Mandatory Record Keeping for Businesses & Events

QR scanning requirement changes come into force 11.59pm, Tuesday, 5 October 2021

The Government has introduced some changes to the Alert Level Order to improve ease of access to QR codes for customers visiting a business or public facilities.

Changes to QR code display requirements:

  • People in control of workplaces must now ensure that:
  1. Additional copies of a COVID-19 QR code will need to be displayed in other places throughout businesses and locations (which are already required to display them). This is in addition to an already required QR code displayed at the main entrance.
  2. QR code posters are now also required to kept in a good condition, this limits the risk that scanning doesn’t take place if posters are faded, damaged or difficult to scan in on.
  3. The QR code must not be altered in a way that makes it unclear that it has been issued by the NZ Government for the purposes of contact tracing. Businesses and locations must use the official COVID-19 QR code posters issued by the Ministry of Health. This also ensures people know the QR code they are scanning links to the COVID tracer app and is for contact tracing purposes.

FAQs around these new changes can be found here from page 7 onwards.

  • Q. Are events also included?
    Yes, businesses and event organisers legally must have a way for customers and visitors to record that they have entered their premises or attended a gathering or event.
    At an event, either the venue owner or operator, or the organiser/hirer of the venue can be the person who is responsible for making sure there are ways for people to record their visit.

From 11:59pm Tuesday 7 September 2021, many businesses and locations will be required to take steps to ensure people can easily make a record when they visit.

This includes:

  • an entertainment venue — for example a cinema, stadium, theatre or casino
  • an indoor event facility, such as a cinema, theatre, concert venue, or casino (see FAQ pack below – current as of 7th Sept 2021)

If you are the person in charge of a business, location, or event, you legally must make sure you have safe and secure systems and processes in place so that everyone working on or visiting your premises can scan in or provide their details in an electronic or paper-based manual process, no matter how long they are there for. This includes workers, contractors, customers, and volunteers.

When businesses and event organisers keep records of who was at their workplace or location, it makes contact tracing faster and more efficient. Good record keeping and fast contact tracing will help stop the spread of COVID-19, and protect our businesses, communities, and each other.

Below is an FAQ pack. Please note the information on Events on the final page of the FAQ pack. We will update this article with any changes as it comes to hand.

You can also find information on the Mandatory Record Keeping page on the Unite Against COVID-19 website here. has guidance on record keeping here.

Resources for businesses and organisations

There are new resources, including posters, three new ‘record keeping box’ templates in different sizes, new record keeping slips, and a sticker for custom boxes. NZ COVID Tracer app posters are still available too.

You might find it useful to display these posters in visible places. Posters can be printed in any size, in black and white, or in colour. You just need to adjust your printer settings.

Record keeping links: slips, box sticker, and box templates

NZ COVID Tracer app poster links

These are also available here.

If someone refuses to scan in

There is no expectation or requirement that you should force a customer or visitor to scan in or provide their details for contact tracing.

You are also not required or expected to turn people away who may refuse to make a record of their visit. It is up to you to decide what is appropriate for your premises and the wellbeing of your staff and other customers.

Privacy Commissioner Guidance on Mandatory Record Keeping

The Privacy Commissioner has a page of guidance here. Please read the full guidance, and especially note:

  • Information should be stored by date.
  • Information stored is only for contact tracing, not for marketing or other uses.
  • Information should be disposed of after 60 days in a secure manner – i.e. shredded, not just thrown in a bin.

Public Health Response Legislation – Order No 11 2021

The legislation can be found here.