Keeping contact information for COVID-19 and other purposes
NSW public offices must collect and keep personal contact information responsibly. Follow COVID-19 recordkeeping rules and retention guidelines. Check disposal authorities for correct record management.
Recordkeeping for personal contact information
NSW public offices often collect personal contact information for various purposes, including:
- marketing and information
- safety and security
- service provision.
It is essential to handle this information responsibly, as it may be considered confidential. Disclosure should align with the purposes of collection. For detailed guidelines, refer to the NSW Privacy Resources.
COVID-19 recordkeeping requirements
Under Section 22 of the Public Health (COVID-19 Restrictions on Gathering and Movement) Order (No 4) 2020, NSW public offices must:
- keep records of the names and contact details of staff, volunteers, visitors, and contractors for at least 28 days
- provide these records to the Chief Health Officer upon request.
Note: While 28 days is the minimum retention period, other regulations or business needs may necessitate longer retention.
Retention period scenarios
For scenarios where the retention of personal contact information exceeds public health order requirements, consult your organisation's retention and disposal authorities or email govrec@staterecords.nsw.gov.au for further advice.
Scenarios
In this scenario, NSW public offices should follow the minimum retention period as set out in s12(a) of the Public Health Order No 3 – keep the record for at least a period of 4 weeks.
The disposal of this contact information is permitted under the following disposal classes:
| 2.23.3 | Summary records regarding visitor attendance, for example, visitors books. | Retain until administrative or reference use ceases, then destroy |
| 2.16.1 | Summary records of visitor attendance, for example, visitors' books. | Retain until administrative or reference use ceases, then destroy |
For records relating to staff's attendance to the premise, go to Scenario 3.
In this scenario, NSW public offices may already have systems in place which collect contact information. However, NSW public offices should ensure that they are able to produce contact information of persons in attendance to the Chief Health Officer or delegate for contact tracing when needed.
NSW public offices should identify the retention period of this contact information pre-COVID-19 and assess whether the retention period is longer or shorter.
Pre-COVID-19:
- if the contact data is usually retained shorter than the minimum retention period as set out in s12(a) of the Public Health Order No 3 – keep the record for at least a period of 4 weeks.
- if the contact data is usually retained longer than the minimum retention period as set out in s12(a) of the Public Health Order No 3 – retain this record as per the relevant disposal classes. The following disposal classes apply:
- General authority: administrative records (GA28) – Community relations – Customer service
| 2.6.4 | Contact details of clients, for example, E-mails lists, address lists | Retain until administrative or reference use ceases, then destroy |
| 2.23.3 | Summary records regarding visitor attendance, for example, visitors books. | Retain until administrative or reference use ceases, then destroy |
| 2.23.4 | Records relating to visits made by the organisation's employees to other organisations (for example, community, business) or professional associations with the view of promoting the image or services of the organisation. Records include invitations. | Retain minimum of 2 years after action completed, then destroy |
| 2.6.1 | Contact details, for example, email lists and address lists, and records relating to their updating and maintenance. Includes changes of contact details for purposes other than rating. | Retain until administrative or reference use ceases, then destroy |
| 2.16.1 | Summary records of visitor attendance, for example, visitors' books. | Retain until administrative or reference use ceases, then destroy |
| 2.16.2 | Records relating to visits or tours of the organisation by members of the general public, student groups, clients of the organisation, representatives of professional associations, community groups or other organisations. Includes requests that are denied. Records include arrangements and bookings, reports of visits and letters of appreciation. | Retain minimum of 3 years after action completed, then destroy |
| 2.16.3 | Records relating to visits made by the organisation's employees to other organisations (for example, community, business) or professional associations with the view of promoting the image or services of the organisation. Records include invitations. | Retain minimum of 2 years after action completed, then destroy |
In this scenario, NSW public offices don’t have to introduce additional data collection activities as systems are already in place. However, NSW public offices should ensure that they are able to produce a record of names and contact information of persons in attendance to the Chief Health Officer or delegate for contact tracing when needed.
In this scenario, the following disposal classes apply:
| 16.24.5 | Records relating to property access controls to secure areas. Records include:
| Retain minimum of 7 years after action completed, then destroy |
| 5.10.1 | Records relating to property access controls to secure areas. Records include:
| Retain minimum of 7 years after action completed, then |