VI Personal Data Protection in Vietnam 2026: 7 HR Compliance Checks
Updated: November 3, 2026
Recruitment and payroll management require businesses to collect and process substantial amounts of employee information. This may include job applications, identity documents, bank account details, salary records and information required for statutory employment obligations.
For companies operating in Vietnam, personal data protection is therefore not merely an information technology issue. It is also an important part of human resources management, employment compliance and corporate governance.
Since January 1, 2026, Vietnam’s new Law on Personal Data Protection has established a more comprehensive legal framework for handling personal information. Additional implementing and enforcement regulations have also come into effect.
For foreign-invested enterprises (FIEs), particular challenges may arise when employee records are accessed by overseas parent companies or processed through international HR and payroll systems.
This guide explains seven practical personal data protection checks that businesses should consider when recruiting employees, managing employment records and coordinating with external service providers in Vietnam.
1. Personal Data Protection Regulations in Vietnam in 2026
The principal legislation is Law No. 91/2025/QH15 on Personal Data Protection, officially titled Luật Bảo vệ dữ liệu cá nhân số 91/2025/QH15, which took effect on January 1, 2026.
The Government subsequently issued Decree No. 356/2025/ND-CP detailing certain provisions and implementation measures of the Law on Personal Data Protection, also effective January 1, 2026.
In addition, Decree No. 330/2026/ND-CP on Administrative Penalties in the Fields of Cybersecurity and Personal Data Protection took effect on August 19, 2026.
For employers, a particularly relevant provision is Article 25 of Law No. 91/2025/QH15, which specifically addresses personal data protection during recruitment and employment management.
Article 61 of Decree No. 330/2026/ND-CP provides administrative penalty provisions for violations involving employee and applicant data.
Official sources include:
Law No. 91/2025/QH15 – Government Portal
Decree No. 356/2025/ND-CP – Government Portal
Decree No. 330/2026/ND-CP – Government Portal
These requirements affect how companies collect, use, disclose, store and delete personal data throughout the employment lifecycle.
2. Collect Only Information Relevant to Recruitment
Under Point a, Clause 1, Article 25 of the Law on Personal Data Protection, employers may only request applicant information relevant to the recruitment purpose and consistent with applicable law.
For example, when recruiting an accounting specialist, a company may reasonably need information about professional qualifications, experience and contact details.
However, collecting unrelated personal information without an appropriate basis creates unnecessary compliance risks.
Employers should review their application forms and recruitment platforms to determine whether every requested field serves a legitimate recruitment purpose.
An effective personal data protection process begins by limiting information collection to what is necessary, rather than attempting to secure excessive information for possible future use.
3. Obtain Appropriate Consent and Define the Purpose of Processing
Point b, Clause 1, Article 25 requires applicant information to be processed in accordance with the law and with the applicant’s consent.
The same Article also addresses the use of applicant information for recruitment and other purposes under appropriate agreements.
This distinction becomes particularly important when a company wishes to retain an unsuccessful candidate’s CV for future vacancies.
The original recruitment purpose should not automatically be treated as indefinite permission to use the applicant’s information for unrelated activities.
Businesses should clearly explain the intended processing activities and maintain the relevant records needed to demonstrate compliance.
Where another statutory legal basis or exception may apply to a processing activity, the company should assess that basis separately rather than assume consent is always the only available mechanism.
4. Delete Unsuccessful Applicants’ Data When Required
Under Point c, Clause 1, Article 25, applicant information must be deleted or destroyed if the applicant is not recruited, unless another arrangement has been agreed with the applicant.
This requirement may have practical implications for recruitment management systems.
A company might remove a candidate’s profile from its main applicant database while leaving copies in shared folders, email attachments or local HR devices.
Employers should therefore establish a coordinated approach to deleting or retaining applicant records across relevant systems.
Where the business wishes to maintain a talent pool for future recruitment, the retention arrangement should have an appropriate legal basis and clearly defined scope.
This is particularly relevant to businesses receiving large numbers of job applications through websites and third-party recruitment platforms.
5. Review Employee Records and Retention Periods
Personal data protection responsibilities continue after an applicant becomes an employee.
During employment, companies process information for payroll, tax reporting, social insurance, performance management and other operational purposes.
Under Clause 2, Article 25, employee personal data must be retained for the period required by law or agreed between the relevant parties.
When an employment contract ends, the data must generally be deleted or destroyed unless an applicable agreement or legal requirement provides otherwise.
This does not mean all employee records must be erased immediately when a worker leaves.
Accounting, tax and other statutory recordkeeping requirements may require some documents to be retained for specified periods.
For this reason, HR teams should work with accounting and legal functions to establish retention schedules for different document categories.
A reliable personal data protection framework should prevent unnecessary indefinite storage without compromising legitimate legal recordkeeping obligations.
6. Assess Employee Monitoring and Workplace Technology
Modern employers increasingly use attendance systems, security cameras, biometric identification and monitoring software.
While these systems can support operational management, they may also collect personal information relating to employees’ activities or identities.
Under Clause 3, Article 25, technological measures used to collect employee personal data must comply with applicable law, protect employees’ rights and interests, and be implemented on the basis that employees clearly understand the measures being used.
The law also prohibits processing or using employee data collected through unlawful technological measures.
Employers should therefore review how monitoring tools operate, the purpose of collection, access permissions and how employees are informed.
Biometric information and other sensitive categories may be subject to additional requirements under the broader personal data protection framework.
Introducing monitoring software should not be treated solely as an IT procurement decision. HR and the appropriate compliance personnel should also assess its legal implications.
7. Manage Outsourced Payroll and Overseas Data Access
For foreign-invested companies, employee information may be handled by several entities within a corporate group.
For example, an overseas parent company may operate a centralized HR system, while a Vietnamese subsidiary engages an external payroll provider.
These arrangements can involve personal data transfers, remote access or processing by third parties.
Businesses should examine the role of each entity, the purpose of processing and the legal requirements under Law No. 91/2025/QH15 and Decree No. 356/2025/ND-CP.
Cross-border data requirements may apply depending on the actual data flow and relevant legal exceptions. However, it would be incorrect to assume that every form of overseas system access automatically requires the same procedure.
An appropriate starting point is to map the data flow: identify which information is processed, where it is accessed, who receives it and for what purpose.
Companies should also examine service contracts, access controls and the allocation of responsibilities between internal departments and external vendors.
8. Penalties for Violations Involving Employee Personal Data
Article 61 of Decree No. 330/2026/ND-CP establishes administrative penalties for personal data protection violations arising during recruitment and employment management.
| Violation category | Statutory penalty range |
|---|---|
| Excessive or improper applicant data collection, misuse of recruitment information, and specified failures to delete applicant data | VND 20–50 million |
| Improper employee data retention and specified unlawful or undisclosed monitoring practices | VND 50–70 million |
| Processing or using employee data collected through unlawful technological measures | VND 70–100 million |
These are penalty ranges specified in Article 61. The applicable amount in an individual case depends on the full statutory provisions, the responsible party and relevant circumstances.
The regulations illustrate that compliance risks are not limited to major data breaches.
A company may also face legal consequences for collecting unnecessary candidate information or retaining employee records beyond an applicable period.
This makes routine HR administration an important area of personal data protection compliance.
9. Practical HR Personal Data Protection Checklist
The following checklist can support an internal compliance review.
| Review area | Key question |
|---|---|
| Applicant forms | Is all requested information necessary for recruitment? |
| Consent and processing purposes | Are processing activities properly explained and supported? |
| Unsuccessful applicants | Is there an appropriate deletion or retention procedure? |
| Employee records | Are legal and contractual retention periods identified? |
| Workplace monitoring | Are employees informed of the relevant technological measures? |
| Access controls | Is employee and payroll data access restricted appropriately? |
| Service providers | Are processing responsibilities and safeguards defined? |
| Overseas data access | Have the actual data flows and applicable cross-border requirements been assessed? |
This is a suggested management checklist, not an official government-issued compliance form.
10. Frequently Asked Questions
Can an employer retain an unsuccessful applicant’s CV?
Article 25 generally requires deletion or destruction of unsuccessful applicants’ information unless another arrangement has been agreed with the applicant. Companies wishing to maintain a candidate database should review the relevant basis and scope of retention.
Must employers delete all employee records immediately after employment ends?
Not necessarily. Certain records may remain subject to statutory retention requirements or appropriate agreements. Businesses should classify their records rather than apply one deletion deadline to every document.
Can companies use CCTV or employee monitoring software?
Such tools may be used where their application complies with relevant law and employees clearly understand the measures being used. Additional restrictions may apply depending on the types of data involved.
Can an overseas parent company access employee records in Vietnam?
The arrangement must be evaluated based on the actual processing activities, legal roles, data flows and cross-border requirements. International access is not automatically prohibited, but neither should it be assumed to be unrestricted.
Does the law apply to small companies?
The personal data protection framework is not restricted to large corporations. The specific obligations and any applicable exemptions should be assessed according to the organization and its processing activities.
11. How PHAM CONSULT Can Support Business Compliance
Managing personal information requires coordination between employment administration, payroll, accounting, IT systems and corporate governance.
For foreign-invested companies, additional complexity can arise from shared international systems and outsourced administrative functions.
PHAM & ASSOCIATES CONSULTING COMPANY LIMITED (PHAM CONSULT) provides payroll, labor compliance and business management advisory services to companies operating in Vietnam.
Depending on the agreed engagement scope, PHAM CONSULT can support businesses with payroll administration and reviews of related HR processes and documentation.
For information about the firm’s services, visit PHAM CONSULT Services or Contact PHAM CONSULT.
Website: https://phamconsult.com/
Email: info@phamconsult.com
Ho Chi Minh City Office: +84 28 3930 2487
Disclaimer: This article provides general information as of November 3, 2026. Actual obligations depend on the data involved, the nature of processing, the parties’ legal roles and applicable statutory exceptions. This material does not replace professional legal advice for a specific organization.
