COVID-19 Protection Framework: Guidelines and FAQs

By Jocelyn Visser, HR Business Partner

The next stage of New Zealand's COVID-19 response plan is a protection framework that aims to give people more freedom and allow more businesses to open while minimising the spread of the virus.

The COVID-19 Protection Framework is a 3-level “traffic light” system - Red, Orange and Green - that hinges on high rates of people being fully (double) vaccinated and the use of vaccination passes (certificates) in higher-risk settings. Each level has different restrictions based on the threat COVID-19 case numbers pose to the health system and people’s safety.

As of 24 January the whole of New Zealand is at Red.

The government will fully review the levels again on 26 January 2022. To shift between levels, they will consider various things, e.g. vaccination coverage, the level of community transmission, the capacity of the health and case management systems.

In case of an outbreak, moving up levels and localised or wider lockdowns (similar to previous Alert Levels 3 or 4) will still be an option.

Find out more about the protection framework at

This information is correct as of 24 January 2022.

At Red, which businesses can open and what restrictions are in place?

  • Working from home is encouraged.
  • Retail can open with mandatory mask use and capacity limits based on 1-metre physical distancing.
  • Early childhood centres and schools can open with public health measures in place. Vaccination is required for onsite delivery at tertiary providers, with capacity based on 1-metre distancing
  • ‘Close contact’ businesses can operate with vaccination certificates and additional public health requirements.
  • Hospitality, events and gatherings, and gyms can operate at a capacity of 100 people, with 1m social distancing, if they opt in to vaccination certificates.
  • If opting out of vaccination certificates:
    • Hospitality must be contactless (as per Alert Level 3).
    • Gatherings of up to 10 people.
    • Close-contact businesses, events (indoor/outdoor), and gyms can’t operate.
    • Tertiary education is distance learning only.
  • Record keeping and scanning is required.
  • Regional boundaries may apply.

At Orange, which businesses can open and what restrictions are in place?

  • Workplaces can open.
  • Retail is open with mandatory mask use and capacity limits based on 1-metre distancing.
  • Schools, tertiary providers, and ECEs can open with public health measures in place.
  • Public facilities can open (libraries, community centres etc.) with mandatory mask use and 1m social distancing
  • These businesses can operate freely, if they opt in to vaccination certificates:
    • Hospitality
    • Gatherings
    • Gyms
    • ‘Close contact’ businesses
  • If opting out of vaccination certificates:
    • Contactless pick-up only for hospitality (as per Alert Level 3).
    • Gatherings with up to 50 people and 1m social distancing.
    • Close contact businesses, events (indoor/outdoor) and gyms can’t operate.
  • Masks are mandatory on flights, public transport, and taxis, encouraged elsewhere.
  • Record keeping/scanning required.
  • Regional boundaries removed.

At Green, which businesses can open and what restrictions are in place?

  • Workplaces are open.
  • Retail and public facilities open with no restrictions.
  • ECEs, schools and tertiary providers are open.
  • These businesses/events can operate freely, if they opt in to vaccination certificates:
    • Hospitality.
    • Events and gatherings
    • Gyms.
    • ‘Close contact’ businesses.
  • If opting out of vaccination certificates:
    • Hospitality - up to 100 people, 1m socially distanced, seated and separated.
    • Events and gatherings - up to 100 people and 1m social distancing.
    • Close contact businesses - face coverings for staff, 1m distancing between customers.
    • Gyms - up to 100 people based on 1m distancing.
  • Record keeping/scanning required
  • Masks mandatory on flights, encouraged indoors.
  • Regional boundaries removed.

How do I decide if the business will require vaccination certificates (“passports”)? 

Requiring vaccination certificates will be optional for many businesses and services. If your business is in the hospitality, event, tertiary education, or close-contact sectors and you don’t want to request proof of vaccination, you will have to operate with stricter limits on capacity and space requirements, and may have to close in Red and Orange levels. 

Essential services, e.g. supermarkets, pharmacies, petrol stations, and health services, won’t have to introduce vaccine certificate requirements.

How do I know if we are a close-contact business?

The criteria and details cover a broad range of businesses, but our general guidelines are that you are likely to be considered a close-contact business if you:

  • Work within 1 metre of the public.
  • Are not able to deliver contactless services, e.g. hairdresser, barber, massage therapist.
  • Are not able to reasonably follow other control measures like physical distancing or mask-wearing.

It is important to note this is in relation to contact with the general public, not other staff members.

What is the difference between vaccination certificates and passes?

There is some confusion about the language, but certificates and passes (or "passports") refer to 'My Vaccine Pass', the official record of a person's COVID-19 vaccination status.

The pass has the person's name, date of birth, and a QR code, and can be digital or a physical printed copy. Anyone aged 12 and over who has had 2 COVID-19 vaccinations administered in NZ (or who has been given a medical exemption) can get a pass.

The pass is for use within New Zealand to enter events, venues, and other businesses that opt in to their use. There is also an International Travel Vaccination Certificate, for use overseas.

Find out more about vaccination certificates at

Can retail businesses opt in to the use of vaccination passes?

There has been some uncertainty about this, but the government has said that retail businesses can opt in to the new system and request proof of vaccination from their customers if they wish.

If I want to opt in to the use of vaccination passes for customers, will my staff need to be vaccinated?

It depends.

If you are a business covered by the My Vaccine Pass mandate - i.e. food and drink services (except businesses that only provide takeaways), events, close-proximity businesses (hairdressers, beauty and tattoo parlours, nail salons etc.), gyms and indoor exercise facilities, and on-site tertiary education when Red settings are in place - your workers will need to have their first vaccination by 3 December 2021 and be fully vaccinated by 17 January 2022.

The mandate applies to all businesses in these sectors regardless of whether they require vaccine passes from customers and clients. If employees refuse and there are no redeployment options, you must give them a minimum of 4 weeks’ notice, with pay, before you can terminate their employment. As always, consultation is crucial, and process is paramount.

If your business is not covered by the COVID-19 Public Health Response (Vaccinations) Order 2021 or the vaccine pass mandate, e.g. retail, opting in to the use of vaccination passes for customers is unlikely to allow you to mandate vaccination for your employees. Instead, you will need to do a full risk assessment to see if you can require work to be carried out by vaccinated workers, on health and safety grounds.

Find out more about risk assessments and mandating vaccinations.

If I choose to opt out of vaccination passes for customers, can I mandate vaccinations for my staff?

No, you can’t mandate your employees get vaccinated unless your organisation is covered by either the COVID-19 Public Health Response (Vaccinations) Order 2021 or the My Vaccine Pass mandate, or you undertake a health and safety risk assessment that determines that vaccinations are required for positions in your business.  

How does my business check customers' vaccine passes?

If your business chooses to operate under My Vaccine Pass rules, you must check customers' passes. You can verify digital passes by using the NZ Pass Verifier app, which is available from the Apple and Google Play app stores. The app scans the QR code embedded in the pass and lets you know if it is valid or not.

The government recommends checking passes at or near the point of entry, or as soon as possible after entry, e.g. at the counter, if you only have 1 staff member.

You must also display posters or signage informing customers that entry is contingent on having a My Vaccine Pass.

It is up to customers to present only their own pass. Businesses aren't required to check ID, but you can request it.

Learn more about requiring customers' vaccine passes at

I’m not a customer-facing or close-contact business, but can I opt in to vaccination passes to make vaccines mandatory for my staff?

No, vaccination passes will only be an entry requirement for the public at hospitality, events, gatherings, gyms, tertiary education, or close-contact or other businesses that opt in to their use.

If you’re not a public-facing business, you can’t opt in in order to mandate vaccination for your staff. 

If you are considering mandating vaccines as you have health and safety concerns if your staff remain unvaccinated, you will need to undergo a thorough risk assessment and consultation process. 

Get legal advice before you make any decisions on mandating vaccinations for your team members.

As a repairs and maintenance service, would we be classified as close contact if we can mitigate contact with controls such as hours of work and keeping more than 2m from customers?

As per the close-contact guidelines above, you may not be considered a close-contact business.

We recommend getting expert advice about your specific situation.

If we determine our business is not close contact, are we able to operate at Red without requiring vaccination passes?

Yes. If you are not in one of the industries specified, then you can operate at Red, adhering to the general public health measures and restrictions such as social distancing and capacity limits. If your team can work from home, this is encouraged.

The bulk of our customers are elderly and therefore at higher risk of catching COVID-19 and suffering severe illness. Is this reason enough to opt in to vaccination passes even if the customers haven't asked to be served by fully-vaxxed staff?

From the current reading of the protection framework, if your business is close contact you could opt in to the use of vaccination passes and mandate vaccinations for your staff.

If you are in retail, you could choose to opt in to the use of vaccination passes but you would not be able to rely on that to mandate vaccinations for your staff. 

If you don't fit one of these categories, we recommend either waiting to see if other sectors will be covered or relying on other measures to mandate vaccines for employees, i.e. complete a thorough health and safety risk assessment and consultation process.

If part of your service is providing services to sectors covered by the government vaccinations order, such as health or education, then you are likely covered by that.

Seek advice if you’re unsure.

Our hospitality business has roles that are close contact, e.g. front of house and bar, and others that aren’t, e.g. chefs and dishwashers. Can we treat them separately?

If you can reasonably separate your business’ areas to minimise the risk of spread, you could treat them as separate. However, most hospitality businesses aren’t designed for this and front of house staff have regular contact with back of house staff.

In this case, we recommend deciding if you will opt in or out of vaccination passes and then apply one rule to simplify your operations and minimise health and safety risk.

What if my business is a combination of both retail and close-contact, e.g. a beauty retailer?

Both retail and close-contact businesses can choose to opt in or out of vaccination passes.

Close-contact settings have greater restrictions than retail, so we would recommend deciding as a business what your plan is and then acting accordingly. If you can reasonably separate the area people go for beauty treatments from the area people come in to buy things, you may be able to have different rules for each area. 

We recommend getting advice about your specific situation. 

We have clothing stores where customers expect assistance with fitting and tailoring. Is this considered close contact?

It could be, and if this is a core part of your business you could look at relying on that to opt in to vaccination passes and mandate vaccination for employees.

However, if this is an extra service you offer, mandating vaccination does come with some risk. For example, if your business sells casual and formal clothing and offers suit tailoring, we would recommend managing the risk by operating under the framework guidelines for retail, and limit those close-contact services in Red and Orange.

What about roles where people must enter a person's home?

The same guidelines apply as above. If customers are requesting only vaccinated people on site, they are able to do that.

In Red, can physios etc. ask for vaccinated patients only? We are a close-contact health service but are not seen as an essential service at present (we only have a limited ability to work in Alert Level 3).

Physios could reasonably be classed as close-contact businesses and therefore could choose to opt in to vaccine passes, which would restrict services to vaccinated customers only.

If you choose not to implement a vaccination entry requirement for customers, you will not be able to operate in Red (or Orange).

We provide tertiary education which consists of classroom and practical workshop (indoor) activities. Social distancing of the students will be impossible during the practical. Under the Red traffic light what must the students do, and can we ask them their vaccination status?

Under Red, if you opt in to vaccine certificates (i.e. checking vaccination status) you have restrictions on capacity based on 1-metre social distancing. You may have to suspend the workshop activities if you are unable to space the students adequately.

If you opt out of vaccine certificates, you can only offer distance learning.

In the construction industry, can only essential work occur under Red?

Under Red, construction can continue with the general settings: 1-metre social distancing, mask use encouraged (mandatory on public transport, retail, public venues etc), record-keeping, and good hygiene.

Can I ask customers for their vaccination status?

Short answer: Yes.

Long answer: When asking for any personal information, you need to let the person know why you are collecting it, what it will be used for, and how you will store and safeguard it.

We recommend framing the question along the lines of: 'To manage our health and safety risks, we are asking customers whether or not they have been vaccinated. We will not be storing this information and will only be using it for the purposes of managing risks. If you’re not comfortable sharing this, that's fine, and we will treat you as unvaccinated'.

What privacy hoops might I need to jump through to find out if my team members are vaccinated e.g. policy creation, privacy disclaimers?

Asking if employees are vaccinated comes with risk as it could be a breach of the Privacy Act.

If there is a genuine business reason for asking, e.g. you are covered by the vaccinations order, have completed a risk assessment, are opting into vaccine certificates, or you have clients requesting only vaccinated workers on site, you can ask the question and let people know if they choose not to disclose their status, they will be treated as unvaccinated.

It is important that you let people know what information you need, why you need it, what you will be using it for, and how you will store and safeguard it.

While recruiting, can we ask if a person is vaccinated? We are in a retail environment and looking to potentially class ourselves as a close-contact business and require all new team members be vaccinated?

Retail businesses are unlikely to be classed as a close-contact.

You can ask about vaccinations as part of recruitment only if you have a legal reason to do so, e.g. your business is covered by the government vaccinations order or you have conducted a health and safety risk assessment that determines you need vaccination to help effectively manage the risk of staff or customers catching or transmitting COVID-19. 

All our staff are vaccinated. Do we still need to advise existing staff if we want to mandate vaccination?

Yes, it would be fair and reasonable to still go through the process of letting your team know what is happening and how it will affect them (even if this means it won't affect them as they are already vaccinated).

Can staff travel between regions for work?

Yes. People can travel around New Zealand at all levels of the protection framework. People travelling into a different setting area need to follow the guidance for the area.

However, most workers crossing the Auckland boundary must have evidence of a COVID-19 test taken within 7 days before crossing (they don't need evidence of a negative result, just evidence they have been tested). They also need to carry evidence of their reason to cross the boundary, e.g. work order or letter from the employer. There are police check points.

If you have workers who need to cross the Auckland boundary, you need a process in place to allow workers to be tested for COVID-19. This includes allowing workers to undergo testing, medical examination, or both, during work hours.

Other people older than 12 years and 3 months who are leaving Auckland must be fully vaccinated and have their My Vaccine Pass, or be carrying evidence of a negative COVID-19 test taken no more than 72 hours before crossing the boundary.

People entering Northland from Auckland need to show their My Vaccine Pass or a negative COVID-19 test taken no more than 72 hours before entering Northland.

Two police checkpoints are operating 24 hours a day, 7 days a week.

You do not need to follow these requirements if you are transiting Auckland without stopping.

From 18 January 2022, the travel restrictions will be lifted.

Find out more about travel at

Can I take a child under 12 to a marae or church, as they can’t get a vaccination certificate - are they exempt?

Yes. The restrictions do not apply to children under 12 and people with an exemption from the Director-General of Health, as they cannot get vaccinated.  

Where can I get expert legal opinion in an untried field?

As the protection framework and vaccination passes haven’t been implemented yet, this is an untested area. At MyHR, we are keeping a close eye on the legal situation and related case law, and will provide updates when we have them.

When can we start consulting with the team about the new COVID protection framework system?

You can prepare now by sending a memo to your team (and customers) to let them know if you plan to opt in or opt out of vaccination passes.

If you are in hospitality, events, tertiary education, or a close-contact business, and are going to opt in to vaccination passes, let your team know this means you will need to know their vaccination status and may need to mandate vaccination for their roles (once law changes are confirmed).

What you can’t do yet is consult to change anyone’s role based on their vaccination status, as the protection framework has not come into effect yet.

Now is a good time to let your team know about any health and safety procedures they need to be aware of and how to follow them.

You can also encourage and help your employees to get vaccinated and offer other support for mental health and wellbeing, e.g. EAP services, resources from the Mental Health Foundation, the free 1737 ‘Need to Talk?’ service.

Where can we find more information about vaccination certificates and what this means for business?