Updated guidance released on how businesses should collect customer details
At the time of the Prime Minister’s statement, there were a number of question marks over how this would be compatible with data protection law, which the ICO has sought to clarify in its most recent guidance.
Following on from our recent article “Relaxation of lockdown: new guidance requires restaurants, bars and other businesses to collect customer details” published last week, the Information Commissioner’s Office (“ICO”) has published supplemental guidance for those businesses that will be asked to collect customer details when opening from tomorrow onwards.
When the initial announcement was made by the Prime Minister that bars, restaurants, cafes and businesses such as hairdressers would be allowed to open from Saturday 4 July 2020, one of the many caveats was that these businesses should collect the contact details of any customers visiting the business’ premises. The need for such businesses to collect this data is on the basis that it will be necessary to support the NHS Test and Trace system.
At the time of the Prime Minister’s statement, there were a number of question marks over how this would be compatible with data protection law, which the ICO (as the independent regulator responsible for governing data privacy rights of individuals) has sought to clarify in its most recent guidance. The broad message for businesses is as follows:
Ask for only what is necessary
This is as set out in the Government’s guidance and includes details such as the individual’s name, contact details and date and time of arrival at the premises. It also includes the details of any staff that are working on a particular day. Whilst it had been thought that businesses may have been required to collect a person’s ID, this does not appear to be the case.
Be transparent with customers
This accords with one of the main principles of data protection requiring businesses to inform data subjects what their data will be used for and why it is necessary. A simple onsite notice, as suggested in our previous article, or website statement would satisfy this requirement so that a business’ employees do not have to inform every single customer personally. Any privacy notice must also set out that personal data may be disclosed to the NHS for the purposes of contact tracing.
Carefully store the data
As with other data collected or processed by these businesses, it should be stored in a way that is secure, digitally or otherwise.
Do not use the data for other purposes
The data that is collected for the purposes of contract tracing cannot be used for any other purpose. For example, businesses cannot add customer details to their direct marketing list.
Erase the data in line with government guidance
Businesses must not keep customer data for longer than 21 days after collection. Erasure should be conducted in a secure manner to prevent others from using the data.
It would appear from the above that the ICO has tried to keep things simple for businesses and to encourage a common sense approach. It has not sought to impose any “new” practices, but has instead re-stated existing data protection principles. For those businesses that are re-opening and will be collecting data for NHS Test and Trace purposes, it will be important to have in mind the data privacy rights of individuals during the collection process.
Further Government guidance provides that individuals will be able to refuse to share their data for the purposes of NHS Test and Trace if they wish. Where data is collected, businesses will only be required to share it with NHS Test and Trace when requested.
For full ICO guidance, see here.
If you have any questions or queries on how best to approach such guidance and re-open, please contact the Data Protection Team at Leathes Prior on 01603 610911 or by email.
Note: The content of this article is for general information only and does not constitute legal advice. Specific legal advice should be taken in any specific circumstance.
Leathes Prior advises Complete Strategy on sale to Flint Global
Alex Saunders, Partner in Leathes Prior's Corporate Team, advised Complete Strategy on the sale of its business to Flint Global. The acquisition marks Flint Global's first acquisition and represents the first step in its M&A growth strategy.
.jpg)
Maternity Services in England: Recent Reports and What They Mean for Families
In a follow up to our recent article on maternity safety, Polly Langford, Partner in our Personal Injury & Clinical Negligence Team has written on the findings of the Ockenden Report and what this means for families.
Competing uses of farmland - what the new Land Use Framework means for your business
The Government has published the Land Use Framework – which DEFRA says is “a plan for delivering new homes, nature restoration, clean energy and food security." Rebecca Allen, Senior Associate in our Agriculture Team explains what this means and what to consider for your business.
Leathes Prior advises Complete Strategy on sale to Flint Global
Alex Saunders, Partner in Leathes Prior's Corporate Team, advised Complete Strategy on the sale of its business to Flint Global. The acquisition marks Flint Global's first acquisition and represents the first step in its M&A growth strategy.
Maternity Services in England: Recent Reports and What They Mean for Families
In a follow up to our recent article on maternity safety, Polly Langford, Partner in our Personal Injury & Clinical Negligence Team has written on the findings of the Ockenden Report and what this means for families.
Competing uses of farmland - what the new Land Use Framework means for your business
The Government has published the Land Use Framework – which DEFRA says is “a plan for delivering new homes, nature restoration, clean energy and food security." Rebecca Allen, Senior Associate in our Agriculture Team explains what this means and what to consider for your business.
Changes to qualifying period: Time to rethink probation periods?
From 1 January 2027, the qualifying period is reducing from two years to six months. But the reality is that the new law will apply to all employees who have already accumulated at least six months of continuous employment by this date. This means that now is the right time for employers to be reviewing their employment contracts and rethinking strategies on probationary periods.
Proposals for reform of cohabitation rights on the death of a cohabitating partner
Georgia Sartin, a Solicitor in our Property and Contentious Probate Team explores the government’s recent open consultation ‘a fairer end to relationships’ published on 5 June 2026, , in respect of the proposals for reform for cohabitants in the intestacy framework and 1975 Act claims.
%20cropped.jpg)
Who is accountable for maternity safety? The case for a maternity commissioner following the birth trauma inquiry.
The safety of maternity services in England has been under intense scrutiny in recent years, now, a national campaign has been launched for the appointment of a dedicated Maternity Commissioner.
What is the difference between a share sale and an asset sale?
When running a business, company founders and shareholders will inevitably, at one stage or another, want to consider potential succession options, the most prominent being an exit by way of trade sale. Hugo Persad, Trainee Solicitor in our Corporate Team provides an overview of what the difference is between a share sale and an asset sale.
UK GDPR Update: What the Data (Use and Access) Act 2025 Means for Organisations
While several updates under the Data (Use and Access) Act 2025 came into force on 5 February 2026, the next key development for organisations is still to come. From 19 June 2026, organisations will be legally required to implement a formal complaint handling process for data protection matters. This is a significant shift, placing greater emphasis on resolving issues internally before they escalate to the regulator.
.jpg)
Selling a Probate Property: A Guide for Executors
Acting as an Executor can feel daunting, especially if there is a property which needs to be sold as part of the estate administration process. If you have been appointed as an Executor and you are unsure where to begin, here are some key things to consider.
%20website.jpg)
Leathes Prior's Personal Injury & Clinical Negligence Team Secure Settlement for Client
Kate Smith (Senior Associate) and Kimberley Nelson (Paralegal) were instructed in relation to a workplace personal injury claim, and successfully secured a five-figure settled for the client.
.jpg)
New Restrictions to Charitable Giving: What You Need to Know
Changes to UK tax law regarding charitable giving took effect from 6 April 2026. Following legislative amendments in the Finance Act 2025-26, the generous tax exemptions associated with charitable gifts - specifically Inheritance Tax (IHT) exemptions - will be restricted to gifts to UK-registered charities. Ejike Ndaiji, Partner in our Wills, Trusts, & Probate and Charities Team explains...
Employment Rights Act 2026: The New Trade Union Right Of Access - Will it matter?
The Government has now published its response to the “Make Work Pay: Trade Union Right of Access” consultation which means we are now one step closer to properly understanding what these new access rights really will be.
%20cropped.jpg)
-3.jpg)
