The COVID-19 Public Health Response (Protection Framework) Order 2021 (Order) has finally been issued.  This Order provides the legal framework for the COVID-19 Protection Framework, known as the traffic light system.  The Order comes into effect 11:59 pm on Thursday, 2 December 2021.  This Order revokes the previous public health order, COVID-19 Public Health Response (Alert Level Requirements) Order (No 12) 2021 which we have all become accustomed to.

The Order allows for new additions, as needed, to provide a tailored response to a particular situation.  For example, a localised lockdown schedule may be inserted if there is a rapid growth in cases in a particular area.

As expected, the Order is fairly complex and encompasses many confusing provisions.  We set out below a simplified summary of the key provisions as they relate to employers and their operations in the different settings.

Safety measures for businesses

Close-proximity businesses

The Order introduces a new classification for businesses which have workers and customers at higher risk of exposure to COVID-19, known as close-proximity businesses.  The Order defines them as businesses which cannot undertake its services:

  • Without physical contact, or close proximity, between people; or
  • Without workers being closer than 1 metre to clients.

Close-proximity businesses have heightened safety protocols and are incentivised under the Order to use COVID-19 Vaccination Certificates to have greater operational freedom.

COVID-19 Vaccination Certificate (CVC)

 Where businesses require a CVC as a condition of entry, they will be required to apply that vaccination requirement to both their customers and workers under the new Framework.   The effect of this will be to impose a vaccination mandate for employees.  Given this, employers ought to undertake risk assessments and consultation processes prior to implementing vaccination requirements for their customers.  That said, employers which use CVCs (especially in customer-facing services) will have far greater operational certainty, such as higher capacity limits and lowered safety protocols, which will assist with much needed business relief after 107 days of lockdown in Auckland.

Where a business requires a CVC as a condition of entry, they must have a system or process in place to verify, so far as is reasonably practicable, CVC compliance.

Certain essential businesses and services are not permitted to deny access on vaccination grounds.

QR codes and other contact tracing

At all levels, businesses must display the NZ COVID tracer app QR codes in / near the main entrance and other prominent areas around the business.   Businesses must have alternative contact record systems and processes in place for individuals who do not have smartphones.  Businesses must also comply with their obligations under the Privacy Act 2020 when collecting this information.

Certain businesses, such as close-proximity businesses, must have systems and processes to ensure people entering the workplace scan QR codes or provide contact records.

Specific health measures

Under the Order, businesses must also follow specific health measures that depend on the nature of the risk present in the industry and the traffic light setting in their region.   These specific health measures include:

  • Face-coverings;
  • Social distancing;
  • Gatherings; and
  • Capacity limits.

We recommend that businesses seek specific legal guidance to determine what specific health measures they must use under their respective traffic light settings.

WorkSafe’s enforcement approach

WorkSafe is taking an educate-first approach and is helping businesses and services meet their obligations under the different COVID-19 legislation and orders.  This means giving businesses the chance to make changes where they might not be compliant.

WorkSafe has also confirmed inspectors are more likely to take enforcement action for a COVID-19 matter under COVID-19 legislation rather than the Health and Safety at Work Act 2015 (HSWA).  However, this depends on the nature and severity of the breach.    WorkSafe also notes that it is unlikely that they will intervene for an individual case of work-related COVID-19. However, where a business or service has a cluster of work-related COVID-19 cases that indicate risks are not being managed effectively, intervention may occur.

Vaccine assessment tool

The enforcement approach has also been updated to note that where businesses have implemented the vaccine assessment tool, WorkSafe will focus on the process followed.  They are unlikely to take enforcement action over the use of the tool if a business or service can demonstrate:

  • The assessment was carried out in line with the tool’s guidance, and
  • Consultation with workers and their representatives was genuine.


Despite taking an educate-first approach, WorkSafe may take enforcement action where a business fails to make the necessary changes.

Non-compliance with the relevant public health order is an infringement offence for the purposes of section 26(3) COVID-19 Public Health Response Act 2020.   The COVID-19 Public Health Response (Protection Framework) Amendment Order 2021 assigns each infringement offence under the Order into three classes.   The three classes are high risk, medium risk, and low risk and are defined by reference to how likely the offence is to lead to the transmission and spread of COVID-19.

The prescribed classes of infringement offences under the COVID-19 Public Health Response Act 2020 are set out in the following table:

Class of offence Description of class
Low risk A breach of an administrative requirement or any other requirement where the worst potential outcome of the breach is a low likelihood of transmission and spread of COVID-19.
Medium risk A breach of a requirement where the worst potential outcome of the breach is a possibility of transmitting or spreading COVID-19 or limiting the capability of the public health response, which does not otherwise meet the description for low risk or high risk.
High risk A breach of a requirement where the risk of transmitting or spreading COVID-19 as a result of the breach is probable.

The prescribed infringement fees for each class of infringement offence are set out in the following table:

The infringement fees (fees that can be imposed on an offender by infringement notice)
Fee: individual ($) Fee: any other person ($)
Low risk 500 1,000
Medium risk 1,500 4,000
High risk 4,000 12,000
The maximum fines (fines that may be imposed instead of infringement fees if the matter goes to court)
Fine: individual ($) Fine: any other person ($)
Low risk 1,500 4,000
Medium risk 4,500 12,000
High risk 12,000 15,000


 The introduction of the new COVID-19 Protection Framework represents a shift into the next part of New Zealand’s response to COVID-19.   The new framework allows for more flexibility and commercially pragmatic options for businesses as they enter 2022.

In our view, WorkSafe’s new updated enforcement approach is a welcome update.  WorkSafe’s guidance and clarity over its approach in handling COVID-19 compliance and the new vaccine assessment tool (when it is ready for use) give employers the certainty they need to help keep their workers and customers safe.

If you would like specific guidance as to how you can ensure you are compliant as we shift into the new COVID-19 Protection Framework, please contact us.