What is employee personal data in Vietnam? Rules on processing employee data under the PDPL

What does managing employee personal data in Vietnam require under the PDPL?

Protecting employee personal data in Vietnam under the PDPL requires businesses to rethink completely how they manage information about their workforce. In running a business, HR data is one of the largest, most detailed and longest-held bodies of personal data. In the past, many businesses were used to treating employee information as an internal asset owned by default by the employer. With the arrival of the Personal Data Protection Law No. 91/2025/QH15, this legal view has changed fundamentally: employees are data subjects with full rights, and the employment relationship does not strip them of their constitutional rights to privacy.

Under Article 25 of Law 91/2025/QH15, the State has established a dedicated regime that comprehensively governs personal data protection responsibilities in recruiting, managing and using employees. It reflects a balance between the employer's lawful right to manage and run the business and the employee's right to personal data protection, in a relationship of legal and economic dependence.

1. Classifying employee personal data in Vietnam under Law 91/2025/QH15

To manage compliance effectively, HR and Legal need to classify each employee data field correctly into one of the two categories under the law:

• Basic personal data: full name, date of birth, gender, citizen identity card or passport number, permanent residence, temporary residence, email address, personal phone number, education, work experience, personal tax code, social insurance book number, and information on dependants for family deductions. This data is collected to enter into contracts and pay salaries under labour law.
• Sensitive personal data (under Article 4 of Decree 356/2025/ND-CP): biometric data (fingerprints, FaceID used for timekeeping machines or door access control systems); health information, medical records, periodic health check results; criminal record information (convictions and prior administrative sanctions); geolocation (GPS) data if the company installs an app to track the routes of sales staff or drivers on their devices; and logs tracking employees' use of services in cyberspace (Point l, Clause 1, Article 4). Payroll bank account numbers are a separate case: the list in Point k, Clause 1, Article 4 covers only bank account login names and passwords, card information, transaction history and customers' financial information held by credit and financial institutions, so a payroll account number held by the employer is basic data, although it should still be kept strictly confidential.

Clause 4, Article 6 of Decree 356/2025/ND-CP makes clear that when asking for consent to process sensitive personal data, employees must be informed that the data to be processed is sensitive personal data, and the processing must fall within the scope of the personal data processing impact assessment (DPIA) dossier sent to the specialised personal data protection authority (the A05 Department, Ministry of Public Security) under Article 21 of Law 91/2025/QH15. Businesses that directly process sensitive data cannot use the option not to prepare a DPIA that is available to small, micro and start-up businesses (Clauses 2 and 3, Article 38 of Law 91/2025/QH15).

2. Data protection responsibilities across the 3 stages of the employee lifecycle

Stage 1: Recruitment (pre-employment)

Under Clause 1, Article 25 of Law 91/2025/QH15, recruiting organisations are bound by 3 strict legal principles:

1. They may request only information that directly serves recruitment for the position concerned. Businesses must not ask applicants to disclose unrelated, privacy-intrusive information such as marriage plans, plans to have children, religious views or personal credit history.
2. All information provided must be consented to by the applicant before it is processed. Careers portals and application forms must therefore include a privacy notice and a transparent mechanism for recording consent.
3. Obligation to delete or destroy the files of unsuccessful applicants: under Point c, Clause 1, Article 25, the business must delete or destroy the entire file (CV, reference letters, recruitment test results) of applicants who are not hired. If it wants to keep an applicant's file in its talent pool for future opportunities, the business must have a separate retention agreement with that applicant; see personal data retention periods.

Stage 2: Managing and using employees (active employment)

Under Clauses 2 and 3, Article 25, while the employment relationship is running, the employer must:

• Comply at the same time with the Personal Data Protection Law, the 2019 Labour Code, the Law on Occupational Safety and Hygiene and the Law on Social Insurance.
• Store employee data only for the period provided by law or clearly agreed between the parties.
• Apply technological and technical measures in managing employees only with safeguards: tools such as fingerprint timekeeping machines, face-scanning cameras, remote device monitoring software (MDM/DLP) or GPS tracking systems may be used only when they comply with the law, safeguard employees' rights and interests, and employees are clearly aware of the measure (Point a, Clause 3, Article 25). Where the measure collects biometric or location data, the business also needs the employee's consent (Article 9; Point a, Clause 3, Article 31), except in the cases under Clause 1, Article 19. Installing device-tracking software, CCTV cameras or other data-collecting devices in the workplace without notifying employees is penalised under Point c, Clause 2, Article 61 of Decree 330/2026/ND-CP; businesses should not install tracking software on employees' personal devices (BYOD). Factories that combine fingerprint or FaceID time clocks with CCTV on the production floor should also read our guide to data protection in manufacturing.

Stage 3: Termination and handover (offboarding)

Point c, Clause 2, Article 25 states clearly that the business must delete or destroy the employee's personal data when the employment contract ends, unless otherwise agreed or provided by law. In practice this often clashes with the obligation to keep tax and accounting records (for 5 to 10 years) or social insurance contribution data. The standard legal solution is to split the data into two groups: (1) data used for internal management (ID photos, biometrics, software accounts, correspondence logs), which should be deleted immediately; and (2) statutory financial and accounting records, which should be moved to a restricted-access archive reserved for tax and insurance inspections.

3. A 4-step guide to building an employee data compliance programme

To meet all the requirements of Article 25 of Law 91/2025/QH15 and avoid legal risk, businesses should implement the following 4-step standardisation plan recommended by our experts:

Step 1: Separate the data processing agreement from the employment contract

Many businesses make the mistake of inserting a short sentence such as 'the employee agrees that the company may process all information' at the end of the employment contract. This does not meet the standard of voluntary and transparent consent. The business should issue a separate, standalone employee personal data processing agreement (Employee Privacy Notice & Consent Agreement) that lists in detail: the types of data collected, the purposes of processing, the third parties that receive the data (health insurers, payroll banks, HRM SaaS software vendors) and the employees' rights.

Step 2: Review the careers portal and recruitment process

The business should update its recruitment rules: its careers website or applicant information form must include a clause letting applicants choose whether or not to allow the company to keep their file if they are unsuccessful. Set up a mechanism that periodically and automatically deletes the CVs of unsuccessful applicants after the recruitment round ends, unless the applicant has given written consent.

Step 3: Finalise the rules on workplace monitoring technology

If the company uses fingerprint or facial recognition timekeeping devices or software that tracks working time on computers, management should:

• Issue a Policy on the use of technology devices and workplace monitoring and communicate it widely to all employees before applying it.
• Provide an alternative timekeeping method (for example, a magnetic card or PIN code) for employees who do not consent to the collection of facial biometric data.
• Store only the feature template of fingerprints or faces, in encrypted or one-way hashed form, not the original image files, to prevent leaks of biometric data.

Step 4: Establish a data lifecycle and retention policy (HR Retention Policy)

HR, IT and Accounting should work closely together to build an access-rights matrix: colleagues' access to a former employee's data must be revoked automatically as soon as the resignation decision is made; email accounts and personal cloud storage partitions must be backed up and deactivated in line with the handover procedure.

4. Administrative penalties for mishandling employee personal data in Vietnam under Decree 330/2026/ND-CP

Under Decree 330/2026/ND-CP, violations of the personal data protection rules in recruiting, managing and using employees are penalised under Article 61, with fines from VND 20,000,000 to VND 100,000,000 for organisations, depending on the conduct and its severity:

• Asking applicants for data that does not serve recruitment, processing applicant data without consent, or failing to delete or destroy the files of unsuccessful applicants (unless otherwise agreed): a fine of VND 20,000,000 to VND 50,000,000 (Clause 1, Article 61), together with the remedial measure of being forced to delete or destroy the data for processing without consent and for failing to delete applicant files.
• Storing employee data beyond the permitted period, failing to delete data when the employment contract ends, or applying technological monitoring measures that employees are not clearly aware of (such as installing device-tracking software or CCTV cameras without notice) or that do not comply with the law: a fine of VND 50,000,000 to VND 70,000,000 (Clause 2, Article 61).
• Processing or using employee data collected through unlawful technological or technical measures: a fine of VND 70,000,000 to VND 100,000,000 (Clause 3, Article 61), together with being forced to delete the data and surrender the unlawful proceeds.
• Other violations concerning employee data: where sensitive data, unlawful provision/disclosure of data or a data leak is involved, the conduct may also be dealt with under other corresponding articles of Decree 330/2026/ND-CP.

Note: fines calculated as a percentage of revenue (1–5% of the previous year's revenue in the Vietnamese market) apply only to certain violations concerning cross-border transfers of personal data under Article 56 of Decree 330/2026/ND-CP, not to ordinary employee data violations. See the handbook entry Penalties for personal data protection violations for details.

Because employee files pass through many departments from recruitment to departure, an outsourced DPO can help track obligations and coordinate HR, Legal and IT. Businesses can also choose personal data protection training for their HR team so that staff can recognise situations that should be raised with the person in charge.