The University of Westminster supports the NHS Test and Trace scheme to help contain the spread of the COVID-19 virus in England. We do so by keeping a temporary record of all visitors to our sites and buildings which may be shared with NHS Test and Trace (which is a part of the Department for Health and Social Care).

For more information on how the University’s track and trace processes uses personal data, please see below.


The University of Westminster takes its data protection obligations very seriously. Access to any personal information you give us when visiting our buildings or attending events we organise, as part of our track and trace processes, is subject to a staff confidentiality agreement. Access to your personal information is limited by permissions to only those staff and administrators who need access to manage our support of the NHS Test and Trace scheme.

Your personal data

To support NHS Test and Trace in England, we have been mandated by law to collect, use and keep a limited record of staff, students and visitors who come onto our premises to support the purpose of contact tracing.

By maintaining records of staff, students and visitors, and potentially sharing these with NHS Test and Trace where requested, we can help to identify people who may have been exposed to the coronavirus.

As a member of staff, student or visitor to the University of Westminster, some of the information we currently hold on you or that you will need to provide when gaining access to our premises or disclose to take part in an event, will be collected and processed as part of our support for NHS Test and Trace in England:

  • The names of all staff who work at the premises, their contact phone number and the dates and times that they are at work there and in some cases the specific rooms or facilities visited
  • The names of all students who visit our premises, a contact phone number for each student, date of visit, arrival time, departure time and in some cases the specific rooms or facilities visited
  • For any other visitor and all event attendees, names, contact number, date of visit or event attended, arrival time, departure time or time period of event, and if visiting a specific member of staff, the name of the member of staff who is being visited or the specific room or facility being visited

Use of personal data and legal basis of processing

Your information will be used in our internal processes to help identify and contact individuals who are at risk of being exposed to the COVID-19 virus and this information and the actions we take may also be shared with NHS Test and Trace in England.

We may also create aggregated reports for management purposes, where no individual will be recognisable, to help us monitor and improve what we do.

The main legal basis for the University to process your personal data in this way is the substantial public interest in the legal area of public health. Processing of this kind is in line with the Public Health (Control of Disease Act) 1984 and the Coronavirus Act 2020 and is needed to protect the welfare and wellbeing of our students, staff and all those who need to visit our premises and facilities.

Data retention

Where your personal data has been temporarily collected and held specifically for track and trace purposes, the University will only hold this data for 21 days, after which it will be securely deleted.

Information captured and held for other business purposes used in our track and trace process will be retained and disposed of line with University retention policies. For more information see our Records management web pages.

Data transfers and sharing

The University will share your information with NHS Test and Trace only where it is necessary, either because you have tested positive, you have contacted us to inform us you have COVID-19 symptoms or you have been in close contact with someone who is believed to have the virus.

Our Safety, Health and Wellbeing team will work with the NHS Test and Trace Teams to notify potential contacts. It is likely that we will officially call or text message you to notify you that you have been in close contact with someone who has tested positive for COVID-19. If you are contacted, you should assume that your information may be shared with NHS Test and Trace.

See the NHS Test and Trace privacy notice for how your information will be securely managed and used by them.

Where any data captured and held involves applications and services supplied by a third-party, these services will be covered by contracts and safeguards to protect your data. You are encouraged to read any privacy or terms of use relating to a third-party service or application prior to use.

Your rights

If you have any questions relating to the use of your personal information in the University’s support for the NHS Test and Trace scheme in England, please contact the University’s Safety, Health and Wellbeing Team at [email protected].

If you have any questions or concerns about your personal information and your information rights, please see the University’s data protection web pages or contact the Information Compliance Team at [email protected].

You can also contact the Information Commissioners’ Office with any concerns or complaints you may have with the processing of your personal data.


This statement was last reviewed and updated in September 2020.