What is biometric data in Vietnam? Examples and how to protect it

What is biometric data, and what should a business watch out for when using fingerprint time clocks? This is a practical question for HR, IT and legal teams. Understanding the concept helps you check exactly what data a system collects, rather than relying only on the vendor's pitch. Fingerprint and face-recognition time clocks are especially common in factories and industrial parks.

What is biometric data in Vietnam under the Personal Data Protection Law?

Clause 2, Article 31 of Law 91/2025/QH15 defines this category of information by reference to physical attributes and distinctive, stable biological characteristics used to identify a person. You can check this against the digitally signed text of the Law on the Government portal.

In practice, a device may record fingerprints or extract facial features for matching when a user logs in. What is stored may be the original image or a feature template, depending on the design. So the question to ask is what the system stores, not just whether it stores images.

Common examples of biometric data

Fingerprints on a time clock

Employees enrol their fingerprints, then scan again so the system can match them and record working hours. The enrolment template used for identification is biometric data. The table of clock-in and clock-out times linked to an employee ID is also personal data, but not every time-keeping record is a biometric template.

Facial features for authentication

An application may analyse facial geometry and create a matching template. This example is different from simply storing a portrait photo on a profile. To classify correctly, the business needs to check the recognition feature, the input data, the template generated and the purpose of use.

Irises for access control

Some systems use iris characteristics to verify identity at restricted areas. This is an application of biological attributes for identification. The choice of technology should be based on need and risk; convenience does not replace determining the legal basis for processing.

Is biometric data in Vietnam sensitive data?

Yes. Point dd, Clause 1, Article 4 of Decree 356/2025/ND-CP places this category on the list of sensitive data. Clause 2 of the same article requires organisations to establish rules restricting access, processing procedures and security measures. See the Decree in the Official Gazette of the Government and the entry on sensitive personal data.

Unlike a password, which can be changed, biological characteristics are tied to the body. If the information is exposed, the user can hardly replace that characteristic. Businesses should assess the consequences from the design stage, especially when one recognition system serves multiple locations or multiple groups of people.

What to watch for with fingerprint and facial time-keeping

Determine the purpose and legal basis for processing

The business needs to make clear why biometric identification is needed, rather than simply recording attendance. Where consent is relied on, Article 9 of the Law applies: consent must be voluntary, given with clear knowledge of the relevant information, expressed for each purpose and verifiable. Signing an employment contract should not be treated as blanket approval for every future use.

One practical option is to consider employee badges or manual confirmation for suitable situations. This is a risk-reduction suggestion for process design, not a statement that every system must have the same alternative. See also managing employee personal data.

Check where the data goes

Ask the vendor to describe where templates are stored, who can access them remotely, where the servers are located and who provides maintenance. If data flows abroad, the related obligations need to be assessed for the actual flow. Do not assume that a device located in the office means all the data stays in Vietnam.

Manage vendors and retention periods

The agreement should clearly state the scope of biometric data processing, security and how data is handled when the service ends. When an employee leaves, the need to keep the recognition template must be assessed separately from the need to keep time-keeping records. The two types of data may serve different purposes and have different retention periods.

How businesses can protect biometric data in Vietnam

Clause 4, Article 31 requires physical security for storage and transmission devices, restricted access and a monitoring system to prevent and detect intrusions. Based on that requirement, businesses can implement the following measures according to their design and actual risk:

• Assign administrative rights by role and revoke rights when staff change.
• Encrypt data in transit and at rest, and manage keys separately from the data where appropriate.
• Log access, review data export operations and alert on anomalies.
• Check backups, template deletion and the vendor's maintenance accounts.

Encryption does not automatically make data non-personal. If the system still uses the template to identify a person, it must continue to be managed accordingly. The business also needs to assess its obligations regarding a DPIA impact assessment dossier before putting the technology into operation.

Before buying a device, draw up a list of the data, a map of where it is stored and the security requirements to discuss with the vendor. LexData can help review data protection processes from enrolment through to template deletion.

For biometric recognition or time-keeping projects, businesses can consider our personal data processing impact assessment and DPIA dossier service. Determining the obligations requires looking at the specific activity, roles and exemptions; using biometric technology is not the only basis for drawing conclusions about the filing procedure.