Contact tracing at your workplace

Help people keep track of where they’ve been.

How contact tracing helps

To stop any future spread of COVID-19, we need to trace the contacts of anyone who may have been exposed to COVID-19 and break the chain of transmission. Contact tracing helps us do that.

Meet your contact tracing requirements

All people on-site should sign in using either the QR code or an alternative contact tracing system. This includes employees, customers and other visitors. Make sure it’s done every day, including weekends and after hours.

People who sign in with the NZ COVID Tracer app don’t need to use an alternative system.

Display your QR code poster 

All workplaces and businesses legally must display an NZ COVID Tracer QR code for each location. This applies at Alert Level 1 and higher.

Get your QR code poster

Have alternative systems

At Alert Level 2, you legally must also have an alternative system for people who do not use the NZ COVID Tracer app. The Ministry of Health or a district health board may contact you if a person is diagnosed with COVID-19 and your business is a potential contact.

There is no requirement at Alert Level 1, but it's still a good idea to have one.

There are different systems and processes you can use to keep a record. You can use:

  • an electronic system, like a tablet sign-in app or an existing booking system
  • a simple pen and paper register using individual slips and a ballot box for storage
  • a process where an employee takes details on the visitor’s behalf.

We recommend that records include the person’s name, phone number, and the date and time they enter.

Whatever alternate system you use, it’s important that everyone’s personal details are collected, kept and used in a way that protects their privacy. Previous visitors’ records should not visible to other visitors. Unsecured personal information exposes people to unwelcome contact, fraud, or even identity theft. It’s also a breach of the Privacy Act.

These records should be kept for at least 30 days.

Collecting and holding private customer information

You should only collect information if it’s necessary for contact tracing. The purpose of the collection is to help the Ministry of Health to contact a person in the event of a suspected or confirmed case of COVID-19.

It’s unnecessary to collect other personal information like identity verification documents or number plates. You should only ask for name, phone number and the date and time of visit.

When collecting this information, tell people that it’s being collected to support contact tracing. It’s your responsibility to store any private information securely, and it can only be used for COVID-19 contact tracing. For example, you should not automatically add people’s emails to your contact database without their consent.

We recommend you display a privacy statement alongside your alternative system. For example:

This information is being collected to assist in the management of COVID-19. It will be given to the Ministry of Health and/or the District Health Board on request if it is required for contact tracing purposes. We will not use it for any other purpose, and will destroy it after 30 days.

It will be kept here at [name of the establishment].

You have a right to access and correct any information we hold about you.

More information about contact tracing

Information about how the Ministry of Health and district health boards trace contacts of identified cases:

How contact tracing works

Last modified: