Set out below are our top tips for how to approach vaccination of your workforce against COVID-19.

  1. Encourage. Rather than requiring vaccination, strongly encourage workers to be vaccinated, stressing the importance for health and safety. Please take a look at Katten's advisory, "COVID-19 Vaccinations: Key Considerations for UK Employers", where we discuss potential claims you could be exposed to if you make vaccination of your workers mandatory.
  2. Communication. Provide updates to staff as the vaccine becomes more widely available about who is eligible and/or when they are likely to become eligible.
  3. Increase awareness. Consider implementing an awareness campaign. Encourage employees to read up on the vaccine and provide accurate, credible and reliable materials (e.g., on how it works, the approval process, what it contains, etc.). Caution against uncertified sources and misinformation from places such as social media.
  4. Training. Provide training to management in relation to the vaccine and your related policies (e.g., health and safety, risk assessments, your approach to COVID-19 vaccinations, etc.).
  5. Lead by example. If senior management pledges to take the vaccine when it is their turn, the rest of the workforce may be more likely to follow suit.
  6. Be flexible and incentivise. Allow time off for appointments; don't require scheduling outside working hours; provide paid time off for appointments; and consider paying full pay for sickness absence related to the vaccine.
  7. Comply with data protection legislation.

(a) Conduct a data protection impact assessment. Consider the reasons for requiring any data you will collect in relation to vaccines, how to hold it security, who will have access to it, retention periods and what data it is necessary and appropriate to hold.

(b) Update privacy policy. Ensure your privacy policy is up to date and complies with applicable laws.

(c) Consider whether it is necessary to obtain explicit consent from employees to process special category data. Personal data revealing an individual's health and medical records, racial or ethnic origin, religious or philosophical beliefs, are types of "special category" personal data under the EU General Data Protection Regulation (GDPR) and UK data protection legislation. Processing such data (e.g., collecting, storing, using or transferring it) is prohibited unless a specific exception applies, which includes explicit consent from the data subject.

  1. Consider adopting a vaccine policy. This is not legally required but may be a great vehicle to convey a consistent message to employees. It could cover:

(a) your stance on employees getting the vaccine;

(b) your obligations under health and safety legislation;

(c) your obligations under data privacy legislation — refer to your Privacy Policy;

(d) whether you require evidence of appointment dates/times;

(e) where you require evidence of an employee's reason for not having the vaccine;

(f) record keeping of vaccinations and/or employee's exemptions; and

(g) time off for vaccine appointments (or related sickness) and pay during time off.


Georgina Vale, a trainee in the Employment practice group, contributed to this advisory.