In association with

COVID-19: Record keeping to support contact tracing

All businesses and workplaces must display the official NZ COVID Tracer QR and have another way for people to check in. At all alert levels specified businesses are required to ensure that people scan in or leave their details.  

This page includes:

To support contact tracing, it’s important people keep a track of where they’ve been, including by using the NZ COVID Tracer app. Using the app, or providing contact details, is the one thing we can all do to help contact tracing go faster when there is a case of COVID-19 in the community, and stop it from spreading.

Businesses play an important role in encouraging people to scan in with the NZ COVID Tracer app, record their visit in their diary or provide the business with their details and date and time of their visit.

Changes to QR code posters

From 11.59pm Tuesday 5 October, businesses need to have QR codes located in multiple places around the premises. This is in addition to the current requirement to have a QR code displayed at the main entrance of the premises. Businesses will need to make sure all QR code posters are in good condition so they can be easily scanned.

Unite against COVID-19 has further information about displaying your QR poster codes.

Get your QR code poster(external link) –

The rules on record-keeping to support contact tracing

Businesses are required to display multiple copies of a NZ COVID Tracer QR code and have an alternative way people can record their visit.

At all alert levels specified businesses that are open must have systems and processes in place to ensure, as far as is reasonably practicable, that everyone aged 12 years or older who enters their workplace either:

  1. scans the NZ COVID Tracer QR code
  2. makes some other kind of personal contact record (e.g. a diary note), or
  3. provides their name and phone number to business, alongside the date and time they were present.

This means more than just displaying the QR code, and having a paper-based sign in system. It requires the person in charge of the business or service to have systems and processes in place to ensure that people do check in.

At Alert Levels 1 and 2 the contact record rule applies to visitors to listed businesses and services where there is likely to be close contact between workers and visitors, or between visitors who do not know each other. It does not apply to retail businesses, including supermarkets, dairies and banks.

It does not apply to the workers in those businesses or services, but we recommend you keep track of when your workers are present and what locations they work at.

This rule applies to regions at Alert Level 2 from 11.59pm on Tuesday 14 September.

See the list of business and services this applies to

Note, as no current regions are in Alert Level 1, this information is subject to change.

At Alert Level 3, the rules do not apply to businesses that are closed because they cannot operate at the Alert Level 3. Previous Orders that applied Alert Level 3 provisions, specified other businesses that did not need to comply with the contact record rule. This includes supermarkets, dairies and other certain uncooked food retailers, petrol stations, car rental and car share providers, banks, shopping malls and accommodation services, and vets.

See the list of businesses that the previous Health Order did not apply to

At Alert Level 4, the rules only apply to specified businesses (as most businesses are already closed).

See the list of specified businesses

Systems and processes to make sure people scan in or record their visit

Deciding what systems and processes work best in your business will depend on how it operates – for example, its size, layout, and what people generally do when entering the premises, including any interactions with workers.

 These actions could include: 

  • ensuring you have prominent signage and messaging about checking in
  • setting a condition of entry to premises that customers and other visitors must check-in
  • ensuring you have multiple QR codes displayed throughout your premises enabling customers to have additional opportunities to sign in
  • having your staff remind or enquire about whether customers/ visitors have checked in during ‘ordinary’ interactions (e.g. at ordering/ payment point)
  • having someone stationed at the door to greet customers and encourage them to check in (ensuring you also comply with the distancing requirements) that apply depending on alert levels
  • checking that existing systems (such as building or premise access cards or appointment booking systems) collect the necessary contact information, and are being used widely by customers/visitors.

Write down the systems and processes you have put in place, and ensure all your workers are aware of them.

Provide multiple options to record people’s visits

You must display an NZ COVID Tracer QR code, but some people might not wish to or be able to scan in. If a person does not scan a QR code or record the visit themselves in their personal diary, you must provide a way for that person to provide you with a ‘contact record’. A contact record is the person’s name, the date and time they entered the workplace, and a telephone number.

This can be through an electronic system (such as the tablet sign-in apps already used by many businesses to register visitors), or a simple pen-and-paper register using individual slips and a ballot box for storage, or having an employee take attendance records on visitors’ behalf. If you already have systems for other purposes, such as building access swipe cards or an appointment booking system, you can use these as long as they collect all the required information (name, date, time, phone number).

More information on options to do this, and templates are available on the Unite against COVID-19 website:

Contact tracing at your workplace(external link) –

Requirements for people organising social gatherings that are permitted at Alert Level 2

A person organising a social gathering that is permitted at Alert Level 2 must have systems and processes in place to ensure, so far as is reasonably practicable, that each person aged 12 or over attending the social gathering scans the QR code, makes a diary note, or provides their details to the person organising the gathering. This rule only applies if the people at the gathering do not all know each other.

Guidance on social gatherings permitted at Alert Level 2(external link) —

Keeping your workers safe when they ask people to sign in or record their visit

As well as meeting the alert level requirements, businesses must continue to comply with all other laws including the Health and Safety at Work Act 2015 (HSWA).

When considering what systems and processes to put in place, you should also think about how to keep your workers healthy and safe. This should include what you might do if a person becomes angry at the worker who is requesting they provide their details for contact tracing purposes.

If a customer, client or other visitor refuses or otherwise doesn’t check in despite the systems and processes you’ve put in place, you are not required to take any further action to make them. You just have to play your part in encouraging them to do so. You also do not have to take any action that would put your workers’ health and safety at risk.

You must involve your workers and their representatives (including unions) in creating these systems and processes.

Worker engagement and participation(external link) - WorkSafe

You should ensure your workers have adequate support, instruction and information to perform these duties, including knowing what to do if things escalate.

Providing information, training, instruction or supervision for workers(external link) - WorkSafe

We recommend you provide your staff with wording they can use if things escalate, so they are best able to de-escalate a situation.  We recommend you are clear when workers should walk away or decide not to continue to engage with the person. Workers have the right to cease or refuse work where they believe that the work would expose them or another person to a serious health and safety risk. Information can be found on WorkSafe’s website.

Request assistance to resolve issues relating to the cessation of work(external link) - WorkSafe

You should also consider what kind of behaviour might mean you call the Police and publicising this – for example you may want to put signs up indicating that abuse of your staff will not be tolerated.

Collect only what’s necessary and ensure private information is protected

Businesses should only collect the information required by the Health Order – the name of the person, the date and time they visited, and a telephone number that can be used to contact them. The purpose of the collection is to enable the Ministry of Health to contact a person in the event of a suspected or confirmed case of COVID-19.

Accordingly, identity verification documents, number plates and other such personal information is unnecessary. Businesses should only ask for name, phone number and the date and time of visit.

When collecting this information, advise people that it is being collected to support contact tracing. It is your responsibility to store any private information securely. The information you collect can only be used for COVID-19 contact tracing. For example, you should not automatically add people’s emails to your contact database without their consent, or you may breach the Privacy Act.

Information you collect for contact tracing purposes must be kept for 60 days, and disposed of after this time.

If you are using a sign in sheet, you need to find a way to protect people’s privacy (e.g. new sheet for each person, or a ballot box arrangement).

The Office of the Privacy Commissioner has guidance on the handling of personal information.

More privacy guidance on contact tracing registers(external link)(external link) — Office of the Privacy Commissioner

Privacy statements

We recommend you display a privacy statement alongside your register system. Here’s an example:

This information is being collected to assist in the management of the COVID-19 pandemic. It will be given to the Ministry of Health and/or the District Health Board on request in the event that it is required for contact tracing purposes. We will not use it for any other purpose, and will destroy it after 60 days.

It will be kept here at [name of the establishment]. You have a right to access and correct any information we hold about you.

Get your NZ COVID Tracer QR code

Generally, every business and service must display multiple copies of the official NZ COVID Tracer app QR code at all Alert Levels.

Generate a QR code by visiting the COVID-19 website.

Get your QR code poster(external link) –

Businesses can also download QR code posters through MBIE’s Business Connect. If you are already registered with Business Connect, simply log in to the service(external link) to get started.

A separate QR poster is needed for each unique location. Each location must display their poster in either a prominent place or near main entrances.  This does not have to be a fixed location. We recommend you get a QR code if your business is a mobile business, such as a food truck. 

Businesses and services include:

  • voluntary and not-for-profit services
  • both public sector and private sector businesses and services
  • businesses and services that provide space for other businesses and services to operate within, such as shopping malls and marketplaces
  • businesses and services that provide facilities or venues for events or activities if people pay to attend the event or participate in the activities or pay to hire the facility or venue; and
  • playing sports professionally or semi-professionally.

For the purposes of displaying a QR code, a workplace has the same definition as in the Health and Safety at Work Act. This means that a code must be displayed at any place where work is being carried out for a business and includes any place where a worker goes, or is likely to be, while at work.

QR codes for mobile workers and delivery vehicles

If your workplace is a customer’s premise or a vehicle, you do not need to display a QR code. This means that tradies (such as plumbers), couriers and delivery drivers will not need to display a QR code when making deliveries to customers or working in someone's home. However, physical distancing requirements will apply, and you should keep detailed records of your movements. This can be paper-based, such as a diary, or electronically.

Public transport and small passenger services

All public transport services and small passenger services, like taxis, are required to display QR codes. Airlines and inter-city buses are excluded from this requirement because they have ticketing with contact information readily available.

Tips on displaying your poster

Each QR code poster relates to a specific premises or location. Print as many copies of the poster as needed to ensure there is one displayed prominently at or near every entrance to the premises. Additional copies are required to be displayed in other places, such as at the register.

Print your posters in A4 and in colour (if possible), and do not crop them – they must be displayed in their entirety. You must keep QR code posters in a good condition, this limits the risk that scanning doesn’t take place if posters are faded, damaged or difficult to scan in on.

Ensure you have multiple QR codes displayed

Additional copies of a COVID-19 QR code will need to be displayed in other places throughout businesses and locations. This is in addition to an already required QR code displayed at the main entrance.

This is to limit any potential barriers for scanning to take place and ensures people are given as many opportunities to scan in, which should be as easy and accessible as possible for everyone.

This can also help reduce the likelihood of queues forming at locations which can be an additional benefit from a public health perspective too.

Place QR code posters in accessible places

Make sure to put your QR code posters on display in prominent locations next to every entrance to the premises.

If you can, place a poster on the left-hand side of your front window or entrance, with the top approximately 130cm from the ground. It is key to make it easy for people to reach without creating an obstruction.

Try not to place your posters on sliding or revolving doors, in narrow or hard-to-see areas, in places with high glare, or in locations that are too high or hard to reach.

How to display your QR code poster(external link) — Ministry of Health

Alert Levels 1 and 2: Businesses and services where the contact record rule applies

At Alert Levels 1 and 2 the following types of businesses and services must have systems and processes in place to ensure, so far as is reasonably practicable, that every visitor to the business or services scans the QR code or otherwise checks in:

  • businesses that serve food and drinks, such as cafes, restaurants, bars, clubs, and soup kitchens. This doesn’t apply to accommodation services selling or providing food or drink for residents (including room service), businesses or services providing food or drink to their workers, or vending machines that are located and used within a workplace
  • close proximity businesses, where the business or service requires physical contact or close-proximity between people, such as massage and hairdressing services, and semi-professional and professional sports
  • indoor public facilities, such as museums, libraries and swimming pools
  • indoor event facilities, such as cinemas, theatres, concert venues, and casinos
  • indoor exercise facilities, such as gyms
  • health services, including pharmacies
  • courts and tribunals
  • category A social services with a public area, including a customer service counter.

Note: as no current regions are in Alert Level 1, this information is subject to change.

Alert Level 3: Exemptions from record-keeping rules

At Alert Level 3, the rules do not apply to businesses that are closed because they cannot open at Alert Level 3. Previous Health Orders that applied Alert Level 3 provisions specified other businesses that did not need to comply with the contact record rule.

As no current regions are in Alert Level 3, this information is subject to change.

At Alert Level 3, under the previous Health Order, the mandatory rules on record-keeping for contact tracing apply for most businesses, except:

  • rental car services and car share services
  • veterinary services and animal health and welfare services
  • other Justice sector services, not elsewhere listed
  • supermarkets and dairies
  • licencing trusts
  • retail butchers, fishmongers, and greengrocers
  • petrol stations, including any stores operating as part of the petrol station
  • food banks
  • hardware and do-it-yourself stores
  • banks
  • shopping malls
  • accommodation services
  • New Zealand Post Limited
  • education entities
  • transport stations and public transport services (other than those provided by means of air transport or small passenger service vehicles)
  • public transport services provided by means of air transport or small passenger service vehicles
  • any businesses that is closed, because it cannot open at Alert Level 3.

These workplaces only need to make reasonable attempts to record visitors, not staff (though we would recommend you keep track of what shifts your workers are working and the locations they work at):

  • services provided under the Oranga Tamariki Act 1989, and other social services provided to support persons to maintain critical well-being and as crisis support for people who are unsafe or homeless
  • courts and tribunals
  • health services, including pharmacies.

If your business or workplace is not listed above, you must follow the rules on mandatory record keeping.

Alert Level 4: Record keeping rules for specified workplaces

At Alert Level 4, most businesses are closed. The following business must ensure, so far as is reasonably practicable, that people record their visit. If your businesses isn’t listed here, it’s because your business can’t open at Alert Level 4, or the mandatory record keeping rules do not apply to your business type.

Business, services and workplaces which need to record visitors (but not staff) who come onto their premise:

  • health services, including pharmacies
  • entities required to provide distance or online learning for primary and secondary education
  • courts and tribunals
  • social and community-based services provided to support persons to maintain critical well-being or as crisis support for people who are unsafe or homeless.

Business, services and workplaces which need to record everyone who comes onto their premise (including workers, customers and clients).

  • Food delivery services for:
    • bakeries
    • uncooked food suppliers
    • alcohol suppliers.           
  • Cooked food delivery services, but only if referred by the Ministry of Social Development, a District Health Board, or the Accident Compensation Corporation, for example, Meals on Wheels.
  • Sale of essential non-food consumer products (via online ordering and contactless delivery) that are necessary for people to remain healthy and safe while isolating, to work or study from home, and to stay in communication with whānau and friends and remain up to date with news and health information, including—
    • necessary clothing, footwear, and bedding
    • urgently required whiteware and appliances (for example, refrigerators, heaters, washing machines and dryers, vacuum cleaners, fans, and dehumidifiers)
    • urgently required cooking, cleaning, and laundry equipment
    • medicinal and hygiene products (for example, medication, PPE, first aid products, soaps, shampoos, moisturisers, and hand sanitisers)
    • urgently required items for transport maintenance (for example, bicycle and automotive parts and repair kits)
    • materials for urgent home repair
    • urgently required communication devices (for example, mobile phones, computer equipment, modems and Internet equipment, televisions, and radios)
    • urgently required educational materials and books
    • urgently required home office equipment.
  • Building, construction, and maintenance services required for one or both of the following:
    • to address immediate risks to health and safety
    • nationally important infrastructure that enables or supports supply chains that are needed for 1 or both of the following:
      • to provide for the current needs of people and communities
      • to enable or support the recovery of the whole or any part of New Zealand from the effects of COVID-19.
  • Entities with statutory responsibilities for building and resource consenting that is necessary to enable the building, construction, and maintenance services referred to above.
  • Other parts of the Justice sector.           
  • Postal and courier services:
    • freight services (including those for transporting livestock) provided by means of road, rail, air, or sea
    • any other transport and logistics services, including those provided at or through an aerodrome or a port.
  • Primary industries (which means food and beverage processing, packaging, and production for both domestic consumption or export, plus the relevant support services) and veterinary and animal health and welfare services.
  • Scientific services (including research organisations) of the following kind or provided by the following entities or facilities:
    • ESR, GNS, GeoNet, NIWA, MetService
    • services involved in COVID-19 response, including laboratories and Physical Containment level 3 (PC3) facilities
    • services involved in hazard monitoring and resilience
    • services involved in diagnostics for critical businesses or services like biosecurity, food safety, or public health
    • other significant research facilities, including animal facilities, clinical trials, and infrastructure that requires constant attention (for example, samples, collections, and storage facilities), that are important to New Zealand.
  • Entities required to provide distance or online learning for primary and secondary education.
  • Key utilities, which means utilities that provide for the production, supply, sale, distribution, or disposal of 1 or more of the following:
    • electricity
    • gas
    • water
    • wastewater (for example, sanitation)
    • waste (for example, rubbish collection and recycling)
    • liquid or solid fuel
    • telecommunications services (as defined in section 5 of the Telecommunications Act 2001).
  • Key communications, which—
    • means news (including news production) and broadcast media; and
    • includes delivery of newspapers for non-English-language material audiences or communities that have limited access to digital connectivity and are hard to reach due to physical location.
  • Government services, including services provided by State services and local authorities, but only if—
    • the service is a regulatory, defence, or social service, or relates to the COVID-19 response or infrastructure; and
    • provision of the service cannot reasonably be delayed (for example, because a delay would breach an obligation under an enactment, risk harm to people or communities, or risk damage to the environment).
  • Foreign Government (maintaining critical operations of foreign missions based in New Zealand).
  • Security services (including locksmiths).
  • Pest management services.
  • Essential elements of pulp and paper plants.
  • The essential operations of the following businesses and services:
    • the Golden Bay Cement manufacturing plant in Portland, Whangarei
    • New Zealand Steel.
  • Services for deceased persons or tūpāpaku including, for example, funeral homes, crematoria, or cemeteries.
  • Unions, if reasonably necessary to provide a service that cannot reasonably be delayed (for example, because a delay would risk the health and safety of workers).           
  • Businesses or services necessary, during the period that the business or service is operating in an Alert Level 4 area, to maintain any of the following:
    • other Alert Level 4 businesses or services
    • exempt businesses or services.

Want more information?

You can find further information about the QR codes and all download processes from the Ministry of Health including contact details if any assistance is required.

NZ COVID tracer(external link) — Ministry of Health

Rating form

We appreciate your feedback

Rate this

"Rate this" is required