Jacobs Media Group is honoured to be the recipient of the 2020 Queen's Award for Enterprise.

Should companies protect the identity of those who have tested positive for Covid-19?

21 January 2021
Should companies protect the identity of those who have tested positive for Covid-19?

Concerns over data protection laws should not hamper safety protocols, but there are some rules to follow, says Jessica Foster.

The problem

Should we be concerned about protecting an employee's privacy if they notify us of a positive Covid-19 result?

The law

Employers have a vital role in encouraging workers to heed notifications to self-isolate and must support them in isolation. Businesses should consider how they will keep staff informed of any positive results, but they are not required to name individuals.

Expert advice

If an employee is displaying symptoms, they should be separated from other colleagues and customers and asked to take a test.

The individual will be asked by NHS Test and Trace to provide details of anyone they have been in recent close contact with. This may not cover all colleagues, but will include those with whom they have had skin-to-skin contact, been within one metre of for one minute, been within two metres of for more than 15 minutes or with whom they have travelled in a small or large vehicle or plane.

Employers should ensure that employees know to inform them as soon as they start to develop symptoms. You should discuss who they have been in close contact with during the 48 hours prior to the onset of symptoms, alert those individuals and take necessary precautions.

You should discuss how you will notify their colleagues and whether they wish to be named. There is no legal requirement for close contact colleagues to self-isolate at this stage if they are not displaying symptoms, but you should risk-assess their roles until you receive the individual's test results.

If a positive result is received, NHS Test and Trace will instruct those close contacts to self-isolate. It will not disclose the person's identity.

When it comes to data protection laws and communicating with your workforce, the Information Commissioner's Office has acknowledged the need for businesses to act quickly and adapt in light of the pandemic and says that data protection will not stop this. However, proportionality is key.

You should have in place a process for notifying colleagues of a positive test result so that appropriate measures can be taken. It is important to consider how much information you need to provide. The person's name is not usually necessary information.

If they are not happy to be named, this should not prohibit you from notifying colleagues of a positive result, undertaking necessary risk assessments and deep cleaning, and reminding staff of your policies and where to find them.

My co-panellist at The Caterer's People Summit, Steve Rockey, people director at Lime Wood and Home Grown Hotels, raised the point that privacy can be trickier if people are living in staff accommodation and sharing rooms. These people are likely to be the same household and notified by NHS Test and Trace if they are required to self-isolate. The person's identity will be more obvious in these circumstances – the best thing is to discuss as a household the steps needed to minimise risk.

Privacy can be trickier if people are living in staff accommodation and sharing rooms

To-do checklist

  • Have a clear policy that explains the rules, what's required and procedures to follow in the event of symptoms or a positive result. This should be easily accessible, clearly communicated and kept up to date.
  • Undertake a Covid risk assessment, communicate this to staff, make sure it's easily accessible and keep it up to date.
  • If an employee displays symptoms or has a positive result, undertake a deep clean and consider any other necessary measures.
  • Have a process in place to notify staff of a positive result. Ensure you have up-to-date contact details, including for absent workers and agency staff.
  • Encourage employees to do the right thing and acknowledge it when they do.


It is a legal requirement for employers to not knowingly allow an employee who has been told to self-isolate to come into work or work anywhere other than their own home for the duration of their self-isolation period. Failure to do so could result in a fine between £1,000 and £10,000.


Jessica Foster is legal director at law firm TLT


Photo: Shutterstock

Continue reading

You need to be a premium member to view this. Subscribe from just 99p per week.

Already subscribed?

The Caterer Breakfast Briefing Email

Start the working day with The Caterer’s free breakfast briefing email

Sign Up and manage your preferences below

Check mark icon
Thank you

You have successfully signed up for the Caterer Breakfast Briefing Email and will hear from us soon!

Jacobs Media Group is honoured to be the recipient of the 2020 Queen's Award for Enterprise.

The highest official awards for UK businesses since being established by royal warrant in 1965. Read more.


Ad Blocker detected

We have noticed you are using an adblocker and – although we support freedom of choice – we would like to ask you to enable ads on our site. They are an important revenue source which supports free access of our website's content, especially during the COVID-19 crisis.

trade tracker pixel tracking