As museums and heritage sites begin to reopen, new guidance has been released on how organisations in the tourism and leisure sectors in England can assist the NHS Test and Trace programme. 
Test and Trace is part of the government’s ongoing Covid-19 response and is intended to allow the NHS to rapidly detect people who have recently come into contact with a new Covid-19 case.
Museums and galleries are among the organisations that have been asked to comply with the scheme as lockdown measures are eased. The guidance asks them to maintain records of staff, customers and visitors and share these with NHS Test and Trace where requested. 
Information that should be collected includes: 
Staff
  • the names of staff who work at the premises
  • a contact phone number for each member of staff
  • the dates and times that staff are at work
Customers and visitors

  • the name of the customer or visitor. If there is more than one person, then you can record the name of the ‘lead member’ of the group and the number of people in the group
  • a contact phone number for each customer or visitor, or for the lead member of a group of people
  • date of visit, arrival time and, where possible, departure time
  • if a customer will interact with only one member of staff, the name of the assigned staff member should be recorded alongside the name of the customer. 
The guidance states: “You should collect this information in a way that is manageable for your establishment. If not collected in advance, this information should be collected at the point that visitors enter the premises, or at the point of service if impractical to do so at the entrance. It should be recorded digitally if possible, but a paper record is acceptable too.”
The guidance says people can opt out of sharing their details, but that organisations should encourage customers and visitors to participate and “advise them that this information will only be used where necessary to help stop the spread of Covid-19”. The organisation is not responsible for verifying an individual’s identity or the accuracy of the information they provide, it says.
Organisations should hold records for 21 days, before deleting or disposing of them securely. The guidance says records kept for other business purposes do not need to be disposed of after this time period, but that all collected data must comply with GDPR and should not be kept for longer than necessary.