From 11 November 2021, anyone working or volunteering in a care home will need to be fully vaccinated against coronavirus (COVID-19), unless they are exempt under the regulations.

The regulations say that a care home may process information about vaccination or medical exemption status, but this must be done in a way that is consistent with data protection legislation. This includes updating your information asset register, record of processing activity, and privacy notice. You will also be required to complete a data protection impact assessment (DPIA) because the Information Commissioner’s Office Guidance on Vaccination and Covid Pass Checks states

“If the use of this data is likely to result in a high risk to individuals (eg denial of employment opportunities) or you will be processing health data on a large scale, then you need to complete a data protection impact assessment before you start processing the data.”

Care homes will not be able to employ individuals who have not received 2 vaccinations or who don’t have an exemption, therefore this can result in the denial of employment opportunities and so a DPIA is required.

We have a draft privacy policy and DPIA below and are working to get these formally signed off as soon as we can. In the meantime, please feel free to use these documents but be aware of our disclaimer. We will continue to update this advice when we get more information.

For general advice on vaccination as a condition of deployment, please see the compiled guidance from the Care Provider Alliance.