A Data protection impact assessment (DPIA) needs to be completed before data is collected if the use of the data is likely to result in a high risk being posed to staff (eg denial of work opportunities). This is likely to be the case with health data such as vaccination statuses.
A DPIA is a process that helps to identify and minimise data protection risks, by analysing the processing to be carried out.
For more information, read Data protection impact assessments.