Vaccination data belongs to the category of so-called sensitive data - so on the basis of GDPR (General Data Protection Regulation) their processing is stricter than so-called ordinary data. 

Information about an employee's vaccination may be processed by the employer on the basis of the health and safety provisions of the Labour Code - i.e. when it is necessary for the implementation of the obligation to protect the life and health of employees - in order, for example, to organise work more safely. Determining the criterion of "indispensability" is crucial in this case and should be analysed in each situation in relation to the specific establishment and workplace. In some situations, existing measures such as masks or distances may be sufficient to ensure the protection of workers' life and health.

The processing of employees' vaccination data is also possible if the employer establishes in an internal legal act some form of "benefit" (e.g. extra day off or bonus) for the vaccination. However, such processing will only be possible for the purpose of granting the benefit or exercising the right.

The period of time during which the employer stores vaccination data remains uncertain, as it is difficult to determine the protection period of the vaccine.

More in the article by Edyta Jagiełło and Jan Rabczuk "The boss has the right to ask about vaccination" for Rzeczpospolita (article dated 8th of April 2021).