ARCHIVED: this archived Practice Note is no longer maintained and is for background information only. Following publication of the government’s COVID-19 Response: Living with COVID-19, under which the remaining coronavirus (COVID-19) domestic legal restrictions were removed in England from 24 February 2022, the ICO replaced its detailed, specific guidance with a brief form of guidance on data protection and COVID-19 from 28 March 2022. See: LNB News 28/03/2022 91. This Practice Note considers the position under the ICO’s previous, more detailed, guidance, which was deleted from 28 March 2022. This material considers the UK GDPR regime, and legislative links are to Assimilated Regulation (EU) 2016/679, UK GDPR, except where expressly stated otherwise. The coronavirus (COVID-19) pandemic is likely to give rise to situations that will require an employer to process, ie to collect, use and record, personal data and special category data relating to its workforce, in particular data concerning health (health information). Before processing any such data, the employer will need to consider whether that processing is lawful under Assimilated Regulation