At last we are going to be able to visit the hairdresser, the restaurant and the pub!  It’s been a long 3 months and for some of us, the hairdressers can’t come a minute too soon.  As the economy slowly eases back into life, there are a few data protection issues that organisations will need to address.  Keep an eye on Government or ICO advice, but here are our Take-Aways about the extra collection of personal data that some organisations will need to adhere to during the next phase of Covid.

Organisations such as pubs, restaurants and hairdressers will be required to collect a temporary list of personal data on customers and visitors for 21 days.  This is to assist with the Government’s Track and Trace ‘if needed’ and to help contain any further outbreaks.

Data Minimisation

Only collect what you need.  Don’t use this as an opportunity to take more personal data.  In fact, the government guidelines suggest you do this ‘in a way which is manageable’.  No need for new expensive technology, let’s hope this is a temporary situation.

Purpose Limitation

You’re being asked to collect the extra personal data by the Government.  It doesn’t mean that you can use the personal data for something else automatically.  Think carefully about your lawful basis, add it to your Data Map or Record of Processing Activity.  Don’t be tempted to use this personal data for other purposes unless you have a lawful basis to do so.

Keep it Safe and Destroy it Carefully

During the 21 days you have to keep the personal data, keep it securely.  This might mean password protecting a spreadsheet or other ways of keeping data safe.  When the 21 days is up, make sure you securely destroy the personal data.

Amend your Privacy Notice

There’s never been a better time to review your Privacy Notice.  Do it now and insert a clause about what you are doing and why you are doing it.  Being transparent with your customers or visitors is a great way to build trust in your brand.  You could even post what you’ve done on your social feeds.  You’ve got nothing to hide, so keep your customer informed.


The above is a good start to your compliant collection of personal data during this extraordinary situation.  Don’t forget to train your staff too, you may have good intentions, but unless all of your staff know the process, you may end up falling at the first hurdle.

We’d love to help you with Data Protection and Business Legal issues.  Please do get in touch, or book a LawChat15 on us.  Use Code LawChat15 to book a free 15 minute phone/Zoom call to see how we can help you.