In association with

COVID-19: Record keeping to support contact tracing

Contact tracing remains a key tool to stop the spread of COVID-19. When businesses keep records of who was at their workplace or location, it makes contact tracing more efficient.

This page includes:

Many businesses are required to assist with contact tracing by ensuring people can easily keep a record of when they visit. This is a requirement at all levels (Red, Orange and Green) of the COVID-19 Protection Framework.

Information about how contact tracing works can be found on the Unite against COVID-19 website.

How contact tracing works(external link) —

Guidance on what to do if your workplace has a case of COVID-19 can be found on the Ministry of Health website.

Guidance for workplaces that have a case of COVID-19(external link) — Ministry of Health

QR code posters and other options for record keeping

NZ COVID Tracer QR codes should be displayed in multiple places around a business premises, including at the main entrance of the premises. All posters should be in good condition so they can be easily scanned.

See guidance about displaying QR code posters.

Get your QR code poster(external link) —

Provide multiple options to record visits

You legally must have more than one way for people to record their visit, especially for people who are not able to scan QR codes.

If a person does not scan a QR code, there must be another way for that person to provide you with a ‘contact record’. A contact record is a person’s name, the date and time they visited, and their phone number.

Other options for collecting contact records include:

  • using an electronic system (for example, tablet sign-in apps)
  • a simple pen and paper register using individual slips and a ballot box for storage
  • having an employee take attendance records on behalf of people visiting your premises.

If you already have systems for other purposes (for example, building access swipe cards, or an appointment booking system) you can use these. You just need to make sure you are collecting the required information: name, date, time and phone number.

Alternative recording systems must protect people’s privacy. For this reason, we do not recommend the use of sign-in sheets that are viewable by the public.

Systems and processes to make sure people scan in or record their visit

Deciding what systems and processes work best in your business will depend on how it operates, for instance: its size, layout, and what people generally do when entering the premises.

These actions could include:

  • ensuring you have prominent signage and messaging about checking in
  • setting a condition of entry that customers and other visitors must check in
  • ensuring you have multiple QR codes displayed throughout your premises
  • having someone stationed at the door to greet customers and encourage them to check in
  • having your staff remind or enquire about whether visitors have checked in during ‘ordinary’ interactions (for example, at the point of ordering or payment)
  • checking that existing systems (for example, access cards or appointment booking systems) collect the necessary contact information, and are being used widely.

Write down the systems and processes you have put in place and ensure all your workers are aware of them.

The rules on record-keeping to support contact tracing

Certain businesses and event organisers must ensure workers and visitors record that they have entered their premises, or attended a gathering or event (as far as is reasonably practical).

You must have ways to record a visit if you are:

  • a cafe, restaurant, bar or nightclub
  • a health service
  • a close-contact personal care service — for example, a hairdresser or beautician
  • an indoor exercise facility — for example, a gym
  • an entertainment venue — for example, a cinema, stadium, theatre or casino
  • an indoor public facility where people gather — museums or libraries
  • a court or tribunal
  • a social services provider with customer service counters — such as a Ministry of Social Development office
  • organising a wedding, funeral, tangihanga or faith-based service
  • organising a concert
  • having a gathering or hui at a marae.

Businesses operating from vehicles

Businesses operating out of vehicles are encouraged to display QR codes and keep contact tracing records where a service is being provided (for example, a food truck or mobile clinic). This might be on the outside of the vehicle.

Mobile workers and delivery vehicles

If your workplace is a customer’s premise or a vehicle, you do not need to display a QR code or keep contact tracing records. This means that tradies (for example, plumbers), couriers and delivery drivers will not need to display a QR code when making deliveries to customers or working in someone’s home.

Public transport and small passenger services

All public transport services and small passenger services, like taxis, are required to display QR codes. Airlines and inter-city buses are excluded from this requirement because they have ticketing with contact information readily available.

See more information about the NZ COVID Tracer app:

NZ COVID Tracer app(external link) —

Keeping your workers safe when they ask people to sign in or record their visit

As well as meeting the COVID-19 Protection Framework requirements, businesses must continue to comply with all other laws including the Health and Safety at Work Act 2015 (HSWA).

Consider the systems and processes you have in place to keep workers safe and ensure your workers have adequate support, instruction, and information to perform their duties.

Providing information, training, instruction or supervision for workers(external link) — WorkSafe

You must involve your workers and their representative (including unions) in creating these systems and processes.

Worker engagement and participation(external link) — Worksafe

Plan for what to do if a person becomes angry at the worker who is requesting they scan in or provide their details for contact tracing purposes.

Some practical steps could include:

  • Provide staff with wording for if things escalate, so they are best able to de-escalate a situation.
  • Put signs up indicating that abuse of your staff will not be tolerated.
  • Consider what kind of behaviour might mean you call the Police and what information would be useful to share with Police. This could include an incident report outlining witness details and accounts of what took place. 
  • Be clear about when to walk away from the situation. Workers have the right to cease or refuse work where they believe that the work would expose them or another person to a serious health and safety risk.
    Request assistance to resolve issues relating to the cessation of work(external link) — WorkSafe
  • Develop or use existing internal mechanisms for regularly checking in with workers, collecting feedback, reporting incidents, and keeping a record of what has happened. 

Collect only what’s necessary and ensure private information is protected

Businesses should only collect the following information: the name of the person, the date and time they visited, and a phone number that can be used to contact them.

The purpose of the collection is to enable the Ministry of Health to contact a person in the event of a suspected or confirmed case of COVID-19. When collecting the required information, advise people that it is being collected to support contact tracing.

It is your responsibility to store any private information securely.

  • The information you collect can only be used for COVID-19 contact tracing. For example, you should not add emails to your contact database without consent, as this would be a breach the Privacy Act.
  • Information you collect for contact tracing purposes must be kept for 60 days, and disposed of after this time.
  • If you are using a sign-in sheet, you need to find a way to protect people’s privacy (for example, a new sheet for each person, or a ballot box arrangement). You should not leave a sign in sheet where it can be viewed by the public.

The Office of the Privacy Commissioner has guidance on the handling of personal information.

More privacy guidance on contact tracing registers(external link)(external link) — Office of the Privacy Commissioner

Privacy statements

We recommend you display a privacy statement alongside your register system. Here’s an example: 

This information is being collected to assist in the management of the COVID-19 pandemic. It will be given to the Ministry of Health and/ or the District Health Board on request in the event that it is required for contact tracing purposes. We will not use it for any other purpose, and will destroy it after 60 days.

It will be kept here at [name of the establishment]. You have a right to access and correct any information we hold about you

Want more information?

More information about contact tracing and the COVID Protection Framework can be found on the Unite against COVID-19 website.

Record keeping and contact tracing(external link) —

Rating form

We appreciate your feedback

Rate this

"Rate this" is required