Skip to main content
Become a member
  • Register
  • Login

Register Login


Directors & Governance

Covid-19 Mass Testing Q&A

17 Mar 2021

Confidentiality and data protection

Q.1 Who owns the data on the test results?

Workplace testing is set up to find out whether asymptomatic staff required to leave home to work are positive for Covid-19 and are thus infectious. The workplace testing arrangement is set up so that the participant registers their details with NHS Test and Trace, the test is administered on site with a bar code and is not linked at the site with the participant details. The participant does not see the result on the LFT device, which takes some time to process. The result is notified to NHS Test and Trace anonymously as part of a batch of tests. NHS Test and Trace then notify the participant of the result. Where the result is positive, NHS Test and Trace also notify Public Health England, contact tracing service and the participant’s GP.

To protect confidentiality, and so long as there are sufficient numbers in each batch, the testing site is unable to link any result to individuals. So the only data that the employer can log is whether a member of staff has taken the test.

All data processing and collation will be carried out by DHSC or any organisation working under DHSC. The participant will be required to sign a Testing Agreement before being enrolled in the testing. An employer is required to inform their subjects of how their data will be used by the DHSC. If participants raise any data privacy concerns, employers should direct them to the Data Privacy Notice:

Coronavirus Covid-19 Testing Privacy Information

How data collected as part of workplace testing is handled will be subject to the arrangements of the employer or testing provider. The arrangements should be appropriate and lawful for sensitive personal information under the General Data Protection Regulation (‘GDPR’). Further details can be found on the Information Commissioner’s Office website here.

Q.2 How should I agree plans for workplace testing with my staff?

If an employer plans to test employees or workers for coronavirus, it should be agreed with staff, the workplace's recognised trade union, or other employee representatives.

Acas advise that it is good practice to discuss:

  • how testing would work
  • how staff would get their test results
  • the process to follow if someone tests positive for coronavirus
  • pay for staff if they need to self-isolate but cannot work from home
  • how someone's absence would be counted if they need to take time off work, for example if it will count towards HR 'trigger' points
  • how the employer plans to use, store and delete testing data, in line with data protection law (UK GDPR).

Any decision after that discussion should:

  • be put in writing, for example in a workplace policy
  • be clear as to how it fits with the organisation's existing disciplinary and grievance policy

Acas provides helpful guidance for employees on how to agree plans for workplace testing here.

Q.3 What can and can’t we store on employee data about their test results? How do we do it correctly? What should we avoid doing?

An employer does not need to hold or store employee health data for testing, as all data processing will be carried out by the Department for Health and Social Care or an organisation working for them under a Data Processing Agreement. A member of staff must agree to this before being enrolled in the testing.

A worker who has received a notification of a positive test result from an appropriate body (e.g. NHS T&T) must inform their employer if they are required to work other than in their place of self-isolation (normally home). A worker who works at home and does not have to leave home to attend the workplace must isolate at home and is not required to inform their employer of a positive test result.

If an individual voluntarily discloses a test result to their employer, the employer should keep it secure and consider any duty of confidentiality they owe to those individuals who have provided test results, in the same way as if a worker reports any other health-related matter to their employer. The employer’s focus should be on ensuring their use of data is necessary and relevant and that they do not collect or share irrelevant or excessive data with authorities if this is not required.

Voluntary nature of testing

Q.4 Do I have the right to ask employees about their test results? What are my options if an employee refuses to share their test results with the employer?

There is a specific statutory obligation on workers to inform their employers if and they are required to work other than in their place of self-isolation (normally home) and they have received a notification from a relevant authority (e.g. NHS T&T) that they need to self-isolate either because they have tested positive, or because they have been identified as a close contact of someone who has tested positive . This obligation should ensure that the employer receives the information they need.

Other than that, there is no specific legal obligation on a worker to share their test results. An employer can ask workers to do so, but will need to ensure that such a request (and any action taken in response to a test result) is compliant with the employer’s legal obligations to the worker (including for example, obligations arising from employment law, discrimination law or data protection law).

Q.5 Can I require testing of my workers? Can I say someone can only access a particular building / site if they can show evidence of a negative Covid test?

Government policy generally remains that participation in the asymptomatic workplace testing scheme should be voluntary and based on communication of the benefits of testing for workers, their co-workers, family, and society.

In some cases, if a business requires workers to attend a physical workplace (I.e. if they cannot work from home) and this involves a level of risk to the worker or others it may be possible to require testing, if that would help the business to reduce that risk.

However, an employer’s options for enforcing such a requirement will rest on the specific circumstances at hand. It is for employers to determine whether to impose a testing requirement, but they will need to consider carefully the need for imposing the requirement, any relevant circumstances applying to individual workers, what use will be made of the test results, and what the appropriate response to a refusal is. For example, whether or not an employee could be dismissed fairly for refusing to participate is likely to depend on a range of factors that would need to be taken into account including, for example, the specific contractual arrangements and workplace policies in place, the nature of the workplace, the type of job done, whether it involves close contact with others, what the broader infection context is (for example, the background infection rate, levels of vaccination), the circumstances of the individual and their reasons for refusing, and so on.

Similarly, it may be possible to limit access by others (for example, customers or visitors) to a particular site or building based on evidence of a negative Covid test, but businesses will need to take care that doing so is lawful (including compliant with GDPR requirements) and does not result in prohibited discrimination.

Isolation and payment

Q.6 If my member of staff tests positive with a Lateral Flow Device test (LFD), do they have to isolate? Do I have to pay them? Do they have to take a confirmatory Polymerase Chain Reaction (PCR) test?

Anyone who tests positive for Covid – whether by an LFD at a workplace testing site or a PCR test – must self-isolate.

The requirement for a confirmatory PCR test following a positive LFD test was temporarily suspended on 27 January due to high rates of Covid infection.

Statutory Sick Pay (SSP) must be paid to eligible employees and there is a Rebate scheme in place for 2 weeks of Covid-related SSP for employers with fewer than 250 employees.

Beyond that, payment when isolating is a matter for the contractual arrangements between the employer and its staff. BEIS encourages employers to go further and pay occupational sick pay where this is in place.

Workers may also be eligible for a £500 Test and Trace Support Payment if they live in England and meet all the criteria. The worker is required to make the application to their local council. Those living in Scotland may be eligible for a £500 self-isolation support grant. Those living in Wales may be eligible for a £500 payment through the Self Isolation Support Scheme. Employees living in Northern Ireland may be eligible for a Discretionary Support Self Isolation Grant. The amount awarded will depend on each person’s individual circumstances.

Free test kits

Q.7 I am an employer with fewer than 50 employees, can I access the national free test kit offer?

All businesses in England are now able to sign up to the government’s free Covid-19 workplace testing programme.

As part of the government’s roadmap to cautiously lift restrictions, businesses of all sizes, including those with fewer than 50 employees, can register to order free lateral flow tests for their employees.

All local authorities have signed up to offer rapid lateral flow testing in the community through local asymptomatic test sites. Small businesses may prefer to direct workers to these test sites instead of offering rapid workplace testing.

Community Testing

Q.8 Where does responsibility for community testing sit within local authorities?

In most cases Community Testing sits within local authority public health teams, but there may be some exceptions.

Q.9 What are the timescales for The Community Collect service, as outlined in the roadmap?

From the 1 March Community Collect has been available at NHS local and regional test sites

From mid-March local authorities, if they opt-in to the collect model, will start to roll out Community Collect as part of their Community Testing offer. Citizens can check which test sites are offering a collection option on COVID Test Finder (

Test accuracy

Q.10 Lateral Flow tests are less accurate than PCR tests. Won’t this lead to lots of false positive tests?

With up to a third of individuals with COVID-19 not displaying symptoms, broadening testing to identify those showing no symptoms will mean finding positive cases more quickly and breaking chains of transmission.

Extensive clinical evaluation has been carried out on the Rapid Lateral Flow Tests. Evaluations from Public Health England and the University of Oxford show these tests are accurate and sensitive enough to be used in the community for screening and surveillance purposes.

Rapid lateral flow testing is useful for finding out if a person is infectious now, and able to transmit the virus to others. The level of sensitivity is high enough to detect the vast majority of these cases. Rapid lateral flow testing is less likely to return a positive result outside the infectious window. While false positives can never be completely ruled out with any test, the chances of receiving a false positive remain low (about 4 in 1000 people tested).

Lateral flow tests identify individuals in the early stage of infectiousness and with the highest infectivity. These individuals tend to spread the virus to many people and so identifying them by lateral flow tests is important.

Clinicians have been clear that we will need to continue testing for the foreseeable future: we do not yet know the impact of the vaccine on transmission, many people will be unable to get vaccinated, and testing is also vital for spotting Variants of Concern early.

Rapid Lateral Flow Tests will play a crucial role in helping us to find more cases – including in workplaces - and stop those cases becoming clusters , and those clusters becoming outbreaks.

Our evaluation work and the ongoing pilots are helping us to understand how lateral flow tests work in the field, how to improve their use and how we may use them to help stop the spread of the virus.

If used in the right way Lateral Flow Tests are effective at identifying if a person is infectious now and able to transmit the virus to others. This allows us to identify and isolate more people who are at high likelihood of spreading the virus and reduce the risk of transmission.

However, we recognise that there are some challenges and that factors such as user error can decrease accuracy. That is why LFD testing is an adjunct to increase safety, on top of the safer working guidelines and not a replacement for these.

Q. 11 Do you accept that LFD tests can give false negatives?

No test will detect every single case but these lateral flow devices are proving to be accurate and reliable and we are confident that they can be used to rapidly identify many people who are silently carrying the virus.

These tests alone aren’t a silver bullet for stopping the spread of the virus. But we are confident that they can detect large numbers of individuals that we could not otherwise detect. If used in combination with other vital infection prevention control measures such as wearing appropriate PPE, washing hands regularly and social distancing, it will enable people to live their lives in as normal a way as possible.


Q.12 Should employees who have been vaccinated still take part in workplace testing?

Testing should continue even for those who have been vaccinated. Clinical trial evidence demonstrates that the vaccine reduces clinically severe infection and severe disease. But the impact of the vaccine on preventing transmission remains unclear and individuals who have been vaccinated may still carry and be able to transmit the virus. We advise anyone who has been vaccinated to continue to observe national lockdown restrictions, comply with guidance on working safely and engage with asymptomatic LFD testing (and PCR testing if appropriate).

Q.13 Can an employer mandate that their employees must be vaccinated? What position should I take on vaccines?

Scientists are united that the Covid-19 vaccine offers the best form of protection against the virus. However, vaccination is not compulsory in the UK. The government would welcome businesses encouraging their employees to take up the vaccine and supporting them in doing so.

There is no specific statutory provision which employers can rely on to require their staff to be vaccinated. While requiring a vaccination may nevertheless be legally possible in some circumstances, refusing services or employment to anyone who is not vaccinated does raise discrimination and other legal issues.

The question of Covid certification raises a variety of complex issues, which is why the Government is carrying out a review into whether COVID-status certification - using vaccine and/or testing data - could play a role in reopening our economy, reducing social contact restrictions and improving safety. This will be led by the Chancellor of the Duchy of Lancaster, with full involvement from BEIS and other Government Departments. It will consider the ethical, equalities, privacy, legal and operational issues and what limits, if any, should be placed on organisations using certification. It will draw on external advice to develop recommendations that take into account any social and economic impacts, and implications for disproportionately impacted groups and individuals’ privacy and security.

The Government has said it will look more closely at the questions around vaccination and testing in its review of the certification of Covid status, which is due to conclude before we get to step 4 of the roadmap.

An error has occurred. Error: Related articles is currently unavailable.

Contact our press office

Press office

IoD Professional Development Brochure

Knowledge, skills and mindset for a challenging world

IoD courses are designed to tackle the core competencies needed to thrive at board-level.

Download course brochure