All businesses and workplaces must display the official NZ COVID Tracer QR and have another way for people to check in. At all alert levels specified businesses are required to ensure that people scan in or leave their details.
This page includes:
To support contact tracing, it’s important people keep a track of where they’ve been, including by using the NZ COVID Tracer app. Using the app, or providing contact details, is the one thing we can all do to help contact tracing go faster when there is a case of COVID-19 in the community, and stop it from spreading.
Businesses play an important role in encouraging people to scan in with the NZ COVID Tracer app, record their visit in their diary or provide the business with their details and date and time of their visit.
From 11.59pm Tuesday 5 October, businesses need to have QR codes located in multiple places around the premises. This is in addition to the current requirement to have a QR code displayed at the main entrance of the premises. Businesses will need to make sure all QR code posters are in good condition so they can be easily scanned.
Unite against COVID-19 has further information about displaying your QR poster codes.
Get your QR code poster(external link) – covid19.govt.nz
Businesses are required to display multiple copies of a NZ COVID Tracer QR code and have an alternative way people can record their visit.
At all alert levels specified businesses that are open must have systems and processes in place to ensure, as far as is reasonably practicable, that everyone aged 12 years or older who enters their workplace either:
This means more than just displaying the QR code, and having a paper-based sign in system. It requires the person in charge of the business or service to have systems and processes in place to ensure that people do check in.
At Alert Levels 1 and 2 the contact record rule applies to visitors to listed businesses and services where there is likely to be close contact between workers and visitors, or between visitors who do not know each other. It does not apply to retail businesses, including supermarkets, dairies and banks.
It does not apply to the workers in those businesses or services, but we recommend you keep track of when your workers are present and what locations they work at.
This rule applies to regions at Alert Level 2 from 11.59pm on Tuesday 14 September.
See the list of business and services this applies to
Note, as no current regions are in Alert Level 1, this information is subject to change.
At Alert Level 3, the rules do not apply to businesses that are closed because they cannot operate at the Alert Level 3. Previous Orders that applied Alert Level 3 provisions, specified other businesses that did not need to comply with the contact record rule. This includes supermarkets, dairies and other certain uncooked food retailers, petrol stations, car rental and car share providers, banks, shopping malls and accommodation services, and vets.
At Alert Level 4, the rules only apply to specified businesses (as most businesses are already closed).
Deciding what systems and processes work best in your business will depend on how it operates – for example, its size, layout, and what people generally do when entering the premises, including any interactions with workers.
These actions could include:
Write down the systems and processes you have put in place, and ensure all your workers are aware of them.
You must display an NZ COVID Tracer QR code, but some people might not wish to or be able to scan in. If a person does not scan a QR code or record the visit themselves in their personal diary, you must provide a way for that person to provide you with a ‘contact record’. A contact record is the person’s name, the date and time they entered the workplace, and a telephone number.
This can be through an electronic system (such as the tablet sign-in apps already used by many businesses to register visitors), or a simple pen-and-paper register using individual slips and a ballot box for storage, or having an employee take attendance records on visitors’ behalf. If you already have systems for other purposes, such as building access swipe cards or an appointment booking system, you can use these as long as they collect all the required information (name, date, time, phone number).
More information on options to do this, and templates are available on the Unite against COVID-19 website:
Contact tracing at your workplace(external link) – covid19.govt.nz
A person organising a social gathering that is permitted at Alert Level 2 must have systems and processes in place to ensure, so far as is reasonably practicable, that each person aged 12 or over attending the social gathering scans the QR code, makes a diary note, or provides their details to the person organising the gathering. This rule only applies if the people at the gathering do not all know each other.
Guidance on social gatherings permitted at Alert Level 2(external link) — covid19.govt.nz
As well as meeting the alert level requirements, businesses must continue to comply with all other laws including the Health and Safety at Work Act 2015 (HSWA).
When considering what systems and processes to put in place, you should also think about how to keep your workers healthy and safe. This should include what you might do if a person becomes angry at the worker who is requesting they provide their details for contact tracing purposes.
If a customer, client or other visitor refuses or otherwise doesn’t check in despite the systems and processes you’ve put in place, you are not required to take any further action to make them. You just have to play your part in encouraging them to do so. You also do not have to take any action that would put your workers’ health and safety at risk.
You must involve your workers and their representatives (including unions) in creating these systems and processes.
You should ensure your workers have adequate support, instruction and information to perform these duties, including knowing what to do if things escalate.
We recommend you provide your staff with wording they can use if things escalate, so they are best able to de-escalate a situation. We recommend you are clear when workers should walk away or decide not to continue to engage with the person. Workers have the right to cease or refuse work where they believe that the work would expose them or another person to a serious health and safety risk. Information can be found on WorkSafe’s website.
You should also consider what kind of behaviour might mean you call the Police and publicising this – for example you may want to put signs up indicating that abuse of your staff will not be tolerated.
Businesses should only collect the information required by the Health Order – the name of the person, the date and time they visited, and a telephone number that can be used to contact them. The purpose of the collection is to enable the Ministry of Health to contact a person in the event of a suspected or confirmed case of COVID-19.
Accordingly, identity verification documents, number plates and other such personal information is unnecessary. Businesses should only ask for name, phone number and the date and time of visit.
When collecting this information, advise people that it is being collected to support contact tracing. It is your responsibility to store any private information securely. The information you collect can only be used for COVID-19 contact tracing. For example, you should not automatically add people’s emails to your contact database without their consent, or you may breach the Privacy Act.
Information you collect for contact tracing purposes must be kept for 60 days, and disposed of after this time.
If you are using a sign in sheet, you need to find a way to protect people’s privacy (e.g. new sheet for each person, or a ballot box arrangement).
The Office of the Privacy Commissioner has guidance on the handling of personal information.
More privacy guidance on contact tracing registers(external link)(external link) — Office of the Privacy Commissioner
We recommend you display a privacy statement alongside your register system. Here’s an example:
This information is being collected to assist in the management of the COVID-19 pandemic. It will be given to the Ministry of Health and/or the District Health Board on request in the event that it is required for contact tracing purposes. We will not use it for any other purpose, and will destroy it after 60 days.
It will be kept here at [name of the establishment]. You have a right to access and correct any information we hold about you.
Generally, every business and service must display multiple copies of the official NZ COVID Tracer app QR code at all Alert Levels.
Generate a QR code by visiting the COVID-19 website.
Get your QR code poster(external link) – covid19.govt.nz
Businesses can also download QR code posters through MBIE’s Business Connect. If you are already registered with Business Connect, simply log in to the service(external link) to get started.
A separate QR poster is needed for each unique location. Each location must display their poster in either a prominent place or near main entrances. This does not have to be a fixed location. We recommend you get a QR code if your business is a mobile business, such as a food truck.
Businesses and services include:
For the purposes of displaying a QR code, a workplace has the same definition as in the Health and Safety at Work Act. This means that a code must be displayed at any place where work is being carried out for a business and includes any place where a worker goes, or is likely to be, while at work.
If your workplace is a customer’s premise or a vehicle, you do not need to display a QR code. This means that tradies (such as plumbers), couriers and delivery drivers will not need to display a QR code when making deliveries to customers or working in someone's home. However, physical distancing requirements will apply, and you should keep detailed records of your movements. This can be paper-based, such as a diary, or electronically.
All public transport services and small passenger services, like taxis, are required to display QR codes. Airlines and inter-city buses are excluded from this requirement because they have ticketing with contact information readily available.
Each QR code poster relates to a specific premises or location. Print as many copies of the poster as needed to ensure there is one displayed prominently at or near every entrance to the premises. Additional copies are required to be displayed in other places, such as at the register.
Print your posters in A4 and in colour (if possible), and do not crop them – they must be displayed in their entirety. You must keep QR code posters in a good condition, this limits the risk that scanning doesn’t take place if posters are faded, damaged or difficult to scan in on.
Ensure you have multiple QR codes displayed
Additional copies of a COVID-19 QR code will need to be displayed in other places throughout businesses and locations. This is in addition to an already required QR code displayed at the main entrance.
This is to limit any potential barriers for scanning to take place and ensures people are given as many opportunities to scan in, which should be as easy and accessible as possible for everyone.
This can also help reduce the likelihood of queues forming at locations which can be an additional benefit from a public health perspective too.
Make sure to put your QR code posters on display in prominent locations next to every entrance to the premises.
If you can, place a poster on the left-hand side of your front window or entrance, with the top approximately 130cm from the ground. It is key to make it easy for people to reach without creating an obstruction.
Try not to place your posters on sliding or revolving doors, in narrow or hard-to-see areas, in places with high glare, or in locations that are too high or hard to reach.
How to display your QR code poster(external link) — Ministry of Health
At Alert Levels 1 and 2 the following types of businesses and services must have systems and processes in place to ensure, so far as is reasonably practicable, that every visitor to the business or services scans the QR code or otherwise checks in:
Note: as no current regions are in Alert Level 1, this information is subject to change.
At Alert Level 3, the rules do not apply to businesses that are closed because they cannot open at Alert Level 3. Previous Health Orders that applied Alert Level 3 provisions specified other businesses that did not need to comply with the contact record rule.
As no current regions are in Alert Level 3, this information is subject to change.
At Alert Level 3, under the previous Health Order, the mandatory rules on record-keeping for contact tracing apply for most businesses, except:
These workplaces only need to make reasonable attempts to record visitors, not staff (though we would recommend you keep track of what shifts your workers are working and the locations they work at):
If your business or workplace is not listed above, you must follow the rules on mandatory record keeping.
At Alert Level 4, most businesses are closed. The following business must ensure, so far as is reasonably practicable, that people record their visit. If your businesses isn’t listed here, it’s because your business can’t open at Alert Level 4, or the mandatory record keeping rules do not apply to your business type.
Business, services and workplaces which need to record visitors (but not staff) who come onto their premise:
Business, services and workplaces which need to record everyone who comes onto their premise (including workers, customers and clients).
You can find further information about the QR codes and all download processes from the Ministry of Health including contact details if any assistance is required.
NZ COVID tracer(external link) — Ministry of Health