Sep 7th, 2021
13 mins

Shakespeare Martineau are a member of BFFF and a leading full service law firm. We asked Phil Pepper (Partner and Head of Commercial, IP & Employment) to comment on the legalities of requesting vaccination status from employees.


From 16 August 2021, any employee who has been double vaccinated (14 days after the second jab) or is under the age of 18, will no longer required to self isolate if they have been in close contact with someone with COVID.  However, they will still be encouraged to take a PCR test but that is not mandatory.

Whilst on the one hand this is good news for employers, in that it will hopefully reduce workplace disruption by reducing the number of employees being required to self isolate, it also throws up a variety of challenges and queries.

The basics

Employees have a legal obligation to inform their employer if they are told to self-isolate by NHS Test and Trace. A failure to do so could result in a £50 fine.  It is also a criminal offence for an employer to allow an employee to attend the workplace if they are aware that the employee is required to self isolate.  This may result in a fine starting from £1,000.

However, from 16 August, if an employee is exempt from self isolation (such as those who are doubled jabbed or under 18) they are not obliged to inform their employer that they have been contacted by NHS Test and Trace.

Understandably, employers are now concerned about their obligations around health and safety (to provide a safe working place for all employees) and their obligations around allowing employees to work if they have been in close contact with someone with the coronavirus.

Can employers ask employees about the vaccination status?

At first glance this is a simple solution to address any concerns right?  However, as always it’s never quite that simple.

Whilst it’s possible to ask employees about their vaccination status there are data protection issues to successfully navigate. Vaccination status would fall under the “special category data” under the GDPR provisions, and as such employers need to tread very carefully.  Employers must identify both:

  • A lawful basis for processing personal data e.g. an employer identifying a legitimate interest and showing that processing is necessary to achieve it, taking into account the employee’s interests, rights and freedoms.
  • An exemption for processing health data such as performance of rights and obligations in connection with employment (e.g. to ensure health and safety of workers/safe working environment) or where processing is necessary for the establishment, exercise or defence of legal claims.

The ICO has issued guidance which provides that the sector in which the employer operates, the nature of the work and health and safety of the particular workplace will be relevant for employers in deciding whether they lawful grounds for collecting and using vaccine status data.

Therefore, employers may be able to justify collecting data where there are increased risks of employees coming into contact with those infected with coronavirus, such as in the retail or services sector where their employees routinely come into close contact with large numbers of members of the public who do not wear masks.

Employers must also be transparent and ensure that employees understand why it needs to collect the information around vaccination status and what it will be used for.  This is likely to mean updating an existing employee privacy policy, but the new changes will need to be brought to the attention of all affected staff.

How can employers check an employee’s vaccination status?

The ICO has confirmed that by conducting a visual check of COVID passes only (such as looking at hard copies or pictures on a screen), that will not result in the employer retaining any data, and would not be considered to be “processing” data.  Therefore, this form of checking vaccination status would fall outside of GDPR.

However, where an employer carries out digital checks (such as scanning a QR code on a pass) or records the employee’s status after checking their pass to keep on file, this would constitute processing data and the employer should then only collate only as much data as is necessary.  It is unlikely that the type of vaccination or the gaps between the 1st and 2nd jabs is likely to be necessary.

Can an employer prevent an unvaccinated employee from entering the workplace?

This could be problematic given that the current Government guidance is clear that vaccination status of a workforce has no impact on the safety measures that employers should follow.  However, of course, employers have health and safety obligations to their workforce and need to balance all the factors.  There may be other ways to manage the risks for example by requiring those who are not vaccinated to undertake appropriate and regular testing (regular lateral flow tests for example).  Any health and safety risk assessment will need to explore those alternatives.

The employer will also need to understand the reasons why the employee is not vaccinated.  There may be a medical reasons why they cannot be vaccinated or have religious and/or strong ethical beliefs around vaccination.  In those cases preventing employees from entering the workplace may well be discriminatory and result in a variety of employment related claims.

Of course, that position may differ where the risks are significant, such as frontline healthcare workers and other sectors who are in close contact with vulnerable individuals (such as care homes where vaccination status is mandatory).

What if the employee refuses to confirm their vaccination status?

If the employer has a legitimate basis for asking employees about their vaccination status, and the employee refuses to confirm their status, the employer should firstly try and understand why the employee does not wish to reveal their status and explain why the information is required.

If the employee continues to refuse to reveal their status and there are no valid and reasonable reasons for doing so, the employer could regard that refusal as a disciplinary matter for failing to obey a reasonable management instruction.  The employer may also wish to regard them as being unvaccinated and treat them accordingly.

Can an employer send an employee home and pay them SSP if they refuse?

In short, that is unlikely.  In order to qualify for SSP an employee must be considered incapable of work.  There are very precise circumstances which fall under the definition of being incapable for work which does currently include being told by NHS Test and Trace to self isolate or having to self isolate after testing positive for COVID.   The definition does not cover scenarios where an employer refuses to allow an employee into their workplace for refusing to disclose their vaccination status.  If the employee does not meet the precise definition of being incapable for work for SSP purposes then they are not entitled to receive SSP.

If an employer sent an employee home in those circumstances, unless there was a very clear contractual basis for not paying an employee, the employee is likely to be entitled to be paid full pay for any period where the employer refuses to allow them to attend their workplace.

If you have any queries or would like any further information please contact Shakespeare Martineau LLP


Philip Pepper

Partner & Head of the Employment and Commercial Team


Martin Noble

Partner  –  Commercial & GDPR Specialist


Dec 9th, 2021
2 mins

Fareshare and Frozen

Nov 1st, 2021
3 mins

Lumina Intelligence give cautious optimism with menu counts increasing season-on-season in the latest BFFF industry webinar

Sep 22nd, 2021
1 min


Sep 16th, 2021
1 min


Aug 19th, 2021
1 min

The Future of Imports Recording

Jul 22nd, 2021
1 min

Integrating Social Value into your business recording

May 20th, 2021
1 min