Vaccine status is a form of special category data under the Data Protection Act. In order to process vaccine status, you must have an individual’s explicit consent and a lawful basis for processing. Consent forms and well drafted data protection policies are a must.
Although you can process this data, you must be careful to ensure that employees aren’t treated unfairly if they haven’t been vaccinated as this may be discriminatory depending on their reason for refusing the vaccine.