• The lawful basis for processing personal data about testing, setting out that it may flow from article 6(1)(e)/(f) GDPR depending on the nature of the employer, read with the 'employment' condition for processing special category data Article 9(2)(b) GDPR (and Sch 1 para 1 of the Data Protection Act 2018 - however, the guidance does not mention the need for an employer to have an Appropriate Policy Document in place as part of the requirements of that condition);
• Sharing information about employees who have tested positive;
• The guidance also flags the importance of having conducted a Data Protection Impact Assessment as part of moving towards testing, including the use of the Surveillance Camera Commissioner's template for testing which involves surveillance technology, such as thermal cameras (https://www.gov.uk/government/news/updated-data-protection-impact-assessment-template-and-guidance-launched). 

Beyond data protection issues there are, of course, employment law and health and safety related implications around testing staff. For advice on these issues please let us know.