Personal data protection in manufacturing: factories, industrial parks and FDI manufacturers
Data protection in manufacturing is mostly about employee data. A factory with a few thousand workers holds HR files, health check results, fingerprints or face templates for time attendance and CCTV footage of every person. Much of this is sensitive data under Decree 356/2025/ND-CP, so factories must follow the employment rules in Article 25 of Law No. 91/2025/QH15, prepare a DPIA, and file a separate dossier when HR data goes to a parent company abroad.
Personal Data Protection Law No. 91/2025/QH15 (Articles 20, 25, 31); Decree 356/2025/ND-CP; Decree 330/2026/ND-CP (Articles 56, 61); Labour Code No. 45/2019/QH14 (Articles 16, 17); Law on Occupational Safety and Health No. 84/2015/QH13 (Articles 21, 27); Circular 56/2025/TT-BYT; Law on Identification No. 26/2023/QH15 (Article 7); Accounting Law No. 88/2015/QH13 (Article 41)
Official legal texts
Key takeaways on data protection in manufacturing
- The core of data protection in manufacturing is employee data. Article 25 of Law 91/2025/QH15 limits recruitment questions to what the job requires, requires deleting unsuccessful candidates' files, and requires deleting employee data when the contract ends unless an agreement or another law says otherwise.
- Facial or fingerprint time attendance and periodic health checks are both sensitive data processing. Even a small factory therefore usually cannot use the DPIA and DPO relief for small businesses (Clauses 2 and 3, Article 38 of Law 91/2025/QH15).
- Sending HR data to a parent company or a regional shared service centre abroad is a cross-border transfer. The exemption in Point b, Clause 6, Article 20 covers only storing an organisation's own employee data on a cloud service; Point d, Clause 3, Article 17 of Decree 356/2025/ND-CP adds an exemption for transfers to manage staff across borders under labour rules, regulations and collective labour agreements.
Personal data processed in manufacturing
| Data group | Examples | Classification |
|---|---|---|
| HR files and labour contracts | Name, date of birth, hometown, education, social insurance number, tax code, dependants | Basic |
| Payroll bank accounts | Account number, bank, salary payment history | Sensitive |
| Health data | Pre-employment and periodic health checks, occupational disease examinations, workplace accident records, sick notes | Sensitive |
| Biometric data | Fingerprints and face templates for time attendance, gates and access to production areas | Sensitive |
| ID card images and identity documents | Citizen ID photos taken at hiring, passports and work permits of foreign experts, visitors' and contractors' ID cards at the gate | Sensitive |
| CCTV footage and monitoring data | Cameras on production lines, warehouses, gates and canteens; computer and work email logs | Basic |
| Location data | GPS on worker shuttle buses and delivery vehicles, trackers for sales staff | Sensitive |
Classified under the lists in Articles 3 and 4 of Decree 356/2025/ND-CP. The same information may be classified differently depending on the context of processing.
1. Who needs to think about data protection in manufacturing?
Data protection in manufacturing applies to every business running a factory or workshop in Vietnam, whether Vietnamese-owned or foreign-invested. Unlike retail or finance, a factory's largest dataset is not about customers but about its own workforce. Typical businesses include:
- FDI factories in industrial parks: electronics, textiles and garments, footwear and auto parts, with thousands of workers, foreign experts and HR systems connected to the parent company.
- Suppliers and contract manufacturers (OEM, ODM): often asked to prove compliance when international customers audit their supply chain.
- Labour supply agencies and security, canteen and shuttle bus contractors: they hold workers' data under contracts with the factory.
- Manufacturers with their own sales channels: besides employee data, they hold data on distributors, dealers and warranty customers.
Personal Data Protection Law No. 91/2025/QH15 applies to foreign organisations in Vietnam and to foreign organisations directly involved in processing Vietnamese citizens' data (Clause 2, Article 1). A parent company abroad that accesses factory workers' data in Vietnam is therefore also within scope.
One point that is easy to miss: small factories rarely qualify for the DPIA and DPO relief. The relief in Clauses 2 and 3, Article 38 of Law 91/2025/QH15 excludes businesses that directly process sensitive personal data, and most factories use fingerprint or facial attendance and keep workers' health check results.
2. Article 25: employee data from hiring to exit
Article 25 of Law 91/2025/QH15 is the specific rule on personal data in recruitment, management and use of employees, and it sits at the centre of data protection in manufacturing. It covers three stages:
- Recruitment (Clause 1): ask only for information needed for recruitment; use it only for recruitment and other agreed purposes; obtain the candidate's consent; delete the data of unsuccessful candidates unless otherwise agreed.
- Employment (Clause 2): keep employee data for the period set by law or agreement, and delete it when the contract ends unless an agreement or another law says otherwise.
- Monitoring technology (Clause 3): use only lawful technological and technical measures that employees clearly know about, and never process data collected by unlawful measures.
In a factory, Clause 3 covers production line cameras, biometric attendance, computer monitoring software, shuttle bus tracking and wearable safety devices. See employee personal data for the general rules.
3. Sector rules: labour, occupational safety and identity documents
Data protection in manufacturing sits alongside the labour rules factories already follow. Under Clause 2, Article 5 of Law 91/2025/QH15, specific personal data rules in laws passed before 1 January 2026 continue to apply if they do not conflict with the Law's principles.
- What employees must disclose: when signing a labour contract, employees give truthful information on their name, date of birth, gender, residence, education, vocational skills, confirmation of their health status and other matters directly related to the contract that the employer asks for (Clause 2, Article 16 of Labour Code No. 45/2019/QH14). This is a natural limit on what can be collected under Clause 1, Article 25 of Law 91.
- No keeping original documents: employers may not keep the originals of employees' identity papers, diplomas or certificates (Clause 1, Article 17 of the Labour Code). This includes foreign experts' passports.
- Health checks and health records: employers must arrange health checks at least once a year, and at least every six months for heavy, hazardous or dangerous work and certain other groups (Clause 1, Article 21 of the Law on Occupational Safety and Health No. 84/2015/QH13), and must keep and manage workers' health records (Clause 2, Article 27). The records are kept while the worker is employed and returned to the worker on leaving (Clause 1, Article 18 of Circular 56/2025/TT-BYT). The results are health data, a sensitive category.
- ID cards: Clause 2, Article 7 of the Law on Identification No. 26/2023/QH15 prohibits keeping ID cards in breach of the law. Holding visitors' and contractors' ID cards at the gate should be replaced with visitor badges.
- Payroll records: accounting vouchers used directly to record the books must be kept for at least 10 years (Point b, Clause 5, Article 41 of Accounting Law No. 88/2015/QH13). Salary payment sheets normally fall into this group, although the law does not name them. This is the legal basis for keeping part of a leaver's data, under the "another law provides otherwise" exception in Point c, Clause 2, Article 25 of Law 91.
4. Five common risks in data protection in manufacturing
These are the situations LexData sees most often when reviewing data protection in manufacturing, especially in industrial-park factories.
Biometric attendance with no alternative
Facial recognition terminals stop "buddy punching", but face templates are biometric data. Many factories install the terminals and enrol every worker with no written notice or consent and no option for those who object. Consent must be voluntary and given for each purpose (Clauses 2 and 4, Article 9 of Law 91/2025/QH15). The factory must also physically secure the devices that store and transmit biometric data, restrict access and run monitoring to detect breaches (Point a, Clause 4, Article 31). Check whether the attendance vendor syncs templates to its own servers.
Factory CCTV and computer monitoring
Factory CCTV for security, safety and quality control is reasonable, but workers must be clearly informed (Point a, Clause 3, Article 25). Clause 2, Article 61 of Decree 330/2026/ND-CP fines VND 50–70 million for installing tracking software or workplace cameras without notice. Using data collected through unlawful measures is fined VND 70–100 million (Clause 3, Article 61). See also CCTV and camera surveillance.
HR data sent to the parent company abroad
FDI manufacturers often use a group HRIS, send payroll to a regional shared service centre or report headcount data to headquarters. Each of these flows is a cross-border data transfer under Clause 1, Article 20 of Law 91/2025/QH15. The exemption in Point b, Clause 6, Article 20 refers only to storing employee data on a cloud service, not to the parent company using it. Point d, Clause 3, Article 17 of Decree 356/2025/ND-CP adds an exemption for transfers to manage staff across borders under labour rules, regulations and collective labour agreements; the factory should assess whether each flow falls within it. Flows outside the exemptions need a Form No. 09 dossier filed with the A05 Department within 60 days.
Health check results reaching line managers
Partner clinics often send full periodic health check results to HR, who then pass them to production managers to assign positions. A line manager only needs to know whether a worker is fit for the role, not the diagnosis. Keep health records separate from HR files, limit who can see them and have the partner clinic sign a data processing agreement.
Contractors and labour agencies holding workers' data
Labour supply agencies and security, canteen and shuttle bus contractors all receive worker lists from the factory, and many service contracts have no data protection clause. A transfer agreement that does not set out data protection responsibilities is fined VND 20–30 million (Clause 1, Article 52 of Decree 330/2026/ND-CP). The factory needs a data processing agreement with each contractor and the right to check compliance.
5. Data protection in manufacturing: obligations and legal basis
The table below summarises the main obligations. Each row is an item for your factory's plan for data protection in manufacturing.
Obligations table: data protection in manufacturing in Vietnam
| Obligation | Legal basis | In the factory |
|---|---|---|
| Collect only what recruitment needs, with the candidate's consent | Clause 1, Article 25 of Law 91/2025; Clause 2, Article 16 of the Labour Code 2019 | Application forms, interviews, pre-employment health checks |
| Delete unsuccessful candidates' files | Point c, Clause 1, Article 25 of Law 91/2025; Clause 1, Article 61 of Decree 330/2026 | Paper files, email, data on job platforms |
| Make sure workers know about monitoring | Point a, Clause 3, Article 25 of Law 91/2025; Clause 2, Article 61 of Decree 330/2026 | Factory CCTV, monitoring software, vehicle GPS |
| Consent and security for biometric data | Article 9, Clause 4, Article 31 of Law 91/2025 | Facial and fingerprint attendance, access control |
| Do not keep original identity documents | Clause 1, Article 17 of the Labour Code 2019; Clause 2, Article 7 of the Law on Identification 2023 | Workers' ID cards, experts' passports, visitors' ID cards at the gate |
| Health checks, health records and returning them | Articles 21 and 27 of the Law on Occupational Safety and Health 2015; Circular 56/2025/TT-BYT; Article 4 of Decree 356/2025 | Periodic and occupational disease checks; records returned at exit |
| Data processing agreements with contractors | Articles 17 and 37 of Law 91/2025; Article 52 of Decree 330/2026 | Labour agencies, security, canteen, shuttle buses, HR software |
| DPIA filed with the A05 Department within 60 days | Article 21, Clauses 2 and 3, Article 38 of Law 91/2025 | Required when processing biometric or health data |
| Cross-border transfer dossier | Article 20 of Law 91/2025; Form No. 09 of Decree 356/2025; Article 56 of Decree 330/2026 | Group HRIS, reports to headquarters, regional service centres |
| Delete data at exit, except what the law requires | Point c, Clause 2, Article 25 and Article 14 of Law 91/2025; Clause 2, Article 61 of Decree 330/2026 | Fingerprints, photos, system accounts; keep payroll records for 10 years under the Accounting Law |
6. Data protection in manufacturing for FDI companies
For foreign-invested factories, data protection in manufacturing differs from the parent company's usual practice in three ways:
- Group policies are not enough: a GDPR-based or Japanese or Korean group policy is a good foundation, but Vietnam requires a DPIA dossier and a cross-border transfer dossier filed with the A05 Department, a step with no European equivalent. Law 91/2025/QH15 also has no mechanism like binding corporate rules (BCRs) to replace these dossiers.
- Supply chain audits: international customers increasingly include workers' data protection in supplier audit criteria. A compliance file built on Vietnamese law helps the factory answer these audits.
- Foreign experts: passports, work permits (issued under Decree 219/2025/ND-CP) and family details of expatriate staff are also personal data protected by Law 91, even though they are not Vietnamese citizens: the factory is an organisation in Vietnam (Clause 2, Article 1), and the definition of personal data in Clause 1, Article 2 is not limited by nationality.
If the factory is being acquired or merged, employee data needs its own due diligence. See LexData's PDPL compliance consulting.
Insight from lawyer Ho Thi Ha Nhi
"In a factory, data protection in manufacturing starts in the HR office and at the security gate, not in the IT department. I recommend checking two things first: whether your facial attendance terminals have written consent and an alternative, and which routes your HR data takes out of Vietnam. These are the two questions both the A05 Department and international customers will ask."
Data protection in manufacturing: implementation checklist
- Map employee data from hiring to exit: candidate files, HRIS, time attendance, payroll, insurance, occupational health, security, shuttle buses and canteen.
- Review recruitment forms: remove questions the job does not need, obtain candidates' consent and set a deletion date for unsuccessful candidates.
- For biometric attendance: give clear notice, get separate consent, offer an alternative such as an access card, restrict access and document whether templates are stored on the device or on a server.
- Tell workers in writing where factory CCTV, computer monitoring and email monitoring are used; never place cameras in changing rooms, toilets or the medical room.
- Keep health check results out of the general HR file: HR receives only a fit or unfit conclusion, and the medical team holds the detailed records.
- Sign data processing agreements (DPAs) with labour supply agencies, security contractors, canteen operators, shuttle bus operators, partner clinics and HR software vendors.
- Prepare a DPIA dossier on Form No. 10 and, if HR data goes to the parent company or a global HRIS, a cross-border transfer dossier on Form No. 09; file both with the A05 Department within 60 days.
- Train shift leaders, security guards and HR staff on data protection in manufacturing, especially on photographing workers and sending worker lists through personal chat apps.
- Schedule deletion when employees leave, keep only what the law requires (such as payroll records), return health records to the employee and record the legal basis for keeping anything.
FAQ: data protection in manufacturing in Vietnam
Can a factory require workers to clock in with facial recognition?
It is high risk. A face template used for identification is biometric data, which is sensitive. Consent must be voluntary and may not be made a condition for other purposes (Clauses 2 and 4, Article 9 of Law 91/2025/QH15), and employees rarely feel free to refuse their employer. The safe approach is clear notice, written consent and an alternative such as an access card or PIN for anyone who declines. The factory must also secure the devices that store biometric data and restrict access to it (Clause 4, Article 31).
Does factory CCTV need each worker's consent?
The law does not require individual consent for security cameras, but workers must be clearly informed about the monitoring (Point a, Clause 3, Article 25 of Law 91/2025/QH15). Installing workplace cameras without notice is fined VND 50–70 million (Clause 2, Article 61 of Decree 330/2026/ND-CP). Put camera locations and purposes in the internal labour rules, post signs and keep cameras out of private areas.
Our parent company in Japan or Korea wants our HR data. What do we need?
This is a cross-border transfer of personal data (Point b, Clause 1, Article 20 of Law 91/2025/QH15). Unless the flow falls within the exemption for cross-border staff management in Point d, Clause 3, Article 17 of Decree 356/2025/ND-CP, the factory must prepare a transfer impact assessment dossier on Form No. 09 of Decree 356/2025/ND-CP and file it with the A05 Department within 60 days of the first transfer, sign an agreement with the parent company, and send only the data needed for group management. No dossier is fined VND 30–50 million; no contract or inadequate security is fined VND 50–100 million (Clauses 1 and 2, Article 56 of Decree 330/2026/ND-CP).
Is a cloud HRIS hosted abroad exempt from the transfer dossier?
It can be, if it is only storage. Point b, Clause 6, Article 20 of Law 91/2025/QH15 exempts an organisation that stores its own employees' personal data on a cloud service. But if parent company or regional staff access and analyse the data to make decisions, a cautious reading is that this goes beyond storage, and a dossier should be filed.
A worker who has left asks us to delete all their data. Must we?
The factory must delete employee data when the contract ends, unless an agreement or another law provides otherwise (Point c, Clause 2, Article 25 of Law 91/2025/QH15). Data the law requires you to keep, such as payroll accounting records, can be kept until the retention period ends, and the worker must be told why (Clause 5, Article 14). Health records are not kept: they are returned to the worker on leaving (Clause 1, Article 18 of Circular 56/2025/TT-BYT). Other data, such as attendance fingerprints and photos in internal chat groups, should be deleted straight away.
Our security guards hold visitors' and contractors' ID cards at the gate. Is that a problem?
Yes, it is a risk. Clause 2, Article 7 of Law on Identification No. 26/2023/QH15 prohibits keeping ID cards in breach of the law, and a photo of an ID card is sensitive data under Article 4 of Decree 356/2025/ND-CP. Switch to recording the document number in the visitor log or issuing visitor badges, do not keep original cards, do not photograph ID cards unless necessary, and delete the visitor log on a fixed schedule.
Does a small factory with under 100 workers need a DPIA and a DPO?
Usually yes, if it uses fingerprint or facial attendance or keeps health check results. A small business may choose not to prepare a DPIA or designate a DPO only if it does not directly process sensitive data and processes the data of fewer than 100,000 people (Clause 2, Article 38 of Law 91/2025/QH15; Article 41 of Decree 356/2025/ND-CP). Biometric data and health data are both sensitive.
Ho Thi Ha Nhi
Founding Lawyer, LexData Consulting · Ho Chi Minh City Bar Association
The Vietnamese original of this page has been reviewed against the Personal Data Protection Law No. 91/2025/QH15, its implementing decrees and the sector legislation cited. This English edition is an unofficial translation for reference; the official legal texts are in Vietnamese.
