The Information Commissioner has published Q+A guidance ( from a data protection perspective on workplace coronavirus testing. It considers: 

  • The lawful basis for processing personal data about testing, setting out that it may flow from article 6(1)(e)/(f) GDPR depending on the nature of the employer, read with the 'employment' condition for processing special category data Article 9(2)(b) GDPR (and Sch 1 para 1 of the Data Protection Act 2018 - however, the guidance does not mention the need for an employer to have an Appropriate Policy Document in place as part of the requirements of that condition);
  • Sharing information about employees who have tested positive;
  • The guidance also flags the importance of having conducted a Data Protection Impact Assessment as part of moving towards testing, including the use of the Surveillance Camera Commissioner's template for testing which involves surveillance technology, such as thermal cameras ( 

Beyond data protection issues there are, of course, employment law and health and safety related implications around testing staff. For advice on these issues please let us know.