staff and volunteers), unless exempt. Exemptions were made where a person entered for the sole purpose of making postal, courier or other deliveries and collections; and for police officers and emergency responders in the course of their duty. Where a person entering the premises was expected to interact with only a single member of staff, the name of that staff member also had to be recorded. The recorded contact details had to be held securely for 21 days, and released on request to the Secretary of State or a Public Health Officer. After 21 days the details had to be destroyed. Requirement to request details from groups Where a group sought entry, the business or service provider had to obtain contact details from every group member, apart from those who had scanned the QR code or who were under 16. Either each group member could provide details individually, or one group member could provide details for the group as a whole. Where a group was larger than six (for example where they were all of the same household or linked households), they had to be treated as separate sub-groups of no more than six for this purpose. From 29 March 2021, SI 2021/364 (the "Steps" regulations) deleted the clauses relating to groups, instead requiring each member of the group to provide their own contact details as if entering the venue alone. Requirement to refuse entry If anyone seeking entry for the purpose of consuming food or drink neither provided the requested information in full, nor scanned the QR code, admission had to be refused. This requirement did not apply to the non food and drink establishments listed above. Penalties Businesses or service providers breaching certain of the regulations could receive a fixed penalty of £1000 (£500 if paid in 14 days), rising to £4000 for repeated violations. Offenders could also be prosecuted. Breaches subject to penalty or prosecution were: Failing to display a QR code (from 24 September 2020) Failing to request contact details from a person or a group entering a premises Failing to record the single member of staff or volunteer whom a visitor comes into contact with Failing to retain the contact details securely Failing to delete contact details after 21 days unless there is another basis to retain them Non-compliance with a request from the Secretary of State or a Public Health Officer to disclose contact