 2021, with a review on the 24 March 2021.

Our recommendations

It may take time for customers to come to terms with the new requirements (particularly where they are in a group. We believe the sooner you have a QR code in place on your premises, the easier it will be for you – and your customers – to comply. It’s vital you understand and follow these rules, so do contact us if you’d like any more guidance. 

This publication is intended for general guidance and represents our understanding of the relevant law and practice as at 15 September 2020. Specific advice should be sought for specific cases. For more information see our terms & conditions.

Get in touch

Related insights & events

View all

Hot topics

Related services