Privacy Notice - Covid-19 Local Contact Tracing

This Privacy Notice explains how your personal information will be used and shared, when carrying out Local Contact Tracing as part of the NHS Test and Trace national programme. This aims to ensure that anyone who develops symptoms of Covid-19 can be tested quickly and helps trace the recent close contacts of anyone who tests positive to notify them that they must self-isolate or to offer support and advice to help stop the spread of the virus.  Information will be collected by staff in the Council’s Contact Centre or Public Health teams. Contact tracing is an important part of the Council’s Local Outbreak Management Plan. The Council will also use information provided by NHS Test and Trace or collected locally to provide advice on self-isolation, to identify potential locations of local outbreaks, and for other purposes where necessary to prevent danger to the health of the public as a result of the spread of infection or contamination with coronavirus or coronavirus disease. The Department of Health and Social Care (DHSC) has published an overview of how NHS Test and Trace works.  

Privacy information for NHS Test and Trace

Who we are

The London Borough of Croydon (Council), is supporting the National Health Service (NHS) Test and Trace service by operating a local contact tracing service. The NHS Test and Trace service is commissioned by the Department of Health and Social Care (DHSC). The Council and DHSC are joint Data Controllers for the processing of your data. The Council is registered as a ‘Data Controller’ with the Information Commissioner’s Office (Reg. No. Z5439989).  This data will be used to identify people who have tested positive or may have been exposed to Covid-19  that have not been contacted by the national Test and Trace service to provide advice about isolation and collect information about close contacts who will be also be advised to self-isolate.

Information held about you

If you test positive for coronavirus you will be contacted by the NHS Test and Trace service and asked to confirm or provide your personal information as outlined below.  This data from NHS Test and Trace is shared with the Council Public Health division for local contact tracing. In order to carryout Local Contact Tracing, it is necessary for the Council to verify, collect, hold and share your personal information.

Your personal information may include but is not limited to:

  • Name
  • Date of Birth;
  • Sex
  • NHS number
  • Address;
  • Telephone Number/s;
  • Email address; and/or
  • Details of those who you may have been in contact with.

The following Special Category Data will also be processed:

  • Ethnicity;
  • Details of COVID-19 symptoms - including when they started; and/or
  • Details if you and/or others are clinically vulnerable or extremely vulnerable and require support.

How we use the information we hold about you

a)    to understand Covid-19 and risks to public health, trends in Covid-19 and such risks, and controlling and preventing the spread of Covid-19 and such risks;

b)    identifying those residents with or at risk of Covid-19, information about incidents of resident exposure to Covid-19 and the management of residents with or at risk of Covid-19 including: locating, contacting, screening, flagging and monitoring such residents and collecting information about and providing services in relation to testing, diagnosis, self-isolation, fitness to work, treatment, medical and social interventions and recovery from Covid-19;

c)    understanding how residents access to health services and adult social care services and the need for wider care of residents and vulnerable groups as a direct or indirect result of Covid-19 and the availability and capacity of those services or that care;

d)    monitoring and managing the response to Covid-19 by health and social care bodies and the Government including providing information to the public about Covid-19 and its effectiveness and information about capacity, medicines, equipment, supplies, services and the workforce within the health services and adult social care services;

e)    delivering services to residents, clinicians, the health services and adult social care services workforce and the public about and in connection with Covid-19, including the provision of information, fit notes and the provision of health care and adult social care services; and/or 

f)    research and planning in relation to Covid-19.

The Council will use this data to carryout Local Contact Tracing to provide advice about isolation and collect information about close contacts that will be also be advised to self-isolate.  In some cases the Council may match your data with information from other locally held datasets, such as Council Tax and social care records, in order to improve the quality of contact tracing data and effectiveness of contact tracing processes and to help us identify those that might need additional support. The Council will treat your information as confidential. The Council will not normally share it with any other organisation without your consent unless we are required by law to share it, or unless you or any other person will come to some harm if we do not share it. Any information we share will only be shared on a need-to-know basis with appropriate individuals.  The Council will not use or share your data with third parties for marketing purposes.

Who we share your information with

The Council will conduct accuracy checks on contact details (address, telephone number and postcode) provided by the NHS Test and Trace Service using local data held by the Council (such as council tax, social care or housing data) to support our local contact tracing team complete any outstanding contact tracing data required to improve levels of contact tracing. This data will be updated on the national NHS Test and Trace system. We will not share data with other organisations or individuals outside of the Council for any other purpose other than that stated above.

The legal basis for us to process your personal data

We must have a legal basis to process your personal data. Our lawful basis for processing personal information for the purposes described above are the sections of the law outlined below:

  • Article 6(1)(e) in the General Data Protection Regulation (GDPR): processing is “necessary for the performance of a task carried out in the public interest or in the exercise of official authority” 
  • Modified by (Special Category Data) Article 9(2)(i) of GDPR: processing is “necessary for reasons of public interest in the area of public health”, 
  • Supplemented by Schedule1 Part 1 (3) of the Data Protection Act 2018, to support the processing of data for the following Covid-19 Purposes specified in the Regulation 3(4) Notice.

Separately, we have special permission from the Secretary of State for Health and Social Care to use confidential patient information without people’s consent for the purposes of diagnosing, recognising trends, controlling and preventing, and monitoring and managing communicable diseases and other risks to public health.  This is known as a ‘section 251’ approval and includes using your test results if you test positive for COVID-19 to start the contact-tracing process.  The part of the law that applies here is section 251 of the National Health Service Act 2006 and Regulation 3 of the associated Health Service (Control of Patient Information) Regulations 2002. You can find more information on this on the NHS Contact Tracing Privacy Notice. Your information will not be used and shared without your Consent unless there is an overriding reason (such as a safeguarding concern) which requires the sharing of your information to take place without Consent. Whenever possible you will be informed that this has taken place.

How long we keep your personal information

There is often a legal reason for keeping your personal information for a set period of time. We will only keep your information for the minimum period necessary. 

The Council will follow NHS Test and Trace guidance on the retention of this data.  The NHS Test and Trace privacy notice currently states that it will keep data related to individuals who test positive for COVID-19 for up to eight years and data related to close contacts for up to five years.

Your right to see your records

Under GDPR and the Data Protection Act 2018, you have the right to request access to information that we hold about you. To make a request for your personal information, please contact the Council’s Information Management Team at

Further information

If you have any questions or concerns about the way the Council has processed your data please contact the Council’s Data Protection Officer, at in the first instance. Additional information about what personal information we collect about you, how and why we use it, who we disclose it to, and how we protect it can also be found on the Council’s Corporate Privacy Notice

For advice about data protection issues, you can contact the Information Commissioner’s Office at We reserve the right to amend this Privacy Notice at any time and will keep it under review. If we do make any changes, we will post the current version to our website at this address.

Last updated: 22 April 2021